Drug Enforcement Administration (“DEA”) diversion investigators conduct random, unannounced cyclic inspections of “non-practitioner” registrants (manufacturers, distributors, importers, exporters and narcotic treatment programs) about every three years.  Investigators also randomly inspect hospitals, pharmacies and practitioners.  With civil monetary penalties for violations of recordkeeping and reporting requirements adjusted for inflation up to $19,246 per violation, periodic mock DEA-style and mirror inspections and audits are more important for registrants than ever.

Mock Inspections/Audits

Periodic random internal mock DEA-style inspections are among the best tools that a registrant can undertake to prepare for actual DEA inspections.  After I left DEA I conducted mock inspections for a registered distributor every six months.  After about two years when DEA investigators conducted an actual inspection of the distributor, they found no deficiencies.  Their DEA group supervisor had never seen a perfect cyclic inspection before, and she sent the investigators back twice to find deficiencies.  The investigators still found nothing.

To ensure similar compliance while teaching employees how to manage DEA inspections, registrants are well-served by conducting periodic random DEA-style inspections comprised of controlled substance accountability audits, and record, report and security reviews.  Third-parties or knowledgeable employees without day-to-day controlled substance responsibilities for the registrant should conduct the mock inspections.  The periodic internal accountability audits of five to eight highly diverted controlled substances disclose potential losses, deter internal theft and identify potential underlying record issues.  Most important, mock inspections help ensure compliance.  They also instill familiarity and build employee confidence for actual DEA inspections.  Preparation for a mock inspection should begin with a review of prior DEA and internal inspection results to ensure that past deficiencies have been remedied, and that they are not continuing.

Mirror Inspections/Audits

When investigators conduct a controlled substance accountability audit during an inspection, registrants typically will not know the results for a number of months.  Registrants should keep in mind that investigators do make mistakes in their accountability audits and even with the records, reports and security that they review.  Registrants should rely on their own audits and reviews, not those of the investigators.  Registrants must ensure during a DEA inspection that investigators receive all required records and reports, and that they fully understand them and the security system.  During a DEA inspection, registrants should photocopy or set aside in a separate file every record and report that the investigators review or use during their inspection and accountability audit.  Concurrent with the DEA inspection, or very shortly afterwards, registrants should conduct an exact mirror of DEA’s inspection and audit.  For the accountability audit, registrants use the same beginning and ending inventories/physical counts that the investigators use, and the same receiving and disposition records for the same time period.  The mirror audit will disclose any controlled substance discrepancies.  Together the mirror inspection and audit will identify DEA’s potential findings to the registrant before the investigators may be prepared to share them.  Conducting a concurrent mirror inspection and audit will enable the registrant to respond to DEA’s findings without having to painstakingly reconstruct the inspection and audit when investigators finally share their results months later.  This is especially important if the investigators allege violations; it allows registrants to timely correct deficiencies.

****

Registrants should conduct mock DEA-style inspections and mirror inspections/audits because not only will doing so help registrants prepare and respond confidently to actual DEA inspections and audits, more importantly they ensure compliance with their obligations under the Controlled Substances Act and regulations.

Commissioner Makary’s pronouncement in April of a new pathway for rare disease therapies based on a plausible mechanism of action or biological plausibility generated enormous excitement. The Commissioner’s general statement found meaningful expression in twin announcements this past Wednesday: one by Dr. Tidmarsh of a new program for ultra-rare genetic diseases, the Rare Disease Evidence Principles (RDEP) initiative, and one by Dr. Prasad of a program for bespoke therapies that will be outlined in an upcoming New England Journal of Medicine article from Drs. Makary and Prasad.

Therapies for Ultra-Rare Disease

Rare disease drug development has always been associated with certain unique risks not as prominent in larger populations. In addition to basic operational challenges such as diagnosis, recruitment, and retention, the impact of which are all magnified with smaller numbers, there are also typically additional challenges related to demonstrating substantial evidence of effectiveness. These challenges can be derived from interpatient differences in baseline characteristics (known and unknown), heterogeneity of disease progression and symptomatology, statistical powering, a dearth of medical literature and natural history data, and a lack of well-understood and recognized endpoints. Additionally, the funding for such programs is always a challenge to secure. Typically, the rarer the disease, the greater these challenges are. For ultra-rare diseases, these challenges can be extremely formidable.

Despite these challenges, there have been some success stories, even with ultra-rare disease populations. For example, Xuriden (uridine triacetate) was approved for the treatment of hereditary orotic aciduria based on a study with 4 patients. Kebilidi (eladocagene exuparvovec-tneq) was approved for aromatic L-amino acid decarboxylase (AADC) deficiency based on a study in 13 patients. Mepsevii (vestronidase alfa-vjbk) was approved for MPS VII based on 23 patients (17 of whom were evaluable for efficacy). Brineura (cerliponase alfa) was approved for CLN2 based on a study in 24 subjects (22 of whom were evaluable for efficacy).

However, the existence of a few success stories does not show the full picture, as many other programs have fallen short because there simply was no available regulatory approach they could fit into, resulting in lost opportunities for rare disease patients. We see on a regular basis the challenges these sponsors face, where they are often asked to develop programs in the same manner as non-rare diseases, including with placebo-controlled trials, which are extremely challenging, if not impossible, to successfully conduct in such contexts. To address ultra-rare diseases, one of the co-authors, as Chair of the Everylife Foundation for Rare Diseases, helped organize the only public workshop yet held on ultra rare diseases in May 2024, at which time the co-author called on FDA to publicly embrace the pathways FDA had used for approvals such as those listed above. This public recognition by FDA of the ability to approve therapies for ultra-rare conditions based on such precedents would hopefully reset the stage for all stakeholders just as the co-author’s 2010 testimony at the FDA’s first public hearing on rare diseases and his follow-up paper cataloging FDA’s use of flexibility has ushered in a whole new approach whereby FDA began to publicly embrace its exercise of flexibility.

As mentioned above, Commissioner Makary has been previewing a “new pathway” to help address these challenges in ultra-rare populations for the past few months, and we have been eagerly awaiting announcements. The “pathway” described by Commissioner Makary is based on biological plausibility, where what is known about the condition and the genetic defect driving it, as well as the mechanism of action of the product, can be leveraged to reduce the evidentiary burden.

On Wednesday, September 3, FDA announced the “CDER/CBER Rare Disease Evidence Principles” or “RDEP” process as a more fleshed-out embodiment of what Commissioner Makary articulated. This announcement was initially rolled out at FDA’s first Rare disease Innovation, Science and Exploration (RISE) workshop convened by the FDA Rare Disease Hub. For drugs accepted for review under the RDEP process, FDA expects that substantial evidence of effectiveness “may generally be established based on one adequate and well-controlled study that may be a single arm trial, together with robust data that provides strong confirmatory evidence of the drug’s treatment effect.” RDEP does not alter the statutory standard for approval for qualifying drugs, but does “offer[] the assurance that drug review will encompass additional supportive data in the review.” The confirmatory data may include the treatment effect on the direct pathophysiology of the disease, data from a non-clinical disease model, pharmacodynamic data, other clinical data (e.g., case reports, expanded access data), natural history data, or data from external controls.

