• where experts go to learn about FDA
  • May 11, 2023: The End of the COVID-19 Pandemic Emergency’s DEA Telemedicine Exemption? “Not So Fast,” Say DEA and SAMHSA

    We blogged earlier this week here that DEA is reconsidering its proposed rules for telemedicine prescribing of controlled substances and buprenorphine. Today is indeed the official “end” of the COVID-19 pandemic Public Health Emergency (PHE) Declaration, and DEA, jointly with the Substance Abuse Mental Health Services Administration (SAMHSA), have announced the issuance of a temporary rule extending the PHE telemedicine exemptions, as described below.  DEA states the temporary rule will take effect today, and “extends the full set of telemedicine flexibilities adopted during the COVID-19 public health emergency for six months – through November 11, 2023.”  In addition, concerning any practitioner-patient telemedicine relationships that have been or will be established up to November 11, 2023, all telemedicine flexibilities concerning prescribing of controlled substances established during the COVID-19 PHE will also be extended for one year – through November 11, 2024.  

    This much welcomed — and needed — extension of the telemedicine flexibilities is a result of DEA’s receipt of over 38,000 comments on its set of proposed telemedicine rules for controlled substances and for buprenorphine treatment. We applaud DEA’s and SAMHA’s recognition that:

    [T]he goal of this temporary rule is to ensure a smooth transition for patients and practitioners that have come to rely on the availability of telemedicine for controlled medication prescriptions, as well as allowing adequate time for providers to come into compliance with any new standards or safeguards that DEA and/or SAMHSA promulgate in one or more final rules.

    88 Fed. Reg. 30,038 (May 10, 2023).

    This time around, DEA is acting jointly with SAMHSA, which agency “concurs” with the temporary rule, and has advised DEA that no additional rulemaking is necessary at this time other than the temporary rule, nor are amendments required to 21 U.S.C. § 802(54)(G) (which references CMS’s statutory definition of “practice of telemedicine”). DEA’s preamble sets forth the temporary rule’s purpose:

    • Facilitates continuity of care;
    • Prevents backlogs concerning in-person medical evaluations in the months before and after the expiration of the COVID–19 PHE declaration;
    • Ensures the availability of telemedicine for practitioners and patients that have come to rely on it;
    • Addresses the urgent public health need for continued access to the initiation of buprenorphine for opioid use disorder in the context of the continuing opioid crisis;
    • Allows patients, practitioners, pharmacists, service providers, and other stakeholders sufficient time to prepare for future regulations;
    • Enables DEA and SAMHSA to review the 38,369 comments in response to the proposed rules; and
    • Permits time to consider regulatory alternatives that may effectively expand access to telemedicine, which “alternatives may be consistent with public health and safety, while maintaining effective controls against diversion.”

    More specifically, the temporary rule adds new regulatory sections 21 C.F.R. §1307.41and 42 C.F.R. 12.1, effective May 12, 2023 through November 11, 2024,  Telemedicine relationships that are included in this period must be “in effect” as of November 11, 2023.  It is extremely important to keep in mind that telemedicine relationships that are in effect or that are established for the prescribing of controlled substances including buprenorphine must include all of the following:

    • First, the prescription must be issued for a legitimate medical purpose by a practitioner acting in the usual course of professional practice.

    • Second, the prescription must be issued pursuant to a communication between a practitioner and a patient using an interactive telecommunications system referred to in CMS requirements for telemedicine services set forth at 42 C.F.R. § 410.78(a)(3). More specifically, it must be issued using audio and video  equipment permitting “two-way, real-time interactive communication or, for prescriptions to treat a mental health disorder—which include, but are not limited to, prescriptions for buprenorphine for opioid use disorder—a two-way, real-time audio-only communication if the distant site physician or practitioner is technically capable of using an interactive audio-video telecommunications system, but the patient is not capable of, or does not consent to, the use of video technology.”

    • Third, the practitioner must be authorized by DEA to prescribe the basic class of controlled medications specified on the prescription or otherwise exempt

    • Fourth, the prescription must be consistent with all other requirements of 21 C.F.R. part 1306 (which include DEA’s general requirements for prescribing controlled substances);

    88 Fed. Reg. at 30,039 (emphasis added).

    By any measure, prescribers that handle controlled substances and  have engaged actively in a telemedicine practice since the onset of the pandemic, and patients that have come to rely on needed telemedicine relations and resulting controlled substance prescriptions, have been granted a reprieve from an imminent retraction in services and the potential for DEA enforcement activity. The plain message here is that citizens and industry commented — loudly, and both DEA and SAMHSA are listening.  We hope that prudent use of the practice of telemedicine continues during this longer transition period while both DEA and SAMHSA meaningfully evaluate the more than 38,000 comments received.

    How Soon Until the Kochava Geolocation Case Catches Up to Medical Device Companies?

    We were listening to a radio interview last week with Lina Khan, the Chair of the Federal Trade Commission (“FTC”).  In the interview, Khan spoke about the Commission’s efforts to regulate geolocation data trackers so that they don’t abuse their abilities. The risks she described caught our attention because two of the risk profiles she cited included things that touched on FDA-related entities, such as medical devices that transmit data. See, e.g., here.

    “We have taken several actions that just in the last few months that have been making sure we’re protecting people’s sensitive information via geolocation data that people can buy to track with great precision” said Khan, “whether people are going to addiction facilities or places of worship or seeking reproductive health service.”

    Khan was referencing a suit that FTC and DOJ filed against Kochava, a prominent location data broker, in August 2022.  The interview aired on Monday, May 1.  The rest of Khan’s week didn’t go as well.

    On Thursday, a District Court judge in Idaho issued a pair of mixed rulings relating to the FTC’s case against prominent location data broker Kochava.  The news wasn’t all bad for the government, but FTC’s now has some decisions to make.

    Back in the Summer of 2022, FTC approached Kochava about its contemplated suit against the company for violations of the FTC Act.  Kochava decided to strike first and sued the FTC, hoping to preempt the pending enforcement suit.  Undeterred, FTC moved ahead with its case.

    When FTC brings data privacy cases against tech companies, it does so under the provisions of the FTC Act that prohibit “unfair or deceptive” practices.  Deceptive practices are the frequent bedrock legal theory for these cases.  Tech companies that don’t live up to their promises to safeguard consumer data are frequent targets of the FTC.

    The case against Kochava is a little different.  The complaint does not describe deceptive practices, instead alleging that Kochava was acting unfairly.  According to the FTC and DOJ, the sale of consumers’ geolocation data to publicly accessible on-line data marketplaces is unfair because it potentially puts those consumers at risk.  Advertisers, the complaint says, aren’t the only digital entities hoping to make use of data showing where people go.  Those with more malevolent—unfair?—intent may also exploit that information.  This is what Khan was describing in her interview.

    On Thursday, the judge overseeing the parallel cases made two, mixed rulings.  To the benefit of the FTC, the judge permanently dumped the company’s pre-emption suit.  He ruled that it was a “race-to-the-courthouse declaratory action” that Kochava filed without the purpose of “seeking any real affirmative declaratory relief . . . .”  In the court’s opinion, Kochava was asking it to “pre-determine that the FTC anticipated lawsuit would fail.”  While there are some cases where seeking to preclude agency action might work, it would be a remarkable decision for a federal judge to rule on the merits of an enforcement suit before it was filed, as Kochava was asking here.

    But the judge also dealt a blow to the government, dismissing its suit against Kochava.  Khan is correct in that one can easily envision how the sale of location data might unfairly put consumers at risk, but the judge in Idaho ruled that the FTC had not effectively alleged facts that show a likelihood of substantial consumer injury.  FTC’s case did not rely on specific instances of realized consumer unfair harm related to the sale of geolocation information.  In this case, the potential for harm was not enough to sustain the suit.

    However, FTC may get another crack at this.  The ruling left open the door for FTC to file an amended complaint that relies more on specific factual evidence.  So, the government here has a choice to make.  FTC will need to investigate further and put together some data specific to Kochava, it seems, since they didn’t include it in the first suit. If the parade of horribles they envision isn’t as evincible as it is imaginable, then pressing the suit against Kochava looks to be more challenging.

    As a final note, we would note that it doesn’t seem difficult to envision this case affecting many FDA-regulated companies.  We’ve written before (see here too) about how medical device companies are truly data companies to the extent they promote software or are otherwise connected to the internet. By their very nature as regulated medical products, they traffic in data that is similarly sensitive to the geolocation information at issue in the Kochava case.  As FDA continues to both build its cybersecurity and digital health infrastructure and strengthen its cross-agency relationship with FTC, we can’t help but wonder how soon we’ll see an action like this against a device company.

    Change is Inevitable – Plan Ahead: An Assessment of FDA’s Draft Guidance on Predetermined Change Control Plans for Artificial Intelligence/Machine Learning-Enabled Device Software Functions

    FDA recently published a long-awaited draft guidance aimed at reducing the need for prior FDA authorization of modifications to artificial intelligence/machine learning (AI/ML)-enabled device software functions (ML-DSFs).  The draft guidance, “Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence/Machine Learning (AI/ML)-Enabled Device Software Functions,” describes the information on planned modifications that should be included with an initial premarket submission to enable FDA to prospectively evaluate a manufacturer’s process for implementing software changes.

