Based on considerable experience of managing companies’ early submissions, Pooja Phogat, regulation and compliance expert at Kinapse, advises on the best approaches to balancing the risk of patient re-identification with the need for greater data utility.
end goal
The European Medicines Agency (EMA) Policy 0070 provides important guidelines and processes supporting the agency’s vision for a public database of clinical research findings.1 The goal is to increase industry transparency, yet without compromising trial participants’ privacy.
With the EU’s new General Data Protection Regulation (GDPR) now imminent,2 the impetus for life sciences firms to cement their data management strategies has further increased. Initiatives by other regions such as North America3,4 around the external publication of clinical findings provide an additional driver for improving approaches to managing outward-facing information.
Faltering first steps
Early attempts by companies to fulfil Policy 0070 requirements have left quite some room for improvement. A common approach has been to redactpublic-facing content. However, the value of a heavily doctored clinical study report (CSR) is questionable. Redaction is also a painstaking process.
With other anonymisation methods, several priorities can be addressed simultaneously — the delivery of higher-value output; strong measures to protect patient privacy (information is simply hidden in plain sight); accurate risk measurement;5 and support for process automation.
Not surprisingly, this is the road EMA is recommending.
Recommended practice
Based on our work in helping life sciences companies prepare early Policy 0070-compliant submissions, Kinapse has identified the following optimal compliance approaches:
1. Look forwards.
Policy 0070 is an evolving requirement, so the most effective strategies will be those that take into account longer term requirements — as well as what is being demanded of firms now.
Policy 0070 was first introduced in January 2015, with guidance on CSR anonymisation published in March 2016, and the first submission made public that October. Phase 2 of Policy 0070, which will require that life sciences companies provide anonymised copies of all of their clinical trial data, is coming down the line, albeit that there isn’t currently a known timeline for this next stage. It is something companies should prepare for nonetheless, as it will require a more systematic and repeatable process than most companies have in place currently.
2. Get going.
Do not wait to start planning how to tackle document anonymisation. Once companies submit a marketing authorisation application to EMA, the guidance specifies that they should ideally take no more than 180 days to provide the equivalent anonymised content for the designated EMA portal, where anyone can look at it. Four and a half months might sound like a long time, but it isn’t really. While there are about 100 different ways we can address a company’s anonymisation needs for a given submission package, those options are reduced the closer firms are to the public submission’s deadline. The tightest timeframe Kinapse has worked to so far has been two months — although we still delivered as planned, this was far from ideal.
3. Manage expectations.
EMA Policy 0070 compliance is not something the majority of life sciences companies can easily manage themselves. The requirements are new, and expertise is in short supply. It’s also easy to underestimate the need for collaboration between different stakeholders.
Using a specialist service provider offers greater efficiency and reliability, not least through the chance to centralise activities. It is probably also the best route to accessing enabling technology and tools — including smart algorithms/machine learning, which over time produce faster and more accurate results by building on each anonymisation cycle.
Anonymisation methods geared to de-identification generally rely on IT to maintain data integrity, measure and manage risk, and provide auditable evidence of measures that have been taken. These techniques can deliver benefits starting at 60% improvements in time and cost efficiency compared to non-technology enabled anonymisation processes.
Managed service providers will also keep abreast of data security as they process documents, keeping companies compliant with GDPR and other data safeguarding measures. For clinical trial sponsors, this all adds up to the lowest-risk and most efficient option for managing compliance.
4. Forget redaction.
Other than in exceptional cases, defaulting to redaction as a strategy is a false economy. It is not in the spirit of clinical data transparency and it adds the least value for everyone concerned. As international requirements dovetail with EMA’s ambitions, and as Policy 0070 enters its next phase, redaction’s limitations will be exposed. This will mean that any money spent on redaction processes and work now will not count, and companies will have to invest afresh in alternative anonymisation strategies.
Keep in mind that EMA has now established a dedicated anonymisation taskforce6 to help sponsors come up with ideal methods and techniques for maintaining data utility.
5. Seek out a like-minded partner.
Once companies have accepted the need for professional help, they will need to decide what kind of outsourced service is appropriate for their requirements. Some service providers offer advisory services, but not the practical operational delivery — or the other way round. Some are light on technology; others focus too much on automation, with a risk to quality control. The optimum combination is likely to be an end-to-end service.
Remember the end goal
Finally, accept that the demands of EMA Policy 0070 are considerable. But remember too that putting off the inevitable or cutting corners could result in greater costs and pain.
Keep a clear sense of purpose — that greater goal of transparency, increased public trust and accelerated clinical breakthroughs — which key stakeholders can buy into.
References:
- European Medicines Agency policy on publication of clinical data for medicinal products for human use, EMA, October 2014: http://www.ema.europa.eu/docs/en_GB/document_library/Other/2014/10/WC500174796.pdf
- How will GDPR impact Life Sciences organisations, Kinapse, February 2018: https://kinapse.com/insight/gdpr-life-sciences/
- Public release of clinical information, Health Canada, February 2018: https://www.canada.ca/en/health-canada/programs/consultation-public-release-clinical-information-drug-submissions-medical-device-applications.html?wbdisable=true
- What’s not shared—building on the FDA’s transparency momentum, BMJ blog, January 2018: https://blogs.bmj.com/bmj/2018/01/31/tianjing-li-whats-not-shared-building-on-the-transparency-momentum/
- Questions and Answers on the External Guidance of Policy 0070 on Clinical Data Publication, EMA, September 2017: http://www.ema.europa.eu/docs/en_GB/document_library/Regulatory_and_procedural_guideline/2017/04/WC500225881.pdf
- EMA Technical Anonymisation Group (TAG): Call for applications, March 2017: http://www.ema.europa.eu/docs/en_GB/document_library/Presentation/2017/03/WC50022490pdf