EMA Policy 0070 requires the publishing of all clinical reports submitted as part of MAAs, so it is important to highlight what new challenges this may bring for the writing of these documents.

Writing the clinical sections of a dossier to apply for marketing authorisation application (MAA) of a medicinal product is no small feat. The clinical modules of the common technical document dossier (modules 2.5 and 2.7) comprise five different documents covering the key features of a drug (the known pharmacological profile, efficacy, and safety) and, combined, are hundreds of pages long. It takes a concerted effort and focused oversight to ensure these documents, which are being written in parallel to each other, present a cohesive picture of the data collected during clinical development.

With the requirement introduced by EMA Policy 0070 to proactively publish all of the clinical reports submitted as part of MAAs, a new level of complexity has been introduced to the writing of these documents. Many teams are not yet fully aware of the fact that these documents (modules 2.5 and 2.7, the clinical study reports in module 5, and appendices 16.1.1, 16.1.2, and 16.1.9 of those reports) will be made publicly available (1-3). They are also not aware of the effort involved to redact those documents, before making them public, to prevent publishing material that could potentially allow re-identification of individual patients – personal protected data (PPD) – or that could release commercially confidential information (CCI).

Authoring teams generally err on the conservative side when deciding to include material in a clinical summary or not; if it might be helpful for the assessors at the agencies, they include it. Teams now need to be made aware of the implications of making some of that information publicly available. Ideally, clinical summaries should be written in such a way that enables public disclosure without the need for too much redaction, while ensuring assessors have all information to fully evaluate the product. The goal is also to retain a maximum of scientifically useful information to ensure data are usable for secondary research. At times, however, protecting the privacy of study participants and maintaining data utility are competing objectives (1).

CHANGING THE WAY WE WRITE

The challenge, then, is to rethink how to present clinical data to provide the clinically relevant information and give insight into the effects of the medicinal product without providing any PPD. The two documents most affected by this are the clinical study report and the summary of clinical safety (module 2.7.4) as both of these present information on individual study participants.

The information traditionally provided to describe an individual and the adverse events (AEs) they experienced during a study might enable identification of an individual if direct or indirect identifiers are not protected. Of particular concern is data that may not, on their own, identify an individual, but may do so when combined with other information (indirect identifiers). If PPD is not anonymised or redacted sufficiently, a savvy adversary who wants to put the pieces together might be able to re-identify a particular person.

For example, these documents typically include a table that lists all participants who experienced serious AEs. This table provides the sex, age, and race of each participant together with the date the event occurred and/or its duration. With these details and information on the hospital at which the study was run – which reveals the region the participant lives in – and the disease the person has, there is a real possibility a reader could identify a specific person by doing some research. This gets even easier if the disease is not a common one.

Maintaining data privacy and minimising the risk for an individual to be re-identified are, thus, important prerequisites for clinical documents to be made public. We need to think about which details are really needed. For example, is it important to know the person was 36 years old? We say this to indicate the person is neither a child nor elderly, so it would be sufficient to say the person was 30-40 years old. Similarly, is it important to know the event happened on 25 March? We give the date of an event to indicate how long the person was on treatment at the time it happened. It is actually more informative to say the event happened 21 days after the start of treatment. These types of changes provide assessors with information needed to determine if there is a possible relationship to the treatment or the clinical profile of the participant, without providing PPD.

To date, implementing EMA Policy 0070 while staying on top of the constantly evolving regulatory guidelines and monitoring the status of the Agency’s Brexit hold has provided unique challenges. Although the anonymisation approach used for a Policy 0070 dossier is the responsibility of the marketing authorisation holder (MAH), previously submitted Policy 0070 dossiers received a number of detailed comments from the EMA on the anonymisation strategy. The EMA requested replies to their comments and further modifications to the anonymisation report after submission of the dossiers, although this interaction was not specified by the guidance. This substantiates the EMA’s announcement at a webinar in January 2018 that the Agency will focus more on anonymisation quality and specificity in the future (4).

Another confusing area of Policy 0070 is the statement that “clinical data cannot be considered CCI” (5). There is a lack of legal definition of what may be accepted as CCI, and it is a matter of considerable debate (6). CCI decisions are considered on a case-by-case basis. According to recent decisions of the EU General Court for three different EMA Policy 0043 cases, MAHs need to provide “concrete evidence of how the release of the contested documents would undermine their commercial interests” (7).