    History of the Development of Predetermined Change Control Plans

    Traditionally, manufacturers seeking to make improvements or updates to their software device functions have needed to consider whether a new marketing submission is required, based on criteria specified in FDA regulations that focus on the potential impact of the proposed modifications on safety and effectiveness.  See 21 CFR 807.81(a)(3) and 21 CFR 814.39(a), and related guidance documents (e.g., here for a 510(k) device and here for a PMA device).  The purpose of a predetermined change control plan (PCCP) is to avoid the need for such post-market assessments – and the delay and expense entailed when it is determined that a new submission is needed – through prospectively defining a process for making post-market changes.

    The draft guidance follows the December 2022 enactment of the Food and Drug Omnibus Reform Act of 2022 (FDORA).  FDORA added section 515C, “Predetermined Change Control Plans for Devices” to the Federal Food, Drug, and Cosmetic (FD&C) Act.  Section 515C authorizes FDA to approve a PCCP submitted as part of a PMA or 510(k) submission and to require that such PCCP include (a) labeling required for safe and effective use of the device as it changes; (b) notification requirements if the device does not function as intended pursuant to the plan, and (c) performance requirements for changes made under the plan.  Once FDA has cleared or approved a PCCP, that statute states that a supplemental application “shall not be required” to make a change consistent with such PCCP.

    Although FDORA gave FDA express authority to allow PCCP , FDA had already been considering creating a mechanism for manufacturers to prespecify modifications for AI/ML-based software subject to 510(k) premarket notification and de novo classification for several years.

    The 2019 discussion paper, “Proposed Regulatory Framework for Modifications to Artificial Intelligence/Machine Learning (AI/ML)-Based Software as a Medical Device (SaMD) – Discussion Paper and Request for Feedback,” introduced the PCCP principle as a means to “enable responsible performance enhancements in AI/ML technologies.”  The discussion paper described a PCCP as including (1) the types of anticipated modifications (SaMD Pre-Specifications or SPS) based on the retraining and model update strategy and (2) the associated methodology  (Algorithm Change Protocol or ACP) being used to implement those changes in a controlled manner to manage patient risks.

    In February 2020, FDA granted a de novo classification request (DEN190040) for software intended to assist medical professionals in the acquisition of cardiac ultrasound images and that included a PCCP for future software modifications.  The reclassification order established a Special Control requiring the inclusion of a “detailed protocol that describes, in the event of a future, change, the level of change in the device technical specifications or indications for use at which the change or changes could significantly affect the safety or effectiveness of the device and the risks posed by these changes.”  Additionally, it stated that the “assessment metrics, acceptance criteria, and analytical methods used for the performance testing of changes that are within the scope of the protocol must be included.”

    In January 2021, as part of its “Artificial Intelligence/Machine Learning (AI/ML)-Based Software as a Medical Device (SaMD) Action Plan,” FDA committed to issuing a draft guidance on PCCPs that would address the content of SPSs and ACPs and identify the types of modifications appropriate under a PCCP.  That draft guidance has now been issued.

    Overview of the Draft Guidance

    The draft guidance describes a PCCP as a “plan that includes device modifications that would otherwise require a premarket approval supplement, De Novo submission, or a new premarket notification.”  It states that FDA will review a PCCP for a ML-DSF as part of the initial marketing submission and “authorize” it in whole or in part, i.e., permit either all of the proposed modifications or only some of them.

    Proposed modifications should be consistent with the device’s intended use and indications for use and be “intended to maintain or improve the safety and effectiveness of the device.”  Manufacturers should be able to verify and validate the proposed modifications within their existing quality system.

    Post-market, manufacturers can make modifications consistent with the PCCP and document the modification in accordance with their quality system, without the need for a new marketing submission.  Modifications that are not consistent with the authorized PCCP, however, must be evaluated in accordance with the traditional regulatory process described in applicable regulations and guidances referenced above.

    The draft guidance provides examples of modifications that may be included in a PCCP, including:

    • modifications related to quantitative measures of the ML-DSF performance specifications, including improvements to analytical and clinical performance resulting from re-training the ML model based on new data from the same type of input signal;
    • modifications related to device inputs to the ML-DSF which may involve including new sources of same signal type; and
    • modification related device’s use and performance for use within a specific subpopulation that was part of the originally indicated population.

    Components of a PCCP

    The draft guidance describes the sections that should be included as part of a PCCP and the specific information that should be included under each section.  The sections are: (1) description of modifications; (2) modification protocol; and (3) impact assessment.

    Description of Modifications

    The PCCP should include a detailed description of the changes to “device characteristics and performance” that are expected to result from proposed modifications.  FDA recommends that PCCPs specify only a “limited number” of modifications but does not provide a limit on the number of modifications that can be included.

    Both automatic and manual modifications can be included in a PCCP, so manufacturers should indicate the proposed implementation strategy for each modification.  In addition, manufacturers should identify whether the modifications will apply to all devices in the field (referred to as global adaptations) or will be implemented based on a specific clinical site or individual patients” (referred to as local adaptations).  For local adaptations, information should be included addressing what “local factors or conditions warrant a local change.”

    FDA recommends manufacturers submit each modification, associated labeling changes and specific performance evaluation in the Modification Protocol (MP).

    Modification Protocol

    The modification protocol (MP) describes the methods that will be followed when “developing, validating, and implementing those modifications, to ensure the device remains safe and effective.” For each proposed modification, the MP should describe:

    1. Data management practices: The MP should address how new data will be “collected, annotated, curated, stored, retained, controlled and used”; identify any relationship between the new data and the original data used for training and testing the initial device; define any data sequestration strategies and explain how the data are separated into training and testing dataset; and ensure that access to the testing datasets is restricted to prevent the use of that data for training.
    2. Retraining practices: The MP should state whether the model will need to be re-trained. If retraining applies to only certain parts of the ML-DSF, manufacturers will need to demonstrate that re-training does not affect other functions or software components.  The MP should also discuss how the manufacturerr will address risks associated with overfitting and model bias when re-training.
    3. Performance evaluation protocols: The MP should include plans to verify and validate modifications. If the proposed performance evaluation methods are different from the original methods used, the manufacturer should describe the differences and provide a justification for the changes.  Just like any other verification or validation activity, the protocol should include pre-defined acceptance criteria and any statistical tests used.  Since the manufacturer will be implementing the change without FDA premarket review, this section of the MP will need to include a statement that if there is a failure in performance, the failure will be recorded and the modification will not be implemented.
    4. Update procedures: The MP should describe how the manufacturer will update the software and any associated labeling that will be required for the modifications. Updates performed automatically will face a “higher bar” for demonstrating safety and effectiveness.  For automatic updates, the MP will need to describe how the software will be updated; how legacy users may be affected by the modification;  how users will be made aware of the modification; and any impact on performance that could be caused by the modification (e.g., whether clinically meaningful differences may be observed in patient results before and after the modification).  Further, the MP should address how version information will be presented to the user for the modified device.  In addition, manufacturers may need to establish a device monitoring plan that will address how they will monitor post market device performance of the modifications, including monitoring real-world device performance or justify why that device monitoring is not necessary.

    The draft guidance includes an appendix with example elements that may be required in a MP depending on the size, scope, complexity, and risk associated with each proposed modification.

    Impact Assessment 

    A PCCP should include an impact assessment that evaluates the risks and benefits of the modifications and how any risks will be mitigated.  The impact assessment can be included with the MP or provided as a stand-alone document, and should include:

    1. a comparison of the version of the device without modification to the version of the device with the modifications implemented;
    2. risks and benefits of the modifications;
    3. how the MP will continue to reasonably ensure safety and effectiveness;
    4. how the implementation of one modification affects the implementation of another; and
    5. the cumulative impact of all modifications.

    Things to Consider When Deciding Whether to Include a PCCP

    PCCPs provide a new mechanism for introducing certain significant changes to an ML-DSF.  The use of a PCCP is not required; a manufacturer can continue to implement significant device changes via supplemental submissions to FDA.  However, including a PCCP can speed up the process of making post-market software modifications and potentially reduce costs by avoiding additional marketing submissions.

    Once authorized, a PCCP is considered a technological characteristic of the authorized device.  Consequently, details of the PCCP would be included in the 510(k) Summary, De Novo decision summary, or PMA Summary of Safety and Effectiveness.  Manufacturers seeking to modify a PCCP once it has been authorized will need to submit the modified PCCP as part of a marketing submission for FDA’s review.  The PCCP is applicable only to the device that was the subject of the market authorization in which it was included, which means that, if the manufacturer makes other changes to the device before implementing the modifications outlined in the PCCP, a new submission for the modified device will be needed to reestablish the PCCP.

    The Agency recommends that manufacturers discuss the PCCP strategy with FDA through the Q-Submission program before submitting a marketing submission with a PCCP.  We note that FDA has already updated the eStar template to include a separate section indicating whether the sponsor is including a PCCP with the submission and a mechanism to attach it to the submission.

    Industry stakeholders seeking to provide feedback to FDA can submit comments to  Docket: FDA-2022-D-2628 by July 3, 2023.