Ever since Congress passed FDAMA 115 in 1997, it has been clear that FDA may approve a drug based on “one adequate and well-controlled clinical investigation and confirmatory evidence.” However, the law did not specify when such evidence might be appropriate, leaving it to FDA discretion. FDA subsequently published guidance on the topic in 1998, 2019, and 2023, describing in successively greater detail what kind of evidence might serve as confirmatory evidence if FDA approved a drug based on the FDAMA 115 pathway. However, none of these guidance documents clearly articulated when such approach would be appropriate (e.g., from the 2023 guidance: “Disease- or condition-specific considerations (e.g., unmet need, size of the patient population) may be relevant to whether such an approach is appropriate.”).

As such, it has remained within the discretion of review divisions whether a FDAMA 115 approach is available. While this has led to regulatory flexibility enabling efficient development for certain programs, it has also been clear that this flexibility is applied unevenly. The challenges of ultra-rare drug development have been on full display in the ongoing elamipretide saga, as Stealth Biotherapeutics again seeks approval for its Barth syndrome drug based on a randomized, placebo-controlled study in 12 subjects. Our firm has experience with several other examples where flexibility seems not to have been featured in the interactions with the Agency on ultra-rare condition therapies.

This RDEP announcement appears to establish a subset of the most clearly appropriate programs for which FDAMA 115 is likely to be available, although this does not mean that approval itself is guaranteed. To us, the most exciting component of RDEP so far made public is that the adequate and well-controlled trial here “may be a single arm trial.” This is extremely helpful in an ultra-rare disease setting where randomization may be exceedingly challenging.

Many programs meeting the RDEP criteria already receive FDAMA 115 flexibility, and a number of rare disease programs are also utilizing single arm studies (see our recent post on that topic here); alternatives are not typically feasible for such programs. Nevertheless, the RDEP is a huge step forward, as it provides clarity, reliability, and efficiency to ease the development and review process for both industry and FDA officials, while maintaining FDA’s gold standard regulatory authority. While selection for RDEP would not erase all of the challenges associated with rare disease drug development, we are hopeful that implementation of RDEP will alleviate some of them, including many of those that are the most vexing.

It is also exciting to one of the co-authors who has been involved with orphan drug development since the enactment of the law in 1983 to see FDA continually work to refine its regulatory systems to address the barriers to development of therapies for our sisters and brothers affected with rare diseases, and in this case, the subset of rare diseases that are ultra rare. It should be noted that as science and medicine evolve and discover new rare conditions, these new rare diseases are overwhelmingly ULTRA-RARE so the need for FDA to adapt its regulatory structures to meet these newly discovered conditions is critical, and it is so wonderful to see that FDA is seemingly aware of this and responding!

How does RDEP work?

Eligible programs for RDEP must meet the following criteria:

1. the drug is for a very small disease population or subpopulation (“e.g., generally less than 1,000 persons in the United States);”
2. the drug is intended to treat a known inborn genetic defect that is “the major driver of the pathophysiology;”
3. the drug must be specific to the correction of the genetic defect (“i.e., either correcting the gene or is a replacement of an essential physiological protein that is otherwise deficient due to the gene defect”) [note: although we have seen some trade press refer to this initiative as limited to gene therapies, this criterion would appear to include other treatment modalities, such as enzyme replacement therapies];
4. the disease results in progressive functional deterioration “leading to rapid and/or significant disability or death in a relatively short period of time;” and
5. there are no adequate alternative therapies that alter the disease course.

Sponsors may apply for RDEP any time prior to the launch of a pivotal trial for each protocol it wants reviewed under RDEP. The RDEP request should be submitted as part of a formal meeting request. If there is no IND, FDA will assign a pre-IND number to facilitate the meeting; the sponsor can open an IND after the meeting and submit a request to the IND. The request, which should include only one protocol, should also include reasonable evidence that the eligibility criteria are met and that safety and efficacy of the drug can be demonstrated by a single study with confirmatory evidence.

The relevant center review team would issue a decision on acceptance following a consult with the Rare Disease Policy and Portfolio Council (RDPPC), which was established in 2024 along with the Rare Disease Innovation Hub. The RDPPC’s role in this process is to ensure consistency between CDER and CBER.

Sponsors of programs accepted into RDEP will then meet with the appropriate review team to determine what data will be used to substantiate safety and efficacy, although the announcement is clear that FDA agreement “would not necessarily indicate…that the drug is approvable.” The announcement also encourages the incorporation of patient experience data, “including by leveraging separate patient listening sessions where appropriate.”

The announcement states that “FDA may require additional data as a postmarketing requirement” (emphasis in original).

Of note, in acknowledgement of the distinctiveness of oncology drug reviews, the announcement states that “[b]ecause of frequent use of non-randomized trials and well-established early clinical endpoints (e.g., response rates, response durations) leading to multiple ‘rare’ oncology indications, sponsors [of ultra-rare oncology drug programs] should first consult the Oncology Center of Excellence or the CDER/CBER oncology review divisions to determine” if RDEP is applicable.

Bespoke Therapies

At the same RISE workshop last Wednesday at which Dr. Tidmarsh announced the RDEP initiative, Dr. Prasad spoke of an upcoming New England Journal of Medicine article to be co-authored with Dr. Makary on bespoke therapies, or therapies that are individualized, often just for one individual or a handful with the same genetic mutation. Organizations like Dr. Stan Crooke’s n-Lorem Foundation (one of the co-authors is a Board member) have been working in this field for years and it is very encouraging to all involved in these efforts to see the FDA move forward with a program tailored to the unique regulatory challenges presented in such situations.

Our Final Thoughts

We heartily applaud FDA for this RDEP initiative and for its promise of announcing soon a program for bespoke therapies as well. As stated above, while we have had the privilege to be part of a large percentage of the successful development programs in rare, even ultra-rare, diseases, we have seen too many programs fail when even a modest exercise of flexibility may have permitted a promising program to ultimately reach patients in need. The FDA’s new RDEP initiative now seems to provide clear guidance as to when flexibility and what kind of flexibility (one adequate and well-controlled trial, single-arm trials) might be applied in certain ultra-rare disease programs that will be selected for RDEP.

We are also buoyed to see that the time to apply for RDEP is prior to the initiation of the pivotal trial and tied to an FDA meeting. This timing, as opposed to waiting until closer to the NDA/BLA review, should provide some amount of regulatory clarity to enable efficient development for qualifying programs, including from a fundraising perspective. Although there are no timelines associated with the RDEP announcement itself, there are timelines associated with FDA meetings. We hope that these meeting timelines will apply to the RDEP requests and not add additional delay to these programs, but this is an open question at the moment.

The formal meeting process and timelines were established via PDUFA negotiations, another round of which is now ongoing. Perhaps this new round of PDUFA negotiations will result in a new type of meeting: a Type R (for RDEP) meeting, which could be for meetings within the RDEP Initiative and which specifically would include appropriate FDA personnel experienced in dealing with rare disease issues and FDA’s rare disease programs.