MAHs are to consider CCI according to the following criteria: the information is covered in Annex 3 of Policy 0070, the item is not listed in Chapter 4 of the external guidance (information not considered to be CCI), and the item does not meet any of the five rejection codes provided in the guidance. For each CCI item, MAHs must provide “a specific, pertinent, relevant, notoverstated, and appropriate justification” explaining how the release of the information would damage the company’s commercial interest (1). In the first year of Policy 0070 being in effect, proposed CCI was rejected in 76% of the instances, most frequently due to insufficient justification. The second most frequent reason was that the information an MAH considered to be CCI was actually available in the public domain (4). Most of the items accepted as CCI concerned manufacturing details and immunological bioassay specifications. Most Policy 0070 dossiers that are currently publically accessible are based on a qualitative, non-analytical assessment of the risk of patient re-identification (4, 8-9). A fairly conservative PPD approach is often chosen by companies to achieve a very low risk of re-identification, which is justified by the permanent public release of the documents and the likelihood of better technological means to re-identify individuals in the future (10). Additionally, as more personal data become publicly available over time, it will become easier to link data from Policy 0070 documents with other public data to re-identify individuals.

Finalising PPD redaction rules, preparing the PPD redaction proposals, identifying CCI, and writing the anonymisation report is a time-consuming and costly process. These tasks are typically performed by a designated MAH transparency and disclosure team in consultation with a legal expert for data protection (a privacy officer), intellectual property associates, and regulatory affairs representatives, along with members of the clinical development, pharmacology, bioassay or immunology, chemistry, manufacturing, and control, pharmacovigilance, non-clinical development, and statistics groups, as needed. Often, external vendors with Policy 0070 experience and software to search for PPD are engaged. Since identifying CCI cannot be done using a software tool, it involves a manual search through each document by subject matter experts. Once identified, justifications are created for each instance of CCI after verifying that the items are not publically available. Quality control checks throughout and across documents are done and, finally, CCI justification tables are colour coded and CCI redactions are formatted accordingly in the draft package.

PLANNING FOR TOMORROW

The EMA’s Brexit-preparedness business continuity plan communicates information about the temporary suspension or reduction of Agency activities while it prepares for the consequences of the UK’s exit from the EU (in terms of the impact on the Agency’s operations and its move to Amsterdam). In the first year that the clinical data publication website for Policy 0070 went live (between October 2016 and December 2017), the EMA published documents for 64 dossiers. By the end of 2017, a total of 337 product dossiers were subject to publication under the policy (10). This backlog, in addition to the backlog created since the EMA Brexit hold, means that the timelines defined in the policy are currently not applicable. When the hold is lifted, the EMA will be notifying MAHs of the dates that their Policy 0070 redaction proposal document packages are due. As a consequence, MAHs are left on their own to determine the amount of time and resource should be set aside for preparing Policy 0070 dossiers that would be currently due, but for which no Agency communication is yet available.

Overall, one of the biggest implications of the Policy 0070 requirement for clinical dossiers is that a lot of extra time-consuming work is involved. It takes months to properly prepare an MAA dossier for Policy 0070 submission and ensure that neither PPD nor CCI is accidentally released into the public domain. As an upstream effect of this, it has changed the way that clinical teams prepare documents for submission dossiers. With a little forethought and some changes in the way data are presented through anonymisation techniques, it is possible to retain clinically relevant information without enabling re-identification of individuals. Proactively thinking about how to write clinical documents in a way that avoids including PPD or CCI can dramatically reduce the need, and time spent, for redaction of those documents when they are prepared to be made publically available. This is in everyone’s interest because the redaction of clinical documents for Policy 0070 submissions is an enormous burden, both in terms of time and cost.

By considering the end use of a clinical document, which includes making it publicly available, medical writers can facilitate the efficiency of the redaction process by adjusting the content and structure of clinical documents. Educating authoring teams to be aware of these implications may reduce the burden of redaction at the time of publication and actually produce documents that help meet the intended goal of bringing this information to the public with minimal risk to patients.

REFERENCES

1. Visit: www.ema.europa.eu/en/documents/regulatory-procedural-guideline/external-guidance-implementation-european-medicines-agency-policy-publication-clinical-data_en-1.pdf
2. Thomas KB, Clinical trial disclosure and transparency: Ongoing developments on the need to disclose clinical data, Medical Writing: The Backbone of Clinical Development: pp63-70, 2017
3. Visit: www.ema.europa.eu/docs/en_GB/document_library/Regulatory_and_procedural_guideline/2017/04/WC500225881.pdf
4. Visit: www.ema.europa.eu/ema/index.jsp?curl=pages/news_and_events/events/2018/02/event_detail_001571.jsp&mid=WC0b01ac058004d5c3
5. Visit: www.ema.europa.eu/en/news/european-medicines-regulators-agree-common-europe-wide-approach-identification-commercially
6. Visit: www.ema.europa.eu/docs/en_GB/document_library/Other/2010/11/WC500099473.pdf
7. Visit: www.ema.europa.eu/docs/en_GB/document_library/Press_release/2018/02/WC500243216.pdf
8. Visit: clinicaldata.ema.europa.eu/web/cdp/home
9. El Emam K, An analysis of anonymization practices in initial data release pursuant to EMA Policy 0070, Applied Clinical Trials: 2017
10. Eibert SM, Policies 0070 and 0043: Juggling different requirements, Medical Writing 27(2): pp31-8, 2018