    Categories: Medical Devices

    TO BE CONTINUED (!?): DEA Announces It is Issuing a “Temporary Rule” to Address Telemedicine Flexibilities After the End of the COVID-19 Pandemic Emergency

    On May 3, 2023, DEA’s Administrator Anne Milgram issued a very brief and lightly publicized statement announcing that DEA intends to issue a “temporary rule” extending telemedicine flexibilities that existed during the COVID-19 Emergency Declaration, which Declaration is set to expire on May 11, 2023.  Most notably for the millions of patients who, for over three years, have depended on telemedicine solutions to receive needed controlled substance medications, the Declaration’s expiration would also put an end to DEA’s flexibilities permitting certain exemptions to the Ryan Haight Online Privacy and Consumer Protection Act’s in-person examination requirements.

    As a reminder, back in February 2023, HPM blogged about DEA’s two proposed rules for prescribing controlled substances generally, and for buprenorphine use in opioid treatment.  HPM also conducted a  90-minute webinar addressing the “End of the COVID-19 Emergency and the Ryan Haight Act: Telemedicine and Next Steps.” HPM’s Presentation Deck and Recording of the Presentation. slides are here, and here (passcode Bv3*o^i5).

    Why is DEA now putting the brakes on its rulemakings, given the Emergency Declaration expires in just a week? DEA states that it received over 38,000 (yes, 38,000!) comments on the proposed rules.  DEA is taking these comments “seriously” and is considering them “carefully,” which, by the way, it is generally required to do for rulemakings issued pursuant to the Administrative Procedure Act (5 U.S.C. §553).   See Perez v. Mortg. Bankers Ass’n, 575 U.S. __, 135 S. Ct. 1199, 1203 (2015) (“An agency must consider and respond to significant comments received during the period for public comment.”).

    DEA and HHS have submitted a draft Temporary Rule to the Office of Management and Budget titled “Temporary Extension of COVID-19 Telemedicine Flexibilities for Prescription of Controlled Medications.”  We eagerly await further details about the temporary rule.  We will update our readers when the temporary rule is published – hopefully soon– in the Federal Register.

    Clinical Trials Join the Remote Work Revolution: FDA’s New Draft Guidance on Decentralized Clinical Trials

    On May 2nd, FDA released a new draft guidance with recommendations for decentralized clinical trials (DCTs) for drugs, biologics, and devices.  A DCT is a clinical trial where some or all of the trial-related activities, such as administration of the investigational product, data collection, or safety monitoring, occur at locations other than traditional clinical trial sites.  In a DCT, trial-related activities may occur in trial participants’ homes, at local health care providers’ offices, or in local clinical laboratories.

    DCTs became more common during the COVID-19 public health emergency, when sponsors were motivated to conduct more clinical trial activities remotely in order to avoid in-person interaction.  This draft guidance builds on recommendations that FDA initially developed early in 2020, in response to the COVID-19 challenges (see our blog post on these recommendations here).

    Section 3606(a) of the Food and Drug Omnibus Reform Act (FDORA) directed FDA to “issue or revise draft guidance that includes recommendations to clarify and advance the use of decentralized clinical studies to support the development of drugs and devices,” not later than December 29, 2023.  This draft guidance was published in response to this statutory mandate.

    The draft guidance notes that DCTs may not be feasible for all study designs.  Notably, the draft guidance explains that variability of the data obtained in a DCT, compared to a traditional clinical trial, could affect the validity of finding non-inferiority but would not affect the validity of a finding of superiority.  For example, in a non-inferiority trial where the effect size of an active control drug has only been determined in a traditional clinical trial, the same effect size may not be seen for the active control drug in a DCT.

    With regard to clinical trial visits and activities, the draft guidance provides examples of the types of approaches that may be possible with a DCT.  Study visits can be conducted using telehealth visits if in-person interaction is not necessary.  Trial personnel can also be sent to participant’s homes.  Visits can also potentially be conducted by local health care providers close to a participant’s home, rather than clinical trial personnel.

    DCTs often include the use of digital health technologies (DHTs), which is technology that can be used to remotely capture and transmit health care information.  DHTs include monitoring instruments (e.g., activity trackers, glucose monitors) and software (e.g., mobile applications to capture patient-reported outcomes through questionnaires).

    The draft guidance is part of a larger FDA initiative related to DHTs.  For example, in March 2023, FDA issued a Framework for the Use of Digital Health Technologies in Drug and Biological Product Development, which noted that FDA would publish guidance on the use of DHTs in both traditional and decentralized clinical trials.  FDA has created a DHT for Drug Development website and an email address for questions related to DHT-derived data (dhtsfordrugdevelopment@fda.hhs.gov).  FDA has also launched a series of five public workshops on issues related to DHTs in regulatory decision-making.

    The draft guidance cautions that any DHTs used in a DCT should be “available and suitable” for all trial participants.  If participants are permitted to use their own DHTs, sponsor-provided DHTs should be available as an option to avoid excluding participants from the trial due to lack of available technology.  In a CDER Conversation regarding DCTs and DHTs, Leonard Sacks, Associate Director for Clinical Methodology in CDER’s Office of Medical Policy, noted that there is a risk that technical hurdles could skew a trial population to a “younger and more tech savvy” population compared to the actual patient population.

    DCTs also have the potential to increase diversity and inclusiveness in trial populations.  The draft guidance states that the use of local health care providers, for example, may “improve engagement, recruitment, and retention of diverse participants” and “may reduce cultural or linguistic barriers.”  Dr. Sacks also explained that DHTs and DCTs may “open access to research” for older individuals and people with disabilities who are not able to travel to clinical trial sites, but could participate from home or a nearby clinic.

    The draft guidance outlines some of the practical considerations for DCTs with regard to recordkeeping and clinical trial operations.  For example, the draft guidance notes that the trial’s data management plan should include information about the multiple sources of data collection.  Additionally, the draft guidance describes when local health care providers may be considered sub-investigators for purposes of completing Form FDA 1572 (for drugs) or the list of investigators in an investigational device exemption (IDE) (for devices).  Investigators should also maintain a task log of all local health care providers who perform trial-related activities.

    The draft guidance also states that informed consent can be collected remotely or electronically as part of a DCT, so long as there is institutional review board oversight.  The informed consent process should inform participants whom they should contact with questions.

    The draft guidance describes situations when an investigational product should be administered with in-person supervision by an investigator at a trial site versus shipped to a patient’s home.  Investigational products that involve complex administration procedures or have a high-risk safety profile may require in-person supervision, while products for which the safety profile is well-characterized and do not involve specialized monitoring could be administered at home without direct supervision.  The stability profile of the product must be considered when a product is shipped to a participant’s home.

    The draft guidance provides recommendations related to the safety monitoring plan in a DCT.  The safety monitoring plan should ensure that all adverse events are appropriately captured and addressed despite the decentralized nature of the trial.  There should also be a plan in place for responding to adverse events, including how participants are expected to seek medical assistance locally when necessary.

    Finally, the draft guidance addresses the use of software in a DCT.  All parties using software should be trained on how to use it properly.  Any software that is used to produce or process trial records must be compliant with the requirements in 21 C.F.R. Part 11.  FDA considers real-time video interactions to be a live exchange of information between trial personnel and trial participants, so these interactions are not subject to Part 11, though local laws regarding telehealth may apply.

    FDA is accepting public comment on the draft guidance until August 1.

    OTC Monograph Reform Update – Final Deemed Final Orders Posted by FDA

    FDA posted the last five “deemed final orders” under OTC monograph reform this week.  All 33 of the final orders can now be found at OTCMONOGRAPHS@FDA.  Under the 2020 Coronavirus Aid, Relief, and Economic Security Act (CARES Act) (see our blog post here), all final monographs (i.e., the regulations formerly found in 21 C.F.R. parts 331 through 358) were deemed to be final administrative orders as of the CARES Act effective date.  As part of the implementation of monograph reform, the deemed orders were to be posted on FDA’s website.

    As the first step in implementing this provision of the CARES Act, FDA issued a Federal Register notice on September 21, 2021, announcing the availability of the first group of deemed final administrative orders (see our blog post here).  The initial group posted also included the administrative order containing a list of certain active ingredients offered for certain OTC uses FDA had found to be non-monograph conditions (former 21 CFR § 310.545).  The deemed final orders posted this week are from the therapeutic areas of anticaries drug products, external analgesics, first aid antibiotics, first aid antiseptics, and laxatives.

    At the moment, all 33 final monographs can be found on FDA’s website and in the CFR (on-line and in the paper volumes for those of us who still look forward to the new color each year).  FDA announced that it will be taking the next step of issuing a notice to withdraw the regulations establishing final monographs in the CFR.  With that withdrawal, the administrative tasks associated with changing final monographs from regulations to final administrative orders will be complete and the 21 CFR volume including Part 300 et seq will be noticeably thinner next year.

    Join Us for an HP&M Webinar – Demystifying DEA Inspections: Accountability Audits, Mirror Reviews and Mock Inspections (Wednesday, May 24: 12:00-12:45)

    Accounting for controlled substances, maintaining complete and accurate records/reports and employing effective, compliant security do not alone guarantee a successful Drug Enforcement Administration (“DEA”) inspection.  A negative DEA inspection can plague registrants for years.