It is noteworthy that, unlike with orphan drug designation, this RDEP announcement does not include a firm population threshold, instead referring to “generally fewer than 1,000 patients” in the U.S. This is likely to be particularly helpful for rare diseases, where epidemiological data are not always available or sufficiently specific, so some flexibility is helpful. However, this lack of specificity may also place a burden on FDA reviewers who will be responsible for making a determination on cases where it is not clear if the 1,000 patient “threshold” has been crossed. Fortunately, the RDPPC’s involvement should help ensure consistency across the Agency.

Speaking of the RDPPC, we are happy to see its established role in this process. Part of the challenge of rare disease drug development is that the different parts of FDA have applied flexibility differently. These differences are apparent between divisions and, particularly, between centers. Although the RDPPC will certainly benefit from the specific expertise of the relevant review divisions, the involvement of a single coordinating rare disease council with broad rare disease expertise will hopefully smooth out these differences. Hopefully, this role for the RDPPC signals greater consistency moving forward for rare diseases Agency-wide.

We are looking forward to getting additional clarity on the mechanics of RDEP. Hopefully, we will hear more about this, and other new initiatives, soon – perhaps at the next RISE meeting? Onward!

Yesterday, FDA announced the publication of 89 previously unpublished Complete Response Letters (“CRLs”), which appears to be the next step in FDA’s effort towards “radical transparency.” The first step was the posting of 200 already-published CRLs on July 10, 2025, which we blogged about here. However, this latest development marks a significant change in Agency policy as the CRLs released yesterday are CRLs issued from 2024 to the present for pending or withdrawn applications. This is the first time such letters for products with pending applications or applications that were not later approved have been publicly accessible. The newly posted CRLs are available on the openFDA database along with the initial batch of letters.

FDA also announced that “[g]oing forward, the agency will promptly release newly issued CRLs, and when approving applications will release all CRLs associated with that application. The agency will also publish batches of previously issued CRLs associated with withdrawn or abandoned applications” (emphasis added). The stated bases for the release were to promote transparency, provide insights to help speed therapies to market, restore public trust, and, notably, ensure that sponsors provide “complete and contextualized information in communications to investors and shareholders,” the latter of which echoes themes of the Executive Order 14303 issued on May 23, 2025 to “restore gold standard science.”

The release of these CRLs will undoubtedly affect both sponsor and Agency practices going forward.  While our review of these CRLs is still underway, we note that it appears the clinical and statistical deficiencies are largely unredacted, while the product quality deficiencies are largely redacted. This is typically the case for CRLs that have been historically posted as part of an approved product’s action package, where clinical and statistical information is less likely to contain confidential commercial information under the Freedom of Information Act, unlike manufacturing information, which usually contains proprietary information about formulations, stability, etc. We will continue to monitor these developments and expect to post more on this topic in the coming days.

On the heels of President Donald Trump saying that he is considering executive action on marijuana rescheduling determination, Representative Greg Steube (R-Florida) reintroduced his Marijuana 1-to-3 Act that would legislatively reschedule marijuana from schedule I under the federal Controlled Substances Act (“CSA”) to schedule III.  Like the 2019, 2021, and 2023 versions of the Marijuana 1-to-3 Act, which never made it out of committee, the 2025 bill would direct the Attorney General to order the transfer of marijuana from schedule I to schedule III within 60 days of enactment.  H.R. 4963, 119th Cong. § 2 (2025); H.R. 4323, 116th Cong. § 2 (2019); H.R. 365, 117th Cong. § 2 (2021); H.R. 610, 118th Cong. § 2 (2023).

The Congressman posted on X that “[i]t makes zero sense that federal law treats marijuana the same as heroin and LSD.  It is even more ridiculous that cocaine is technically classified as less restrictive than marijuana.”  Congressman Greg Steube (@RepGregSteube), X (Aug. 11, 2025, at 15:21 ET).  (Unlike marijuana, cocaine has a currently accepted medical use in treatment in the U.S., including, for example, as a topical anesthetic, so is classified a schedule II substance.)  Steube characterized the bill as “a common-sense change that will finally allow real scientific research into its medicinal value and ensure our drug laws reflect reality.”  Id.

Health and Human Services recommended in August 2023 that the Drug Enforcement Administration (“DEA”) also reschedule marijuana to schedule III.  DEA published a Notice of Proposed Rulemaking (“NPRM”) in May 2024 signed by Attorney General Merrick Garland proposing to reschedule marijuana to schedule III, leading to a public hearing that began in January 2025 to receive factual evidence and testimony on marijuana rescheduling.  The hearing was stayed in January and, with DEA Chief Administrative Law Judge John Mulrooney’s recent retirement, rescheduling is in the hands of new Administrator Terrance Cole.

Rescheduling marijuana from schedule I, the most restrictive classification, to less restrictive schedule III would continue to present significant implications for marijuana-related businesses and users.  The NPRM stated that should rescheduling occur, “the regulatory controls applicable to schedule III controlled substances would apply, as appropriate, along with existing marijuana-specific requirements and any additional controls that might be implemented, including those that might be implemented to meet U.S. treaty obligations.”  Schedules of Controlled Substances: Rescheduling of Marijuana, 89 Fed. Reg. 44,597, 44,621 (May 21, 2024).  In the absence of marijuana-specific exemptions, cultivators, producers, and processors, distributors, importers, dispensers and practitioners will be subject to specific regulatory requirements under the CSA and DEA regulations.  Requirements would likely vary for different business activities.

If marijuana is rescheduled to schedule III, legitimate handlers would be required to obtain a DEA registration, take initial and biennial inventories, maintain transaction records, file theft and significant loss reports, and provide adequate security to prevent diversion.  Dispensing marijuana to patients, as with other schedule III substances, would require a prescription issued for legitimate medical purpose by a DEA-registered, state-licensed practitioner.  21 U.S.C. § 829(b).  As with the other schedule III substances that they dispense, pharmacists would be required to exercise their corresponding responsibility under the CSA to ensure that marijuana is prescribed and dispensed for legitimate medical purpose.  21 C.F.R. § 1306.04(a).  Marijuana activities would be subject to the CSA criminal prohibitions under 21 U.S.C. §§ 841-844 and Federal Food, Drug, and Cosmetic Act provisions.  89 Fed. Reg. 44,597, 44,621.

As with the prior Marijuana 1-to-3 Acts, the 2025 bill was referred to the House Energy and Commerce as well as the Judiciary Committees.

FDA’s recent approval of Papzimeos (zopapogene imadenovec-drba) highlights FDA’s use of regulatory flexibility in rare, serious diseases with unmet medical need. Approved on August 14, 2025, Papzimeos is the first treatment in the U.S. for recurrent respiratory papillomatosis (RRP), a rare disease characterized by recurrent HPV-induced papillomas in the airway that often require repeated surgeries. Papzimeos, a non-replicating adenoviral vector-based immunotherapy, is designed to stimulate a patient’s immune system to tackle the virus-infected cells driving disease. According to FDA’s announcement of the approval and the product’s labeling, approval of Papzimeos was based on a single-arm, open-label Phase 1/2 dose escalation plus dose expansion study that evaluated the safety and efficacy of Papzimeos in adult RRP patients – specifically patients who had three or more surgeries in the prior 12 months.

In FDA’s announcement, the current Center for Biologics Review Director, Dr. Vinay Prasad, stated:

Randomized trials are not always needed to approve medical products and this approval is proof of that philosophy. The FDA will always demand the correct clinical study for the specific medical product and disease. Our requirements for products given to tens of millions of healthy people will be different than products given to at most hundreds or thousands of patients with unique diseases.

This is an important endorsement by new FDA leadership.

FDA’s regulatory framework has long contemplated baseline-controlled and other historically-controlled trials as being capable of establishing drug effectiveness. The December 2019 Draft Guidance: Substantial Evidence of Effectiveness for or Human Drug and Biological Products explains that the substantial evidence of effectiveness standard requires expert judgment, including in accepting study designs that “produce less certainty” than randomized, controlled studies.  The May 2001 Guidance for Industry: E10 Choice of Control Group and Related Issues in Clinical Trials explicitly recognizes the baseline-controlled study as a type of historical control group that is appropriate in certain circumstances. Specifically in the context of rare diseases, FDA has recognized that “single-arm trials may be an important option in rare diseases with well-understood pathophysiology and a well-defined disease course,” (FDA’s May 2014 Draft Guidance: Expedited Programs for Serious Conditions – Drugs and Biologics).  And, at its core, historical controls are recognized in regulation as capable of being “adequate and well-controlled studies” that can support FDA’s effectiveness conclusions (21 C.F.R. § 314.126).

However, acceptance of non-traditional study designs by regulators requires exercise of judgment, and Agency leadership play an important role in doing so.  However, as Dr. Prasad notes, there are certain circumstances where baseline-controlled studies are most appropriate.

The Papzimeos Approval Helps Us Understand Circumstances Where Baseline-Controlled Studies Are Appropriate

The primary efficacy endpoint in the Phase 1/2 study of Papzimeos was Complete Response, defined as the percentage of patients requiring no RRP surgeries in the 12 months following treatment. Key secondary endpoints included HPV-specific immune responses, extent of papilloma growth as measured by Derkay scoring, and quality of life as measured by the Vocal Handicap Index-10 (VHI-10).

Precigen, the drug’s sponsor, announced in August 2023 that it had gained agreement with FDA that the Phase 1/2 study could serve as a single pivotal trial to support accelerated approval utilizing HPV-specific immune response as a surrogate endpoint. However, when FDA issued its approval decision this month, it went further, granting traditional, or full, approval instead. While the approval package is not yet publicly available to provide insight into FDA’s reasoning for supporting a single-arm pivotal trial design, these authors believe the choice of a single-arm study design was particularly well-suited for RRP.

1. As noted by FDA’s Dr. Prasad, RRP is rare, affecting approximately 27,000 adults in the United States. FDA has a history of applying flexibility for rare diseases, as well as for serious conditions with unmet medical needs.  RRP was all these things, with no FDA-approved therapy for this disease, which is characterized by recurrent, rapidly growing papillomas in the upper and lower respiratory tract that cause severe and potentially fatal airway obstruction, chronic lung disease, and recurrent pneumonia, thus requiring frequent surgeries.
2. Because recurrence of papillomas after surgery is nearly universal, a single-arm study allows for meaningful comparison against the known natural history of the disease because lack of recurrence (defined as being surgery-free for the study duration) can reliably be attributed to treatment effect. This is analogous to solid tumor response in cancer treatment, where spontaneous tumor regression is exceedingly rare and, as a result, single-arm studies have been a mainstay.
3. To enroll a population with severe enough disease to detect a treatment effect in a 12-month duration study (i.e., to adequately enrich the study), the study recruited RRP patients with three or more surgeries in the prior 12 months. This means that patients are more likely to have recurrence and require additional surgeries if left untreated.  It would not be ethical to randomize patients to forego off-label drug therapy often used in conjunction with surgery (e.g., Avastin, Cidofovir) in lieu of placebo for 12 months.  It would likely be infeasible to recruit such a study, as the more severe patients targeted for enrichment are likely to pursue off-label treatment if faced with the possibility of being randomized to placebo.
4. The treatment hypothesis for the primary endpoint was (1) objective (surgery) and (2) of a large magnitude (Complete Response), two key features that help reduce or overcome bias that can be associated with open-label trials. Knowledge of treatment assignment is unlikely to influence their perceptions, behaviors, and reporting of outcomes associated with surgical intervention as an outcome.
5. The combination of a well understood disease pathophysiology, such as HPV-induced papillomas in RRP, together with a therapy that has a mechanism of action on the causal pathway of the disease, such as Papzimeos which generates HPV 6- and HPV-11 specific T cell responses (see Section 12 of the product’s labeling), provides confidence that a deviation from the expected natural history is more credibly attributed to the drug despite the lack of concurrent control.

The Papzimeos Approval Does Not Stand Alone

This approval is one of a number of recent examples over the past year that demonstrate the ability of a single-arm study to establish effectiveness in a rare disease setting. From August 2024 to date, of the 22 novel, non-oncology rare disease drug approvals by FDA, nearly 20% (n=4) were on the basis of a single-arm trial; beyond Papzimeos, they are:

• November 13, 2024 approval of Kebilidi (eladocagene exuparvovec-tneq) for aromatic L-amino acid decarboxylase (AADC) deficiency;
• December 18, 2024 approval of Ryoncil (remestemcel-L-rknd) for steroid-refractory acute graft versus-host disease (SR-aGvHD); and
• February 11, 2025 approval of Gomekli (miradmetinib) for neurofibromatosis type 1 (NF1).

Each of these cases underscores the FDA’s recognition, across both CDER and CBER, that evidentiary requirements for meeting substantial evidence of effectiveness must be tailored to the context of the product and the patient population. For RRP patients, Papzimeos represents a long-awaited therapeutic option, and for the broader rare disease community, it serves as another illustration of how regulatory flexibility can accelerate access to transformative therapies while still upholding rigorous scientific standards.

Hyman, Phelps & McNamara, P.C. (HPM) is excited to announce speakers for the program we are co-hosting with Freshfields geared toward early-stage biotech and medtech companies.

This program will be a half-day, in-person event at Freshfields’ Silicon Valley office on Wednesday September 10, 2025.  HPM’s Michelle Butler and Allyson Mullen will be representing the drug and device perspectives, respectively.