    Hyman, Phelps & McNamara, P.C. (“HP&M”) invites you to join Director Larry Houck for a free webinar demystifying DEA inspections by providing an understanding of controlled substance accountability audits, the importance of conducting mirror reviews and mock DEA-style internal inspections.  The webinar will share additional valuable inspection tips.

    Registrants are far from powerless when DEA investigators inspect their controlled substance operations.  This webinar will provide insight on how to prepare for and manage inevitable DEA inspections to help ensure favorable results.

    Before joining HP&M in 2001, Mr. Houck conducted numerous scheduled cyclic and targeted inspections and investigations as a DEA Diversion Investigator in the field for ten years.  He later served as Staff Coordinator in Diversion Control’s Liaison and Policy Section at DEA headquarters.

    We hope that you will be able to join us!  Please see the attached flyer that includes a link to register for the webinar.

    B-B-B-B-Bad to the Bone? The Brought Back BLOCKING Act: Better, But Still Bad for Business and Buyers

    On the day I was born
    The nurses all gathered ‘round
    And they gazed in wide wonder
    At the joy they had found
    The head nurse spoke up
    Said, “Leave this one alone”
    She could tell right away
    That I was bad to the bone


    As we noted in our post yesterday, on May 2nd, the U.S. Senate Committee on Health, Education, Labor and Pensions (“Senate HELP”) is scheduled to discuss in an Executive Session various pieces of FDA legislation.  Among those pieces of legislation—all intended to shield FDA from litigation in some way, shape, or form—is the latest version of the “Bringing Low-cost Options and Competition while Keeping Incentives for New Generics Act,” which is better known as the “BLOCKING Act,” and that would significantly alter the ANDA Paragraph IV 180-day exclusivity incentive.  This time, however, it is called the “Expanding Access to Low-Cost Generics Act of 2023” (S. 1114).

    The BLOCKING Act has been floating around as a legislative proposal since February 2018 when it appeared in the Trump Administration’s Proposed Fiscal Year 2019 Budget (pages 22 and 51).  It has drawn this blogger’s ire in prior blog posts (herehere, here, and here) and in Congressional testimony as antithetical to a primary goal of the Hatch-Waxman Amendments: getting high quality, low-cost generic drugs into the hands of consumers—fast.  It made some headway last year as as part of the Senate HELP-passed S.4348, the “Food and Drug Administration Safety and Landmark Advancements Act of 2022” (Section 515), but ultimately was not enacted.  Then earlier this year, the BLOCKING Act reappeared as a proposal in FDA’s Summary of FY 2024 Legislative Proposals:

    Amend the 180-Day Exclusivity Provisions to Encourage Timely Marketing of First Generics

    FDA is proposing that the FD&C Act be revised to specify that 180-day patent challenge exclusivity for generic drugs does not block approval of subsequent applications from other generic drug manufacturers until a first applicant begins commercially marketing the drug; this revision should ensure that the exclusivity period lasts 180 days (i.e., from the date of first commercial marketing by a first applicant until 180 days later) rather than for multiple years, as can occur under current law (i.e., while the first applicant is eligible for 180-day exclusivity prior to commercial marketing in addition to the 180-day period itself). 180-day patent challenge exclusivity is intended to provide an incentive and a reward to the first generic drug applicant(s) to submit a substantially complete application with a certification that a patent listed for its reference listed drug is invalid, unenforceable or not infringed by the ANDA, and thus expose themselves to the risk of patent litigation. Forfeiture provisions, under which a first applicant may lose its eligibility for this exclusivity, also seek to motivate first applicants to begin marketing quickly in order to reap the benefits of this marketing exclusivity. In practice, however, the framework has not been operating to encourage early generic entry. First applicants often “park” their eligibility for this exclusivity either by declining to begin marketing their product for extended periods of time after ANDA approval, or by delaying receipt of final approval of their ANDAs for extended periods of time, while avoiding a forfeiture. FDA’s proposal would substantially increase the likelihood that generic versions of patent-protected drugs will come into the market in a timely fashion, and that multiple versions of generic products will be approved quickly (leading to significant cost savings).

    The current iteration of the BLOCKING Act that is the “Expanding Access to Low-Cost Generics Act of 2023” (S. 1114) and that Senate HELP will discuss on May 2nd would, like its progeny, further dilute the 180-day exclusivity incentive by amending the Paragraph IV 180-day exclusivity statutory provisions at FDC Act § 505(j)(5) to place new conditions on when a subsequent Paragraph IV ANDA can be approved notwithstanding a first applicant’s eligibility for 180-day exclusivity.  But unlike its progeny, S. 1114 includes a new proviso that is intended to guard against a subsequent Paragraph IV ANDA gutting the exclusivity incentive, and would thus somewhat blunt the negative effective of the proposal.  Below is the relevant text from the bill with proposed additions to FDC Act § 505(j)(5)(B)(iv) identified in red, italicized, bold typeface:


    (I) EFFECTIVENESS OF APPLICATION.—Subject to subparagraph (D) and subclause (III), if the application contains a certification described in paragraph (2)(A)(vii)(IV) and is for a drug for which a first applicant has submitted an application containing such a certification, the application shall be made effective on the date that is 180 days after the date of the first commercial marketing of the drug (including the commercial marketing of the listed drug) by any first applicant or an applicant whose application was approved pursuant to subclause (III). If an applicant described in subclause (III) is eligible for effective approval on the same day a tentatively approved first applicant who has requested final approval is determined by the Secretary to be eligible for effective approval by meeting all the approval requirements of this subsection, such applicant described in subclause (III) may not receive effective approval until 180 days after the first applicant begins commercial marketing of the drug. . . .

    (III) APPLICANT APPROVAL.—The Secretary may approve an application containing a certification described in paragraph (2)(A)(vii)(IV) that is for a drug for which a first applicant has submitted an application containing such a certification, notwithstanding the eligibility of a first applicant for the 180-day exclusivity period described in subclause (II)(aa), if each of the following conditions is met:

    (aa) The approval of such application could be made effective, but for the eligibility of a first applicant for 180-day exclusivity under this clause.

    (bb) The applicant of such application has submitted a certification to the abbreviated new drug application that there are no conditions that would prevent the applicant from commercial marketing within 75 days after the date of approval and that the applicant intends to so market the drug.

    (cc) At least 33 months have passed since the date of submission of an application for the drug by at least one first applicant.

    (dd) Approval of an application for the drug submitted by at least one first applicant is not precluded under clause (iii).

    (ee) No application for the drug submitted by any first applicant is effectively approved on the date that the conditions under items (aa), (bb), (cc), and (dd) are all met and maintained.

    New to the above calculus included in prior versions of the BLOCKING Act is the addition of a “tie-goes-to-the-runner” provision at proposed FDC Act § 505(j)(5)(B)(iv)(I), a longer (i.e., 33-month instead of 30-month) period under proposed FDC Act § 505(j)(5)(B)(iv)(III)(cc) to account for longer ANDA approval times, and an additional criterion at proposed FDC Act § 505(j)(5)(B)(iv)(III)(bb) requiring a subsequent Paragraph IV applicant to certify that “there are no conditions that would prevent the applicant from commercial marketing within 75 days after the date of approval and that the applicant intends to so market the drug.”  (We previously analyzed the other criteria in proposed FDC Act § 505(j)(5)(B)(iv)(III), which appeared in prior versions of the BLOCKING Act.)

    The new certification criterion is further laid out and explained in a special approval status rule for certain subsequent applicants at proposed FDC Act § 505(j)(5)(D)(v):

    (v) SPECIAL APPROVAL STATUS RULE FOR CERTAIN SUBSEQUENT APPLICANTS.—An application that is approved pursuant to subclause (III) of subparagraph (B)(iv) is deemed to be tentatively approved and to no longer have an effective approval pursuant to such subclause (III) on the date that is 76 days after the date on which the approval has been made effective pursuant to such subclause (III) if the applicant fails to commercially market such drug within the 75-day period after the date on which the approval is made effective. If the applicant of an application approved pursuant to such subclause (III) submits a notification that it can no longer commence commercial marketing within 75 days after the date of approval, as required under subparagraph (B)(iv)(III)(bb), its application is deemed to be tentatively approved and to no longer be effectively approved on the date that such a notification is received. If an applicant does not commence commercial marketing within the 75-day period, it shall not be eligible for a subsequent effective approval for the application under subclause (III) of subparagraph (B)(iv) unless, in addition to meeting each of the conditions in such subclause (III), it submits a certification to its abbreviated new drug application that an event that could not have been reasonably foreseen by the applicant prevented it from commencing commercial marketing and that it has fully resolved this issue. The applicant shall submit notification to the abbreviated new drug application confirming that such applicant has commenced commercial marketing of the drug not later than one business day after commencing such marketing.

    Under this special rule, a what we’ll coin as a “Special Subsequent Paragraph IV Applicant” that makes a certification under proposed FDC Act § 505(j)(5)(B)(iv)(III)(bb) and that does not commercially market within the certified-to 75-day period has its final ANDA approval converted to (or deemed) a tentative approval.  If the stars line up again for that Special Subsequent Paragraph IV Applicant, it cannot be once again be eligible for approval under proposed FDC Act § 505(j)(5)(B)(iv)(III) unless “it submits a certification to its [ANDA] that an event that could not have been reasonably foreseen by the applicant prevented it from commencing commercial marketing and that it has fully resolved this issue.”