Agenda:

1:00 – 1:30 PM: Registration

1:30 – 2:30 PM: Case Studies: Regulatory Matters in M&A and Licensing Transactions

• Michelle Butler, Director, HPM (Panelist)
• Vinita Kailasanath, Partner, Freshfields (Panelist)
• Allyson Mullen, Director, HPM (Panelist)
• John Fisher, Partner, Freshfields (Moderator)

2:30 – 3:30 PM: CFO Panel

• Phil Howard, Partner, EY
• Jean Viret, Former CFO at NGM Biopharmaceuticals
• Phillip Stoup, Partner, Freshfields (Moderator)

3:45 – 4:45 PM: CBO Panel

• Carey Chern, President and CBO, DeepSeq.AI, Inc.
• Stephanie Toney, Chief Strategy and Business Development Officer, Diatiro
• Vinita Kailasanath, Partner, Freshfields (Moderator)

4:45 – 5:15 PM: Lightning Round of Additional Regulatory/Data Topics

• Michelle Butler, Director, HPM
• Allyson Mullen, Director, HPM

5:15 – 6:15 PM: Reception

Event Details:

Wednesday, September 10, 2025
1:00 – 6:15 PM PT

Freshfields’ Silicon Valley office
855 Main Street Redwood City, CA 94063

Please click here to register your interest in attending.

A recent Warning Letter to a dental laboratory offering direct-to-consumer dental prosthetics highlights the ambiguous regulatory position occupied by dental laboratories and the products they produce for patients.  In June 2025, the dental laboratory Reset Technology Corporation received a Warning Letter identifying several areas of noncompliance with medical device regulations.  The violations identified in the letter made clear that FDA considered the dental laboratory to be engaged in device manufacturing activities and subject to the same regulatory requirements as manufacturers of other types of devices.

Historically, the traditional role of a dental laboratory has been “to manufacture prosthetics or devices in accordance with the written directives (or instructions) provided by a licensed dentist,” according to the American Dental Association.  Following Congressional enactment of the Medical Device Amendments of 1976, FDA promulgated regulations that exempted dental laboratories meeting certain criteria from registration and listing requirements in recognition of their distinct role.  21 C.F.R. Part 807 exempts:

[p]ersons who dispense devices to the ultimate consumer or whose major responsibility is to render a service necessary to provide the consumer (i.e., patient, physician, layman, etc.) with a device or the benefits to be derived from the use of a device; for example, a . . . dental laboratory . . . whose primary responsibility to the ultimate consumer is to dispense or provide a service through the use of a previously manufactured device.

21 C.F.R. § 807.65(i) (emphasis added).

The scope of the exemption as it pertains to dental laboratories has been a source of longstanding confusion.  Indeed, in responding to the Form FDA 483 that preceded the Warning Letter, Reset explained that it had previously registered as a device manufacturer “based on incorrect information from a regulatory consultant” but had since deactivated its registration with FDA for FY 2025.  Reset asserted that 21 C.F.R. § 807.65(i) applied because it “manufactures patient specific restorative devices (removable partial dentures) based upon a prescription from a licensed dentist” and “use[s] FDA cleared materials . . . to manufacture each patient specific device and do[es] not commercially distribute these devices.”  FDA disagreed, stating that Reset did not provide “a service through the use of previously manufactured devices” but rather “manufactures and distributes partial denture devices using devices that lack required approval/clearance and manufactures and distributes impression kits comprised of devices that lack required approval/clearance.“

The Warning Letter also cited numerous violations of the Quality System Regulation (QSR) requirements, including the failure to document procedures for process validation in connection with cleaning the partial denture device.  FDA rejected the dental laboratory’s assertion that process validations were not required since they had already been performed as part of the regulatory process for the FDA-cleared materials used in its devices.

Other QSR violations cited in the Warning Letter related to inadequate procedures for controlling non-conforming product, failure to establish and maintain procedures for rework, failure to adequately investigate complaints or maintain complaint files, and failure to adequately establish and maintain procedures for implementing corrective and preventive action.

FDA’s concerns appeared to be driven in part by the direct-to-consumer nature of the dental laboratory’s operations.  For example, the Warning Letter asserted that the “adjustment kits” provided to consumers at home to enable at-home modifications of their devices should have been reported as corrections pursuant to 21 C.F.R. Part 806, noting that ill-fitting dentures could lead to adverse health consequences.  The Warning Letter cited the dental laboratory’s failure to obtain premarket authorization for its devices and noted that the clearances cited by the dental laboratory were for different indications for use.  For example, the 510(k) cited by the dental laboratory for the impression material was for prescription use only, whereas the dental laboratory intended for the material “to be used by customers to take their own impression without the supervision of a dentist.”  This change “could significantly affect the safety and effectiveness of the impression material because customers who use at-home impression kits to take their own impressions may be more likely to take improper impressions—and improper impressions can lead to improper fabrication of the denture, which can cause bone loss/resorption, irritation, sores, and TMJ dysfunction.”

Additionally, the Warning Letter noted “it is unclear whether your firm is sending the impression material to customers with a prescription from a dentist—and the labeling of the impression kit does not appear to state that it is for prescription use only” and stated that “[c]hanging a device for prescription use only to a device for over the counter use also could significantly affect the safety or effectiveness of the device.”

The Warning Letter’s focus on a direct-to-consumer dental laboratory is consistent with concerns raised by the American Dental Association about the growing presence of direct-to-consumer dental laboratories, where patients are instructed to independently take their own impressions and order products without the involvement of a dentist.

Although the Warning Letter is specific to Reset Technology Corporation, other dental laboratories, in particular those incorporating direct-to-consumer practices, should take note and ensure they comply with applicable FDA regulations after careful consideration of whether their operations extend beyond what FDA considers to be a dental laboratory exempt from otherwise applicable regulations.

With great sadness, we announce that our colleague and friend Tom Scarlett passed away on August 20, 2025, at the age of 82.  Tom was a great lawyer, a recognized leader of the food and drug bar, and an unexcelled teacher and inspiration to all of us in the firm.

A graduate of Columbia University and Yale Law School, Tom began his legal career in 1969 as an associate with the New York office of White & Case.  In 1971, he joined the Office of the General Counsel of the Department of Health and Human Services (then HEW) as a staff attorney in the Social and Rehabilitation Services Division. However, it was in 1973 that he found his true calling when he became a trial attorney in the FDA Chief Counsel Office in HHS, where he served until 1979, rising to Deputy Chief Counsel for Regulations and Hearings. After practicing in the D.C. office of Morgan, Lewis & Bockius from 1979 to 1981, Tom was called back to FDA, where he was appointed Chief Counsel of FDA. Tom held that position with distinction, and some drama, until 1989, when we were honored to have him became a Principal in our law firm.

Tom was in active practice with the firm for 19 years, until he became senior counsel in 2008.  Tom fully retired in 2017, but he was always available to help when called upon and was a regular attendee at our firm functions.

Tom was one of the intellectual stars of the food and drug bar.  He had a quick understanding of the key issues in a matter and the ability to develop thoughtful, effective solutions to them (which he presented in his cool, polite and understated manner).  Tom also was an extraordinary writer of clear, efficient and persuasive prose.  He was often called on to assist lawyers in other firms with complicated matters.

We extend our heartfelt sympathy to his family.  Tom will be greatly missed.

As the summer of 2025 comes to a close and we begin to look toward to the 2026 Fiscal Year, FDA is completing its reporting on 2024. The FDA’s fiscal year 2024 Report on the State of Pharmaceutical Quality from CDER’s Office of Pharmaceutical Quality (OPQ) provides a look at the agency’s efforts under previous leadership to normalize its post-pandemic oversight. But the FDA and the pharmaceutical industry are in transition under the current administration, as new quality challenges have emerged across global supply chains. FY2024 ran from October 2023 through September 2024, so this report does not address the possible impacts of more recent policies, actual and proposed tariffs, and reductions in force at FDA. That said, this look back contains a number of interesting highlights.

Section One of the report examines the overall production site demographics and analyzes how they’ve changed in recent years. According to the report, 36% of registered sites are in the “No Application” sector, the majority of which are OTC monograph products, but also including marketed unapproved prescription drug products and homeopathic products. The remaining 64% of sites each manufacture at least one application product, including biological products licensed under Biologics License Applications (BLAs), products approved under New Drug Applications (NDAs), and generic products approved under Abbreviated New Drug Applications (ANDAs).

The six countries with the most sites in the FY2024 Site Catalog were the U.S., India, China, Germany, Italy, and France. Of note, since 2020, those nations had significant net increases in total listed sites, as seen in the chart below (here).

Five other countries, including China and India, increased registered sites more than 15%. Canada, Japan, and the U.K. each saw declines.

According to the Report, both domestic and foreign drug quality assurance inspections continued to creep up as well, though FDA is still well below pre-pandemic levels. There were over 1,300 inspections in FY2019, compared to 989 quality inspections last fiscal year. Perhaps in a nod to the recent Executive Order and announcement about FDA’s emphasis on foreign inspections, OPQ’s report boasted that “more than 62% of drug quality assurance inspections were at foreign sites —an all-time high. This progress in foreign inspections was particularly evident in India and China, where 34% and 28% of sites in the Site Catalog, respectively, were inspected.” In the 2023 report, we noted that roughly half of all inspections were at foreign facilities. We’ll keep an eye out for how this data might change if and when FDA’s foreign inspection policies evolve.

Section Two of the report examines drug product demographics, stating that CDER’s Product Catalog included 14,168 ANDAs, 3,625 NDAs, 383 BLAs, and 140,119 non-application product NDCs. All were increases from FY2023.

Section Three dissects FY2024’s enforcement matters, including import alerts, recalls, and Warning Letters. According to the report, FDA issued 105 Warning Letters for quality issues, the highest in five years. The report does not discuss Untitled Letters. Globally, 93% of all sites in the CDER Site Catalog have received no action indicated (NAI) or voluntary action indicated (VAI) as their most recent inspection classification. This data reveal an overall high level of compliance; however, classifications varied by global regions. Internationally, China, India, and South Korea were the leaders in quality-related Warning Letters (here).

In terms of percentages, inspected firms in Europe led the global pack with a 98% NAI or VAI classification rate. China’s overall rate was 93%, and the U.S. rate was 92%. India’s overall inspection rate lagged at 87% of inspections classified as NAI or VAI (here).

Import alerts affected 75 sites, primarily OTC manufacturers and API suppliers. The report also reveals that over the last five years, 72% of enforcement actions against API manufacturers targeted sites exclusively supplying compounding pharmacies, though these sites represent just 18% of API manufacturers in CDER’s catalog. OPQ notes that because this small sub-group represents an outsized portion of enforcement actions, “FDA has prioritized these higher risk sites for future surveillance.”

Product recalls dropped to their lowest level in five years at 421 products, though contamination remained the leading cause. Ophthalmic products topped the recall list in terms of numbers, with several multi-product events involving sterility issues.

Looking at FDA’s FY2024 quality surveillance data provides a baseline for evaluating potential regulatory changes under the current administration’s reform agenda. The report’s discussions about FDA’s use of Warning Letters, emphasis on foreign manufacturing oversight, and API quality gaps all suggest areas where the agency’s approach might shift under the current leadership. And challenges with Chinese and Indian suppliers may align with Administration calls for domestic supply chain “reshoring,” and reduced dependence on foreign pharmaceutical manufacturing.

As we turn the calendar to FY2026, we’ll keep an eye on these trends to see how FDA’s assessment of 2024 will inform its future.

Hyman, Phelps & McNamara, P.C. (“HP&M”) is proud to announce that 16 of our attorneys have been recognized in the 2026 edition of The Best Lawyers in America®. This recognition reflects the depth of our team’s experience and our ongoing commitment to excellence in FDA law, health care law, and regulatory matters.

Attorneys recognized in The Best Lawyers in America® include:

• Michelle L. Butler – FDA Law
• Ricardo Carvajal – Food and Beverage Law
• Robert A. Dormer – FDA Law
• Douglas B. Farquhar – FDA Law
• Jeffrey N. Gibbs – FDA Law
• Paul M. Hyman – FDA Law
• Gail H. Javitt – FDA Law
• Kurt R. Karst – FDA Law
• Sara W. Koblitz – FDA Law
• Dara K. Levy – FDA Law
• Allyson B. Mullen – FDA Law
• Josephine M. Torrente – FDA Law
• Anne K. Walsh – FDA Law

Additionally, three HP&M attorneys were recognized in Best Lawyers: Ones to Watch® in America:

• Kalie E. Richardson – Health Care Law
• James E. Valentine – Health Care Law
• Sarah L. Wicks – Administrative/Regulatory Law

 The Best Lawyers in America® is based entirely on peer review and is considered one of the most respected and unbiased sources for legal referrals in the United States. Being selected is a testament to the trust and regard of fellow attorneys and reflects HP&M’s leadership in regulatory and health law.

We congratulate our colleagues on this well-deserved recognition.

Karla Palmer and Andrew Hull will be presenting at this year’s Controlled Substances and State Regulatory Conference to be held in Savannah, GA, from September 3-5.  Karla Palmer will be presenting on suspicious order monitoring and customer due diligence requirements for manufacturers and distributors as well as leading a session on pharmacist awareness of “red flags” of diversion.  Andrew Hull will be presenting on the current DEA enforcement environment and leading a roundtable discussion on legal issues facing DEA registrants.

The conference will feature many other speakers on important topics facing the DEA-regulated industry, as well as a DEA update on controlled substances regulation.

Click here to register for this conference.  We hope to see you in Savannah!

Like death and taxes, unannounced, periodic cyclic inspections of controlled substance manufacturers, distributors, importers, exporters, and narcotic treatment programs, by Drug Enforcement Administration (“DEA”) diversion investigators every three to five years is inevitable.  “Practitioner” registrants, that include hospitals, pharmacies, and practitioners, are also subject to random unannounced DEA inspections.  An accountability audit of selected controlled substances, and a review of required records, reports, and security comprise most DEA cyclic and other inspections.