    The exception provision above is intended to be narrow so that the exception does not swallow the “one-shot-deal” rule.  And whoever it was who drafted this provision clearly had something in mind: the “event that could not have been reasonably foreseen” language parallels language in FDA’s MAPP 5240.3 (Rev. 6), titled “Prioritization of the Review of Original ANDAs, Amendments, and Supplements,” concerning priority review for certain ANDA supplements under 21 C.F.R. § 314.70(b)(4).  Under MAPP 5240.3 (Rev. 6), FDA states:

    Supplements for which a priority review is requested under 21 CFR 314.70(b)(4)

    Under 21 CFR 314.70(b)(4), an applicant may ask FDA to grant a priority review to “a supplement for public health reasons or if a delay in making the change described in [the supplement] would impose an extraordinary hardship on the applicant.”  Under this factor, “extraordinary hardship on the applicant” will be interpreted to include the following:

    • Catastrophic events such as explosion, fire, or storm damage to manufacturing facilities.
    • Events that could not have been reasonably foreseen by the applicant and for which the applicant could not have planned. Examples include:
      • An abrupt discontinuation of the supply of an active ingredient, packaging material, or container closure system.
      • The relocation of a facility or a change in an existing facility because of a catastrophic event.

    The proposed new certification requirement and accompanying special rule provision are significant improvements to prior iterations of the BLOCKING Act.  That being said, it’s kind of like putting lipstick on a pig.  In the end, the “Expanding Access to Low-Cost Generics Act of 2023” (S. 1114) is still the BLOCKING Act, and it is still bad to the bone.  As we’ve said before, what generic drug companies would be willing to invest millions of dollars in generic drug development and patent challenges for the potential of a hollow exclusivity incentive?  More ANDA approvals does not necessarily translate into more launches.  Over time, a new exclusivity regime for Paragraph IV ANDAs may mean fewer ANDA approvals and launches.  And that ultimately means more drug shortages of critical medicines, fewer choices for consumers, and higher costs to the U.S. healthcare system.

    New Legislation Would Cut Off Access To The Courts And Immunize FDA Actions From Timely Judicial Review

    On May 2nd, the U.S. Senate Committee on Health, Education, Labor and Pensions (“Senate HELP”) is scheduled to take up legislation that could significantly limit access to the courts and immunize critical FDA decisions from timely judicial review.  That bill is S. 1067, the “Ensuring Timely Access to Generics Act of 2023,” and it would fundamentally transform the playing field for NDA, ANDA, BLA, and aBLA applicants seeking to preserve their rights in the wake of an adverse FDA approval decision.

    It does so by amending FDC Act § 505(q), the current statutory subsection regarding citizen petitions.  Subsection 505(q) initially was added by Section 914 of the 2007 FDA Amendments Act (“FDAAA”), Pub. L. No. 110-85 (2007), as amended by Section 301 of Pub. L. No. 110-316 (2008) and by Section 1135 of the FDA Safety and Innovation Act (“FDASIA”), Pub. L. No. 112-144 (2012).  And, as originally drafted, it was narrowly intended to prevent the citizen petition process from being used to delay the approval of ANDAs,  505(b)(2) applications, and aBLAs.  We’ve posted on FDC Act 505(q) many times over the years (see, e.g., here, here, here, and here).

    As background, FDC Act § 505(q) states that FDA shall not delay approval of a pending ANDA, 505(b)(2) application, or 351(k) biosimilar application as a result of a citizen petition submitted to the Agency pursuant to 21 C.F.R. § 10.30 (citizen petition) or § 10.35 (petition for stay of action), unless FDA “determines, upon reviewing the petition, that a delay is necessary to protect the public health.”  FDA is required to “take final agency action on a petition not later than 150 days after the date on which the petition is submitted.”  FDA may not extend the 150-day period “for any reason,” including consent of the petitioner.  In addition, FDA may deny a petition if the Agency “determines that a petition or a supplement to the petition was submitted with the primary purpose of delaying the approval of an application and the petition does not on its face raise valid scientific or regulatory issues, the Secretary may deny the petition at any point based on such determination.”

    That last provision—concerning petitions that are intended solely to delay the entry of competing products—was the subject of FDA’s most recent modifications to guidance on FDC Act § 505(q) (see our previous post here), in which FDA identified the various factors it would apply in determining whether or not a petition was submitted to the Agency with with the primary purpose of delay.  And in December 2021, we saw FDA apply those factors in responding to a citizen petition (Docket No. FDA-2021-P-1211) concerning generic VASOSTRICT (vasopressin).

    Current FDC Act § 505(q) also includes a provision addressing judicial review of final Agency action.  Specifically, subsection 505(q)(2) deems FDA to have taken judicially reviewable final agency action on a petition if the Agency either makes a final decision within the meaning of 21 C.F.R. § 10.45(d) during the 150-day period (including the common FDA response of denying a petition without comment), or if the 150-day period expires without FDA having made a final decision on the petition.  Under current FDC Act § 505(q)(2)(B), if a civil action is filed against FDA “with respect to any issue raised in the petition before the Secretary has taken final agency action on the petition. . . , the court shall dismiss without prejudice the action for failure to exhaust administrative remedies.”  This statutory provision was tested once without much luck (see our previous post here).

    With that background, let’s get back to S. 1067, which first reared its head in Spring 2022 as an amendment to  S.4348, the “Food and Drug Administration Safety and Landmark Advancements Act of 2022” (Section 511).  In addition to amending FDC Act § 505(q) to incorporate the various “intent to delay” factors FDA currently uses to determine whether a petition was submitted with the primary purpose of delaying FDA’s approval of an application, the new bill rewrites FDC Act § 505(q)(2) in a manner that appears calculated to immunize FDA’s actual final approval decisions from timely judicial review.  Specifically, the bill would amend the law to state:

    (2) Exhaustion of administrative remedies

    (A) IN GENERAL.—A person shall submit a petition to the Secretary under paragraph (1) before filing a civil action in which the person seeks to set aside, delay, rescind, withdraw, or prevent submission, review, or approval of an application submitted under subsection (b)(2) or (j) of this section or section 351(k) of the Public Health Service Act. Such petition and any supplement to such a petition shall describe all information and arguments that form the basis of the relief requested in any civil action described in the previous sentence.

    (B) TIMELY SUBMISSION OF CITIZEN PETITION.—A petition and any supplement to a petition shall be submitted within 60 days after the person knew, or reasonably should have known, the information that forms the basis of the request made in the petition or supplement.

    (C) FINAL AGENCY ACTION.—The Secretary shall be considered to have taken final agency action on a petition if—

    (i) the Secretary makes a final decision within the meaning of section 10.45(d) of title 21, Code of Federal Regulations (or any successor regulation); or

    (ii) on or after the date that is 151 days after the date of submission of the petition, the Secretary approves or has approved the application that is the subject of the petition without having made such a final decision.


    (i) PETITION.—If a person files a civil action against the Secretary in which a person seeks to set aside, delay, rescind, withdraw, or prevent submission, review, or approval of an application submitted under subsection (b)(2) or (j) of this section or section 351(k) of the Public Health Service Act without complying with the requirements of subparagraph (A), the court shall dismiss without prejudice the action for failure to exhaust administrative remedies.

    (ii) TIMELINESS.—If a person files a civil action against the Secretary in which a person seeks to set aside, delay, rescind, withdraw, or prevent submission, review, or approval of an application submitted under subsection (b)(2) or (j) of this section or section 351(k) of the Public Health Service Act without complying with the requirements of subparagraph (B), the court shall dismiss with prejudice the action for failure to timely file a petition.

    (iii) FINAL RESPONSE.—If a civil action is filed against the Secretary with respect to any issue raised in a petition timely filed under paragraph (1) in which the petitioner requests that the Secretary take any form of action that could, if taken, set aside, delay, rescind, withdraw, or prevent submission, review, or approval of an application submitted under subsection (b)(2) or (j) of this section or section 351(k) of the Public Health Service Act before the Secretary has taken final agency action on the petition within the meaning of subparagraph (C), the court shall dismiss without prejudice the action for failure to exhaust administrative remedies.

    Yeah, you read that correctly!  If S. 1067 is enacted, it would require potential litigants to submit a citizen petition to FDA not only before filing suit with respect to issues that were known and could have been raised prior to FDA’s approval of an application, but also before filing suit with respect to previously unknown issues even after FDA has granted a final approval—the quintessential “final agency action” in the FDA context, and of course the subject of hard-fought Administrative Procedure Act litigation in the federal courts for decades.  Taken together, these aspects of the proposed legislation are likely to prevent potential litigants—including brands, generics, public-interest groups, and interested members of the public—from vindicating their rights or protecting their interests in multiple contexts, and ultimately poses a clear and direct threat to the public health by immunizing critical safety-related issues from timely judicial review.

    These problems arise because sponsors and other interested members of the public frequently do not know about potential regulatory issues (or cannot reasonably disclose what they may know about those issues because of a protective order in pending litigation or other trade-secret and confidentiality concerns) until after FDA issues a final approval.  Indeed, in many cases, no one beyond FDA and the application’s sponsor has any idea that an application implicating such issues even is pending before the Agency; FDA’s confidentiality regulations preclude the Agency from disclosing the existence of an unapproved application, and sponsors who otherwise might receive notice of a pending application (e.g., by receiving a Paragraph IV notice) nonetheless might remain in the dark because a particular application references a different RLD or lacks a Paragraph IV certification.

    S. 1067, however, could effectively preclude potential litigants from protecting their interests in court even if they had no idea about a potential issue prior to approval, even after FDA has fundamentally altered the marketplace by approving an application in alleged violation of the law—for instance, by issuing approval before the conclusion of a thirty-month stay; a pediatric exclusivity period; a new chemical entity (“NCE”) or new-indication exclusivity period; an orphan-drug exclusivity (“ODE”) period; a 180-day exclusivity period; or by approving disputed labeling change. That is so because the proposed bill would condition access to the courts on: (1) potential litigants first filing a post-approval citizen petition asking FDA to unwind its approval decision; and (2) the Agency then taking final action on the post-approval citizen petition, which the statute makes clear can up to 150 days.

    Between the time needed to prepare such a post-approval citizen petition; and the 150-day period FDA is granted to address such a petition; and the time it takes to prepare post-petition litigation papers; and the time it takes a court to resolve litigation after it is filed, S. 1067 easily could prevent the sponsor from securing judicial relief for 6-9 months after an allegedly unlawful approval.  That delay would consume the entirety of an NDA holder’s pediatric exclusivity or a first-to-file ANDA sponsor’s 180-day exclusivity, and a considerable portion (if not the entire remaining amount) of a thirty-month stay, new-indication exclusivity, NCE, or ODE period.  Importantly, because FDA has sovereign immunity from damages claims, sponsors trapped in S. 1067’s post-approval citizen petition web can never be made whole for their losses even if a court later agrees that FDA acted unlawfully in approving the application at issue.

    S. 1067 isn’t bad just for application sponsors. It threatens grave risks to the public health. While these two authors certainly have seen our fair share of petitions and lawsuits raising dubious “safety concerns,” and indeed have persuaded FDA to refer bad actors to the FTC in past cases, we also have been party to a number of matters that raise indisputably serious potential health risks.  We have the utmost respect for the seriousness with which FDA’s scientists and regulatory professionals approach these matters, and are confident that no one at FDA wants to see potentially dangerous drugs on the market.  But FDA also tends to move slowly and deliberately even under the best circumstances; it is chronically underfunded, overwhelmed by competing demands (including a backlog of unresolved citizen petitions), and—like all federal agencies—constrained in its ability to respond even to the most pressing matters because of the cumbersome bureaucratic procedures inherent in any administrative agency (especially one as sprawling as FDA).

    In the many decades we have been practicing in this space, we are fortunate that FDA has never once refused to engage when we’ve brought an urgent matter to its attention.  But it’s one thing to discuss matters with the Agency, and another thing entirely for FDA to take action.  Litigation risk tilts the balance: In our experience, the prospect of taking FDA to court when it makes a mistake, violates the law, or otherwise compromises the public interest is the only tool that reliably ensures FDA will prioritize a given issue and dedicate the resources and personnel needed to resolve it quickly and appropriately.  Put simply, nothing focuses FDA’s attention on a matter more effectively than the risk it might soon be forced to explain its action (or lack of action) to a United States District Judge. We have no doubt the same is true of other federal agencies—which, of course, is a big reason why the Administrative Procedure Act has authorized aggrieved parties to file suit over an agency’s undue delay or its final agency actions for nearly 80 years.

    S. 1067 would gut that venerable tool: By curtailing timely judicial review of final approvals—game-changing final agency actions that, to reiterate, have been litigated for generations—the proposed law threatens to remove the only real leverage through which the public can ensure prompt agency action. And without that tool, there is literally nothing to prevent FDA from taking months to evaluate market-transforming legal issues and pressing safety concerns, even as vulnerable patients are exposed potentially dangerous drugs and sponsors see their competitive standing destroyed. Indeed, that appears to be the precise objective of these provisions in S. 1067: to make it more difficult for the public to hold FDA to account after it has approved a product in alleged violation of the law, by shielding FDA from litigation.  The fact that S. 1067 might allow these issues to be litigated months down the road therefore provides no solace: That’s far too late for patients, sponsors, and the broader public.

    We certainly hope that Senate HELP will consider these issues as it entertains S. 1067 later this week in its Executive Session, and encourage readers of this blog to consider contacting your Representative and Senators about S. 1067 at the earliest possible opportunity.

    It’s the Law Now – Cybersecurity Information in Premarket Submissions

    Does your firm manufacture a “cyber device”?  A recent amendment to the Federal Food, Drug, and Cosmetic Act (FD&C Act) added a new section about cybersecurity for “cyber devices.”  If a device uses software that connects to the internet, it is most likely a cyber device and subject to new section 524B of the FD&C Act, “Ensuring Cybersecurity of Devices.” This provision became effective as of March 29, 2023.  It will become part of the “refuse to accept” (RTA) checklist on October 1, 2023.

    FDA’s New Cybersecurity Authority

    Over the past years, FDA has been expanding efforts to encourage mitigation of cybersecurity threats to medical device functionality and device users, but the FDA’s recommendations with respect to the cybersecurity of medical devices were not codified into law prior to the enactment of section 524B of the FD&C Act. The primary vehicle for FDA to request cybersecurity information in premarket submissions has been guidance documents.  However, FDA’s legal standing to insist on cybersecurity features, especially within the substantial equivalence paradigm, has been questionable.  Now, with explicit statutory authority, FDA’s push for cybersecurity has a firm legal footing.

    Congress has given FDA the authority to require device manufacturers to provide cybersecurity information in their premarket submissions for a “cyber device.”  Section 524B(a) states:

    A person who submits an application or submission under section 510(k), 513, 515(c), 515(f), or 520(m) [i.e., 510(k), premarket approval application (PMA), Product Development Protocol (PDP), De Novo, or Humanitarian Device Exemption (HDE)] for a device that meets the definition of a cyber device under this section shall include such information as [FDA] may require to ensure that such cyber device meets the cybersecurity requirements. . . .

    Definition of A Cyber Device

    Section 524B(c) defines a “cyber device” as a device that—

    (1) includes software validated, installed, or authorized by the sponsor as a device or in a device;

    (2) has the ability to connect to the internet; and

    (3) contains any such technological characteristics validated, installed, or authorized by the sponsor that could be vulnerable to cybersecurity threats.

    The technological characteristics in this context may cover a wide range of device functions, for instance, monitoring features, stimulation parameters, and communications with healthcare providers.  It applies whether the software is the entire device (i.e., Software as a Medical Device, or SaMD) or the software is embedded in a traditional hardware device (i.e., Software in a Medical Device, or SiMD).

    Note that section 3060(a) of the 21st Century Cures Act in 2016 amended section 520 of the FD&C Act and removed certain software functions from the statutory definition of a medical device.  Therefore, a firm should first determine whether its product meets the statutory definition of a medical device.  Of course, if a product does not meet the definition of device, it is not subject to the FD&C Act.  We have recently blogged on this topic (“Is my software a medical device?”).

    The new requirements

    Section 524B(b) requires sponsors to provide the following information in premarket submissions for cyber devices:

    (1) submit to the Secretary a plan to monitor, identify, and address, as appropriate, in a reasonable time, postmarket cybersecurity vulnerabilities and exploits, including coordinated vulnerability disclosure and related procedures;

    (2) design, develop, and maintain processes and procedures to provide a reasonable assurance that the device and related systems are cybersecure, and make available postmarket updates and patches to the device and related systems to address—

    (A) on a reasonably justified regular cycle, known unacceptable vulnerabilities; and

    (B) as soon as possible out of cycle, critical vulnerabilities that could cause uncontrolled risks; [and]

    (3) provide to the Secretary a software bill of materials, including commercial, open-source, and off‑the‑shelf software components.


    Section 524B became effective on March 29, 2023.  Through a recent (and very short) Guidance document, FDA indicated that, starting on October 1, 2023, FDA may base “refuse to accept” (RTA) decisions on the information required by section 524B.  Until this deadline, FDA generally intends not to issue RTA decisions based solely on the information required by section 524B.  Instead, FDA “intends to work collaboratively with sponsors of such premarket submissions as part of the interactive and/or deficiency review process.” Id. at 2.

    Note that FDA does not conduct an RTA acceptance review for submissions submitted via eSTAR.  As of April 17, 2023, the current eSTAR versions indicate: “A guided walk-through of Section 524B of the FD&C Act is not yet available below. It will be provided in a future eSTAR update.  Please refer to the help text in this section for the content that is required according to this statute.”  Users of eSTAR templates need to add attachments for cybersecurity risk management, cybersecurity management plan, continuing support plan, and cybersecurity labeling.  For those who are not familiar with an eSTAR, please refer to our previous posts: here, here, here, and here.

    Loose Ends

    IDEs.  There is still uncertainty about section 524B and how FDA is going to marry it to existing programs.  For example, what information needs to be provided in investigational device exemption (IDE) applications with respect to cybersecurity?  In the 2022 draft Guidance for Cybersecurity in Medical Devices, FDA recommends only a subset of the documentation be included in IDE applications, including (1) cybersecurity risks as part of Informed Consent Form, (2) global, multi-patient and updateability/patchability views, (3) security use case views for functionality with safety risks (e.g., implant programming), (4) software bill of materials, and (5) general labeling (connectivity and associated general cybersecurity risks, updateability/process).  Since section 524B(b) of the FD&C Act on its face does not apply to IDEs, it would seem that these recommendations are likely to remain unaltered by the new law.  It would be helpful if FDA would clarify its intentions in this regard.