DEA diversion investigators appearing unannounced, though not totally unexpected, can be nerve racking for employees given the great importance that rides on whether the inspection finds find that registrants are in compliance with the Controlled Substances Act (“CSA”) and DEA regulations.  A negative inspection can result in a Corrective Action Letter (formerly a Letter of Admonition), an informal hearing, an Order to Show Cause, a Memorandum of Agreement, and civil monetary penalties.  Over the years we have posted recommendations on how registrants can proactively prepare for and manage DEA inspections.  See, for example, here, here, and here.

First as a DEA diversion investigator and later in private practice, I have witnessed countless inspections over the years where employees scrambled to gather and provide requested information and documents.  The investigators’ first impression can be crucial in how an inspection progresses and whether they conclude that a registrant is compliant.  Certainly the best preparation for the inevitable DEA inspections is to comply with the CSA and regulations by maintaining complete and accurate records and reports that are readily accessible, and ensure that security components are operational.  Registrants should designate a specific responsible employee to act as liaison with the investigators.  Registrants should also conduct periodic DEA-style mock random internal accountability audits and record, report and security reviews.

Investigators always ask for certain basic information and documents upon their arrival.  This information is crucial to the inspection and for the files that DEA maintains on the registrant.  The initial portion of an inspection after investigators have made their requests is typically an anxious time for employees as they scramble to locate the requested information and documents.  One way to alleviate some of the anxiety for employees is for registrants to create and prepare a DEA inspection binder that organizes and contains what investigators typically ask for.

Registrants should remove and provide information and documents from the binder when requested.  A typical DEA inspection binder should contain:

1. Current federal and state license, permit, and registration certificates;
2. Corporate structure with ownership including incorporation documents;
3. Executive and corporate officers with their title, date of birth, Social Security number, and home address;
4. For employees who access controlled substances and listed chemicals, their title, date of birth, Social Security number, and home address; (DEA protects and safeguards all information, including Personal Identifiable Information obtained as required by the Privacy Act of 1974);
5. Powers of Attorney pertaining to controlled substances and listed chemicals;
6. Controlled Substances Biennial Inventory;
7. List of controlled substances/listed chemicals handled for prior two years;
8. Suppliers with their address and DEA registration numbers;
9. Customers with their address, DEA registration numbers, and/or unique ID numbers;
10. Operations information including hours and full- and part-time employee numbers and hours;
11. Controlled substance/listed chemical Policies and Procedures; (neither the CSA nor DEA regulations require written SOPs, but investigators view them as relevant for assessing compliance);
12. Central recordkeeping authorization letter if applicable;
13. Facility interior and exterior security including:
    • Building plans and diagrams
    • Alarm:
      • 1.  Description,
      • 2.  Specifications with literature,
      • 3.  Contracts,
      • 4.  Central monitoring system contract; and,
      • 5.  Test results
    • Safe/vault/container:
      • 1. Literature with specifications; and
      • 2.  Contracts; and
    • Security guard contract if applicable.

Registrants must update the binder when changes occur, such as when responsible employees leave or new licenses/registrations are issued.  Registrants can maintain the materials in a three-ring binder or electronically.

****

Look for additional DEA inspection recommendations here in the coming weeks.

FDA recently released a CDER Center for Clinical Trial Innovation (C3TI) White Paper on Selective Safety Data Collection (SSDC), a subject about which there is little awareness. Selective Safety Data Collection (SSDC) describes the prospectively planned curtailment of safety data collection in studies where the safety profile of the drug has been well characterized. Although some information should always be collected from a clinical trial, e.g., serious adverse events, adverse dropouts, adverse events of special interest, other information may be unnecessary. Consider an approved drug, studied in 1200 subjects, with a table in Section 6 of labeling that lists nausea as an adverse reaction, e.g., 24% with drug and 13% with placebo. If subjects in the planned study are similar to those in registrational studies, how important would it be to query subjects about non-serious adverse events of nausea in a subsequent study? And given that routine laboratory data were collected and analyzed in these 1200 subjects, how important would it be to collect tens of thousands of additional laboratory values in the planned study? In this situation, FDA and other regulatory authorities recognize that such information would not add importantly to the safety knowledge about the drug. Collection of such data increases the burden of the study, first and foremost to participants, and also to investigators, sponsors, and regulatory authorities. Why worry about the burden? If clinical studies are less burdensome, more will be conducted, and more questions will be answered—the main goal of clinical research.

FDA expressed its willingness to adopt SSDC when it released its 2016 Guidance for Industry, “Determining the Extent of Safety Data Collection Needed in Late-Stage Premarket and Postapproval Clinical Investigations.” When I was an Office Director in CDER, we would encourage sponsors to use this approach in studies they were planning. Executives would smile and nod their heads in agreement, but no one took us up on the offer! Our thinking was that we needed international buy-in of this approach for it to be viable, given that these were multinational studies that involved regulators from around the world.

In 2016, I advanced SSDC as a topic for the International Council on Harmonisation (ICH). The matter was taken up as a topic by the ICH E19 Expert Working Group, and I was appointed as one of the FDA leads. In the working group, it became apparent that the resistance to SSDC was not so much from regulators outside the US, but rather from the companies, who felt like they needed to obtain every shred of information from their trials! They worried that a regulator—somewhere, sometime—would request the information, and thought that, rarely, the availability of comprehensive safety information might help explain the etiology of unusual serious adverse events. Moreover, such decisions could be driven by the most conservative member of leadership at each company!

ICH finalized the Guideline, “E19, A Selective Approach to Safety Data Collection in Specific Late-Stage Pre-Approval or Post-Approval Clinical Trials,” almost 3 years ago; however, the concept still draws little attention from industry. FDA is now increasing awareness of the concept with their new White Paper. The White Paper does an excellent job in explaining the concept of SSCD, its utility, past and present experience, and opportunities for future use, all with excellent examples. It is something we hope many of you will read.

The authors of this post are both avid bibliophiles, and keenly appreciate the hook of a good title or first sentence that draws you right in. Usually the titles of government press releases do not share this allure, but there was one recently that caught our attention. On July 31, 2025, the Department of Justice (DOJ) issued a press release titled: “Illumina Inc. to Pay $9.8M to Resolve False Claims Act Allegations Arising from Cybersecurity Vulnerabilities in Genomic Sequencing Systems.”  Since most settlements with the government stem from actual harm caused, we found the word “vulnerabilities” of particular interest, and knew we needed to settle in to read more.

The allegations, brought to DOJ’s attention by a qui tam relator, state that from February 2016 through September 2023 Illumina submitted or caused to be submitted false claims to a variety of federal government agencies, including DOJ, Department of Health and Human Services, Department of Veterans Affairs, and others, for payment for the purchase of certain of Illumina’s genomic sequencing systems. The punchline of the settlement may be the following: “The United States contends that the claims to the Agencies were false, regardless of whether any actual cybersecurity breaches occurred, because the [genomic sequencing systems’] software had cybersecurity vulnerabilities, and Illumina did not have an adequate product security program and sufficient quality systems to identify and address cybersecurity vulnerabilities affecting the [] software.” (Emphasis added.)