    Special 510(k)s.  If a firm wants to add an additional cyber feature to a currently non-cyber device that is already authorized for commercial distribution through 510(k) clearance or a De Novo classification request, the firm needs to determine if the change can be submitted as a Special 510(k).

    The Special 510(k) Program Guidance provides an example of a change involving the addition of wireless control capabilities to a bilevel positive airway pressure (BiPAP) device intended to treat patients with obstructive sleep apnea.  The Guidance notes that “[v]erification and validation should be conducted to ensure that the BiPAP has acceptable wireless quality of service, coexistence, cybersecurity, and maintains EMC in its intended environment of use.”  The Guidance concludes that such a change cannot be reviewed in a Special 510(k), because “there are not well-established methods in an FDA-recognized voluntary consensus standard or in the manufacturer’s previous 510(k) that address the methods to evaluate the addition of wireless control for this BiPAP. The test methods vary depending on the wireless quality of service necessary for the device’s intended use and environment of use.”

    This example suggests that the prospects are poor for adding cyber features via a Special 510(k).  However, FDA should update the Special 510(k) Program to clarify if and how the information required by section 524B could be submitted for review in a Special 510(k).

    510(k) exempt.  It appears from the plain language that section 524B does not apply to 510(k)‑exempt devices.  An interesting question is whether FDA would take the position that converting a device from non‑cyber to cyber would trip such an exemption and require a 510(k) clearance.

    What’s next?

    Section 524B(b)(4) of the FD&C Act authorizes FDA to issue regulations with additional requirements for cyber devices.  Given FDA’s track record in issuing regulations, it will likely be many years before that happens, if it ever does.

    As noted above, FDA published a draft guidance titled “Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions” just about a year ago.  Per section 3305(e) of the Omnibus, FDA must provide an updated guidance document by December 2024.  Given that it is on the A-list that FDA intends to publish during FY2023, FDA will likely publish the final guidance in a few months.  We look forward to it.

    Categories: Medical Devices

    FDA’s Draft Guidance on Externally Controlled Trials Answers Some Questions, Leaves Others Unanswered

    The Draft Guidance

    In February 2023, CDER, CBER, and the Oncology Center of Excellence published a draft guidance titled “Considerations for the Design and Conduct of Externally Controlled Trials for Drug and Biological Products” (the “Draft Guidance”) to provide recommendations to those considering the use of externally controlled clinical trials to provide evidence of safety and effectiveness of a drug product.

    An “externally controlled trial” is described in the Draft Guidance as a study in which “outcomes in participants receiving the test treatment according to a protocol are compared to outcomes in a group of people external to the trial who had not received the same treatment.”  The external control arm can be either an “historical control” (from an earlier time period) or a “concurrent control” (from the same time period but in another setting).  Because an external control can involve the use of real-world data (“RWD”), the Draft Guidance notes that this guidance is being issued to satisfy, in part, requirements from the 21st Century Cures Act on the use of real-world evidence (“RWE”) in regulatory decision-making, similar to other recent efforts in this arena that we have blogged about.  This Draft Guidance focuses on the use of patient-level data from other clinical trials or from RWD sources.  Notably, the Draft Guidance states that it is not intended to address other types of external controls, such as using summary-level estimates instead of patient-level data, nor does it discuss the use of external control data to supplement a control arm in a traditional randomized controlled clinical trial.

    The Draft Guidance states that an external control group is potentially appropriate in a setting where the natural history is well-defined and the disease is known not to improve in the absence of an intervention or with available therapies.  “For example, objective response rate is often used as a single-arm trial endpoint in oncology given the established understanding that tumor shrinkage rarely occurs without an intervention.”  However, it also cautions that in many cases, “the likelihood of credibly demonstrating the effectiveness of a drug of interest with an external control is low, and sponsors should choose a more suitable design, regardless of the prevalence of disease.” Similarly, the Draft Guidance cautions that if the anticipated effect size is modest, an externally controlled trial may not be appropriate due to the concerns regarding the impact of bias and other limitations.  The Draft Guidance also does not recommend using a non-inferiority approach for an externally controlled trial.

    As highlighted in the Draft Guidance, a prominent feature of an externally controlled trial is the absence of randomization.  A challenge caused by this is that confounding factors that can affect the measured outcome, such as certain baseline characteristics (e.g., demographic and related factors, disease characteristics, prognostic or predictive biomarkers, comorbidities, and treatments received), start of follow-up, and clinical observations collected may not be captured or similarly measured across groups.  Additionally, for historical controls, changes over time to factors such as diagnostic criteria or methods of obtaining data should be assessed.  The goal is to select similar patients in the treatment and external control groups.  The Draft Guidance recommends that Sponsors confirm that recognized, important prognostic characteristics can be assessed in the data sources used for an externally controlled trial to make the populations as comparable as possible.  Other challenges in the use of an external control include concerns over potentially important treatment imbalances between arms resulting in biases that were not documented or accounted for.  Such imbalances can involve adherence, dose, initiation timing, handling of index date, treatment duration, receipt of additional treatments, and factors in health care delivery.

    The Draft Guidance recommends that, where possible, the outcome should be assessed by individuals blinded to treatment status, which may require re-adjudication of externally controlled data.  Well-defined, reliable, and meaningful outcomes that are typically used in clinical trials may not be available in RWD due to the lack of collection of relevant data in routine care or differences in strategies used to identify certain events.  Outcomes of interest are more likely to be recorded in clinical records when the events are objective and require immediate medical attention (e.g., stroke).  The Draft Guidance recommends that sponsors should also evaluate the consistency of timing of outcome assessments, which may be influenced by the patient’s clinical status outside the context of a clinical trial.  Other challenges related to the selection of outcomes include the differential capture of intercurrent events, and the potential lack of standardization and training regarding clinical outcome assessments.

    Decisions regarding study design and the statistical analysis plan (“SAP”) should be made in a blinded manner to any external control data, according to the Draft Guidance, with the exception of planned feasibility analyses regarding such things as availability of key variables or missing data.  The analytic method should identify and manage sources of confounding and bias, including a strategy to account for differences in baseline factors and confounding variables, and missing and misclassified data.  Sponsors should also propose additional analyses to evaluate the comparability between the trial arms for important covariates.

    The Draft Guidance states that sponsors should consult with the review division early in development about whether an externally controlled trial is reasonable, and they should submit their SAP with the protocol before initiating enrollment.  Specific design elements (such as data sources, baseline eligibility criteria, endpoints, and approaches to minimize missing data and sources of bias) should be prespecified in the protocol.

    The Draft Guidance also states that sponsors must include in their marketing applications relevant patient-level data for both arms.  If sponsors do not own the data used for the external control arm, they should structure agreements with the data owner to ensure that patient-level data can be provided to FDA.

    Outstanding Questions

    This Draft Guidance expands on the 2001 ICH E10 guidance (Choice of Control Group and Related Issues in Clinical Trials) and does a fairly thorough job describing the limitations and challenges facing sponsors seeking to use an externally controlled trial, particularly using RWD.  As the determination is ultimately case-specific, the Draft Guidance does not provide many examples of scenarios where such approaches would be feasible and acceptable.  This is potentially discouraging to sponsors of drugs intended for rare and serious diseases.  If the Draft Guidance was interpreted to mean that applicability was limited to superiority trials in diseases with a well-understood natural history where the anticipated effect size is large, that would not address the reality facing many sponsors of drugs for rare diseases and potentially chill development of important drugs.  Nor is this Draft Guidance entirely consistent with ICH E10, which does not, for example, entirely foreclose the use of an external control in a non-inferiority trial (“An external control study could be a superiority study . . . or a non-inferiority study.”).

    Additionally, the Draft Guidance states: “Sponsors must include in their marketing applications relevant patient-level data (i.e., data on each participant and patient in the externally controlled trial), as required under FDA regulations, for both the treatment and external control arms.”  The regulation that FDA cites as preventing it from considering summary-level estimates in an NDA is 21 C.F.R. § 314.50(f), which states in relevant part:

    The NDA is required to contain tabulations of the data from each adequate and well-controlled study . . . .  The tabulations are required to include the data on each patient in each study, except that the applicant may delete those tabulations which the agency agrees, in advance, are not pertinent to a review of the drug’s safety or effectiveness. Upon request, FDA will discuss with the applicant in a “pre-NDA” conference those tabulations that may be appropriate for such deletion.

    However, as the Draft Guidance explicitly does not apply to the use of summary-level estimates in an external control arm, it is unclear how sponsors of NDAs seeking to utilize summary-level information available may best make use of such information and still comply with this regulation.