Like a line out of a good Stephen King novel, this sentence should put fear in the heart of any company that manufactures software-reliant medical devices sold to the government. And just like that Stephen King novel, you need to keep reading to find out more.

It turns out that DOJ’s position was not merely based on the presence of potential “vulnerabilities,” but rather on its finding that “Illumina knowingly failed to incorporate product cybersecurity in its software design, development, installation, and on-market monitoring; failed to properly support and resource personnel, systems, and processes tasked with product security; failed to adequately correct design features that introduced cybersecurity vulnerabilities in the genomic sequencing systems; and  falsely represented that the software on the genomic sequencing systems adhered to cybersecurity standards, including standards of the International Organization for Standardization and National Institute of Standards and Technology.”

Even with all that, and even assuming some part of the allegations are true, it is still startling that these actions, which appear to be violations of FDA’s Quality System Regulation, led to a seven-figure settlement. Notably, there is no discussion of FDA requirements, quality system or otherwise, just general references to “cybersecurity standards” and “cybersecurity obligations.”

So what does this mean for medical device companies moving forward? Perhaps not much, beyond additional focus on complying with the already-existing cybersecurity requirements. While not explicitly stated, it stands to reason that, given this administration’s focus on national security, this particular settlement may stem from potential threats to national security that could be presented by cybersecurity “vulnerabilities” and really has very little, if anything, to do with FDA requirements more broadly. As DOJ states in its press release, the concerns here related to protecting “sensitive information from cyber threats,” “combat[ing] cybersecurity risks,” and the consequences that may stem “from a failure to adhere to required cybersecurity standards, especially when the systems involved include sensitive genomic data.”

It is worth comparing this settlement with earlier cases involving alleged violations of drug good manufacturing practices, like United States ex rel. Rostholder v. Omnicare, Inc., No. 12-2431 (4^th Circ. Feb. 21, 2014).  Courts have rejected False Claims Act theories based solely on alleged regulatory violations, noting that the FCA is not “a sweeping mechanism to promote regulatory compliance.”   The focus in those cases was that compliance with the current good manufacturing practice (cGMP) regulations was not material to payment by Medicare and Medicaid.  Although “the correction of regulatory problems is a worthy goal,” such a theory is “not actionable under the FCA in the absence of actual fraudulent conduct.”

While the Illumina settlement is not necessarily an indicator that DOJ is interested in going after medical device companies simply for QSR violations, a company’s quality management system and its cybersecurity are inextricably linked. The one thing that is certain from this settlement is that if you have a medical device with software (and let’s be honest, these days, that describes most of them), you should review your cybersecurity risk management plan, assess any potential vulnerabilities, and implement necessary mitigations. You don’t want to be the lead character of the sequel.

* Credit to Helen Exley for the quote, “Books can be dangerous. The best ones should be labeled ‘This could change your life.’”

CDER’s Office of Pharmaceutical Quality (OPQ) recently published a white paper called Quality Management Initiatives in the Pharmaceutical Industry: An Economic Perspective. Not entirely a financial analysis, OPQ is making what amounts to a two-part sales pitch to pharma execs that investment in manufacturing quality systems will return profit and economic savings while also serving broader public health interests. This white paper is the latest release in what OPQ calls their initiative towards “mature quality systems management.” The timing of this release follows other, related papers that endorse the idea that going beyond bare-minimum compliance actually pays dividends.

In part one of the paper, entitled The Economic Return on Investment for Quality Management Initiatives, OPQ makes the case that investment in quality will not merely minimize regulatory headaches but will also advance real savings and profits. Instead of the usual regulatory finger-wagging about compliance, here OPQ is trying to speak the language of CFOs. A central principle here is that companies don’t need to affect massive quality overhauls to see financial benefits. Their research claims that targeted quality investments can lead to cuts in product defects by more than half and reductions in waste of 75%, while allowing companies to redeploy a quarter of their staff from quality troubleshooting to other work. To realize these kinds of benefits, OPQ uses economic modeling that aspires to show that there’s an optimal sweet spot for quality investments where companies can expect measurable returns on their spending. The paper shows this relationship as a curve where total costs decrease with quality investments until reaching an optimal point, after which additional spending produces diminishing returns.

See Table here – Source: OPQ White Paper, Quality Management Initiatives in the Pharmaceutical Industry: An Economic Perspective, page 5.

The agency presents this as a stepwise approach where companies can make incremental investments rather than committing large amounts of capital upfront. According to their model, companies can choose an investment level based on their current situation and business needs, with each step theoretically delivering additional returns even without reaching the optimal investment point.

FDA’s approach here has pros and cons. We appreciate FDA’s allowance that the approach is company specific. It’s certainly true that not all manufacturing facilities nor quality management systems are created equal. We note, however, that FDA’s economic model relies heavily on case studies and anecdotal evidence rather than rigorous econometric analysis, which makes it difficult to verify their claimed returns or determine how applicable they are across different types of pharmaceutical operations.

Additionally, while FDA does provide a mathematical framework for finding the optimal investment level, it appears to us as more theoretical than practical. The key here is that companies should incrementally invest in quality up to the point until the cost of additional spending equals the savings it generates. This is a pretty standard economic optimization theory for finding a “sweet spot” for Return on Investment (ROI). But FDA’s model admittedly doesn’t add in the realities of the “external complexities of the pharmaceutical market.” Thus, manufacturers are left with a model that doesn’t factor in any market-driven externalities. As a theoretical exercise, FDA’s economic model is interesting. But the jury is still out on how helpful it will be for quality managers, CFO’s, and C-Suite executives.

In part two, The Public Health Return on Investment for Quality Management Initiatives, focus shifts from company ROI to the broader public health benefits of mature quality systems, arguing that they help preserve patient safety, prevent drug shortages, and maintain supply chain stability. Here, FDA leans more into its traditional position that frames quality as a public health imperative, noting that functioning, compliant quality systems reduce the risk of treatment delays and adverse patient outcomes that ripple through healthcare systems during shortages.

Section Two’s public health arguments are compelling in principle, albeit not entirely connected to the economic ROI focus of the first part of the paper. FDA acknowledges some of the associated indirect costs with their public health concerns but doesn’t quantify how much companies should spend on quality systems to achieve these public health goals, assuming that the public benefits justify the private costs. And there’s no clear link here to FDA’s earlier theme that even small investments can lead to substantial rewards. This potentially leaves pharmaceutical executives in an awkward position of being asked to optimize for two different objectives without clear regulatory instruction on how to balance profit-driven quality investments against broader public health responsibilities.

The report concludes that whether “companies are implementing their first quality culture initiatives or embracing new technologies, there are opportunities for companies at every stage of quality management implementation.” These incremental opportunities, OPQ writes, are something “that pharmaceutical companies cannot afford to lose.” Time will tell if OPQ merges these economic principles into their inspection and classification assessments, space that is already inhabited by the public health philosophies this report also includes. While there’s a lot of interesting material here, this is a white paper, not a formal guidance document, so it’s not clear how or if this analysis might impact enforcement decisions going forward. We’ll report on any further advancements in the agency’s view on mature quality management as they develop.