    Summary-level information should be able to serve a regulatory purpose, and it has, in some circumstances.  It is particularly important in the rare disease space, where patient-level data is often difficult to find.  It is not unusual for summary-level estimates, such as data published by an investigator drawing on information from one (or a few) academic centers, to be the only data available for a particular disease or condition.  It would be unfortunate to interpret the Draft Guidance to mean that these data would be entirely dismissed.  FDA should acknowledge that there is value in such data, while remaining true to its regulatory constraints.  For example, summary-level data can be very helpful in putting an observed placebo control or active control arm response into “real world” perspective. Rather than dismiss summary-level information entirely, the Draft Guidance should at least acknowledge that summary-level information may be used for other regulatory purposes.

    Comments on the Draft Guidance are due May 2nd.

    New OMOR Guidance on Format and Content – Putting the Mor(e) in OMOR

    Last week FDA checked off another item on its to-do list for implementing the Coronavirus Aid, Relief, and Economic Security Act (CARES Act) OTC monograph reform provisions.  As provided in the OMUFA Performance Goals letter, FDA issued draft guidance on the content and format of submissions.  The draft guidance for industry entitled Over-the-Counter Monograph Order Requests (OMORs):  Format and Content, outlines the information (content) and the form of and manner in which the Agency recommends that an OMOR be submitted in order for FDA to make a determination that the OMOR is sufficiently complete and formatted to permit a substantive review.

    If that language sounds familiar, that’s because it is very similar to the language used to describe the process by which FDA determines that a new drug application (NDA) will be filed (or not).  The new draft guidance continues to borrow heavily from the NDA process and FDA notes that it used the same source material on which other drug application recommendations are based including the Common Technical Document (CTD).  Multiple International Council for Harmonization (ICH) documents are referenced throughout the draft guidance as sources of further direction.

    The draft guidance outlines five modules into which a request should be organized and includes detail about each of the modules’ expected content:

    • Module 1: Administrative Information
    • Module 2: Summaries
    • Module 3: Quality
    • Module 4: Nonclinical Study Reports
    • Module 5: Clinical Study Reports

    FDA also explains that certain information related to the nonprescription use, such as consumer behavior studies (e.g., label comprehension studies, self-selection studies, actual use studies, and human factors studies), should be included in Module 5 even if they are not clinical studies.  Module 5 should also include information about safe nonprescription marketing and use if the proposed drug contains an active ingredient not previously contained in certain OTC monographs or orders, and any postmarketing safety information.

    Reminders of the need to fulfill existing environmental assessment requirements and make all submissions electronically are also included.

    The section “General Considerations for an OMOR” goes through several basic submission requirements that clearly reflect the desire to avoid the chaos that the monograph docket files became over the years.  As anyone who spent any time searching through those can attest, between the quality and organization of the submissions and the less-than-optimal results of a long-ago effort by a third-party contractor to scan the paper submissions, it could take hours of sometimes fruitless searching to sort through the comments and other documents in any given monograph.  Now FDA has made it clear that submissions are expected to be in English, electronically searchable, of reasonable size font, generally on 8.5 x 11-inch paper, and with hyperlinks to references and numbered pages.

    It is probably safe to assume that most are not surprised by these basics, but the amount of information FDA expects to be included in the modules is a far cry in terms of both quality and quantity from what in many cases has been provided by industry in the past.   The OTC monograph review is implementing process and data standards more akin to what its formerly more formal kindred NDA has had in place for decades.

    DEA Designates 4-Piperidone, Used in Illicit Manufacture of Fentanyl, A List I Chemical

    In addition to regulating drugs of abuse, the federal Controlled Substances Act (“CSA”) controls the manufacture and distribution of chemicals used in the illicit manufacture of controlled substances.  As the primary agency enforcing the CSA, the Drug Enforcement Administration (“DEA”) previously designated nine chemicals used in the illicit manufacture of fentanyl or its analogues as List I or List II chemicals.  To further address the fentanyl crisis, DEA has issued a final rule designating 4-piperidone a List I chemical after concluding that “the vast majority of, if not all” of that chemical is being used in the illicit manufacture of fentanyl.  Designation of 4-Piperidone as a List I Chemical, 88 Fed. Reg. 21,902, 21,907, 21,909 (to be codified at 21 C.F.R. § 1310.02(a)(38) (Apr. 12, 2023).

    The List I designation includes 4-piperidone’s acetals, amides, carbamates, salts and salts of its acetals, amides, and carbamates, and any combination thereof as a List I chemical.  Id. at 21,909 (to be codified at 21 C.F.R. § 1310.12(c)).

    The designation subjects 4-piperidone (also called “piperidin-4-one”) manufacturers, distributors, importers, and exporters to DEA registration, recordkeeping and reporting, importation/exportation, and security requirements.  DEA did not establish a threshold for 4-piperidone, so all domestic and international transactions including all chemical mixtures, are regulated transactions.  DEA has assigned chemical code 8330 to 4-piperidone.  Id.

    DEA is aware of at least 38 domestic suppliers and 19 foreign suppliers of 4-piperidone and those entities must obtain an agency registration unless exempt, or cease handling the chemical.  Id. at 21,904.  The final rule becomes effective May 12th, and DEA is allowing “continued legitimate commerce” in 4-piperidone by temporarily exempting handlers from required registration as long as it “receives a properly completed application for registration or application for exemption of a chemical mixture” on or before that date.  Id. at 21,906 (to be codified at 21 C.F.R. § 1310.09(s)(1)).


    The final rule is attached here.

    The FTC Asserts Its Penalty Offense Authority (Again)

    On April 13, the Federal Trade Commission (“FTC” or “Commission”) issued a press release that it had sent letters to “almost 700 marketing companies that they could face civil penalties if they can’t back up their product claims.” FTC indicates that the notices were sent to companies involved in the marketing of OTC drugs, homeopathic products, dietary supplements, or functional foods. The press release included a link to the list of the recipients.

    Interestingly, FTC notes that a recipient’s inclusion on the list does not in any way suggest that it has engaged in deceptive or unfair conduct. According to the press release, FTC sent the notices to companies that it believes are making or likely to make health-related product claims.  So what is the purpose of this notice you may ask?

    As readers of our blog may recall, this is not the first time that FTC issued notices of penalty offenses to a seemingly random sample of the industry.  As we reported in October 2021, FTC apparently resurrected its penalty offense authority as an enforcement tool after the Supreme Court decided that the FTC is not allowed to seek penalties against alleged wrongdoers under section 13(b) of the FTC Act.

    In the letter sent out last week, FTC asserts that: “Receipt of a notice of penalty offenses puts your company on notice that engaging in conduct described therein could subject the company to civil penalties of up to $50,120 per violation. See 15 U.S.C. § 45(m)(1)(B)” (emphasis in original).

    FTC seems to be overstating the effect of the notices.  Under the plain text of the statute, FTC only has authority to pursue such penalties against a person with “knowledge” either “actual knowledge or knowledge fairly implied on the basis of objective circumstances that such act is unfair or deceptive and is prohibited by such rule.”  FTC must prove that the defendant committed the same conduct and did so with actual knowledge that the conduct was unfair or deceptive.

    The letter refers to two Notices of Penalty Offenses, one regarding endorsements and the other regarding claim substantiation.  The notice of penalty offence regarding endorsements is identical to and relies on the same cases as the notice from 2021.  The notice of penalty offense regarding substantiation is new.  The FTC’s webpage for Penalty Offenses Concerning Substantiation lists cases dated between 1974 and 2017 on which the FTC relies for its notice regarding product claims substantiation, but provides no explanation whatsoever for how those earlier cases relate in any way to the hundreds of companies who received the 2023 letters

    The letter appears to be a general statement of FTC’s interpretation of law, as it lacks any factual information that clarifies what conduct FTC would consider to be  violative.  It seems doubtful that these notices are adequate to allow FTC to impose civil penalties.  On her last day as a Commissioner, now former Commissioner Wilson seemed to agree with us in her dissenting opinion.  It remains to be seen how heavily FTC will lean on these notices in any upcoming actions.

    To our knowledge the Commission has not relied on the 2021 notices in any public enforcement action or publicly announced settlement.  While the Commission did settle cases in 2022 against Walmart and Kohl’s, those settlements were not based on 2021 notices.

    That said, the notices are a good reminder of a company’s obligations regarding truthful and non-misleading advertising.

    Bring Out Your Meds! Bring Out Your Meds!

    Eric Idle, as a body collector, immortalized the phrase, “Bring out your dead,” in the 1975 comedy classic, Monty Python and the Holy Grail.  The Drug Enforcement Administration (“DEA”) could voice a modern variation, “Bring out your meds,” as the agency and its law enforcement partners host local drop-off locations nationwide for safe disposal of unneeded medication on Saturday, April 22, 2023, from 10:00 a.m. to 2:00 p.m. local time.

    Stockpiles of old, unwanted and expired controlled prescription medication in medicine cabinets are susceptible to theft, misuse and abuse.

    DEA hosts National Prescription Drug Take Back Days each spring and autumn.  DEA’s Take Back Day last October collected almost 650,000 pounds of unneeded medication at about 5,000 collection sites.  DEA’s bi-annual Take Back Days have collected nearly 17 million pounds of medication since 2010.  More information about DEA’s National Prescription Drug Take Back Day, including disposal locations, can be found at: https://www.deadiversion.usdoj.gov/drug_disposal/takeback/index.html.  That DEA website also lists permanent, year-round disposal locations.

    So, bring out your meds!  Bring out your meds!