1 Boring Old Man

Drugmakers urge FDA security audit after cyber breach

Reuters

By Jim Finkle

Dec 17, 2013

The U.S. Food and Drug Administration is under pressure from the pharmaceutical industry and lawmakers to undergo an independent security audit, after hackers broke into a computer system used by healthcare companies to submit information to the agency. Drug companies fear the cyber thieves may have accessed corporate secrets that are on file with the agency, such as data about drug manufacturing, clinical trials, marketing plans and other proprietary information. While some lawmakers charge that the hackers breached the FDA’s gateway, compromising confidential business data, the agency argues that the access was limited.

The breach came to light last month when the FDA sent letters to users of an online system at the Center for Biologics Evaluation and Research. The letters said the breach was detected by the FDA on Oct. 15 and that it resulted in the theft of usernames, phone numbers, email addresses and passwords. The U.S. House of Representatives Energy and Commerce Committee launched an investigation, and last week four senior Republican members of that committee sent a letter to FDA Commissioner Margaret Hamburg asking her to immediately launch a third-party audit that would "assess and ensure the adequacy of FDA’s corrective actions" following the breach

Washington-based pharmaceutical industry trade group PhRMA said on Tuesday that it supported the committee’s request for an independent audit. "It is the legal obligation of the Food and Drug Administration to protect companies’ trade secrets and confidential commercial information," PhRMA Vice President Sascha Haverfield said in a statement. The group’s members include Amgen Inc, Daiichi Sankyo, GlaxoSmithKline, Johnson & Johnson, Merck & Co and Novartis AG. The FDA’s breach notification letter, which was published in pharmaceutical trade publications, referred to the compromised system as an "online submission system" at the Center for Biologics Evaluation and Research. That alarmed drugmakers, which provide the FDA with highly sensitive data – which would be priceless to a competitor – when they submit applications seeking approval for new drugs, biologics and medical devices.

In their letter to the FDA, the Energy and Commerce Committee members charged that the attackers had breached the "FDA’s gateway system," compromising confidential business information along with sensitive data about patients enrolled in clinical trials. FDA spokeswoman Jennifer Rodriguez said that was wrong. "The system that was attacked maintains account information for the Biologic Product Deviation Reporting System, the Electronic Blood Establishment Registration System and the Human Cell and Tissue Establishment Registration System," she said. "This system is not used to submit any applications. It is not the electronic gateway that was breached," she added. She also said that the agency was not aware of any attempts to use stolen information for "criminal or other inappropriate purposes." Rodriguez declined to comment on the requests for an outside audit or say whether the breach had affected more than the 14,000 accounts disclosed to date. Tracy Cooley, a spokeswoman for the Biotechnology Industry Organization, another healthcare industry trade group, said her organization also had concerns about the breach. "We support Congress investigating this situation," she said.

I don’t question that those two statements are likely true – that they’ve succeeded in getting the world to accept or even rule that clinical trial data are "corporate secrets" or that they have the FDA including clinical trial data as "confidential commercial information," but I’m beginning to think that it got those designations originally simply because they said that’s what it was, not because the bodies involved actually thought deeply about the question, or made some ruling. Thus far, the only ruling I know of is in the World Trade Organization agreements [see repeal the proprietary data act…, except where necessary to protect the public…, and a crushing setback…] which contains the phrase "except where necessary to protect the public."

Managing Intellectual Property Rights Over Clinical Trial Data to Promote Access and Benefit Sharing in Public Health

by Pamela Andanda

IIC – International Review of Intellectual Property and Competition Law. 2013 44[2]:140-177.

[full text on-line]

The main strategic approaches that have been identified in this paper are summarized below.

1. Researchers should ensure that they reserve the right to publish clinical research findings expeditiously when they sign clinical trial agreements and TTOs that negotiate licensing agreements with the pharmaceutical industry, on behalf of researchers, should equally be sensitized on the need to protect this right since it is an ethical obligation under paragraph 30 of the Declaration of Helsinki.
2. Regulatory authorities should exercise discretion by drawing a clear distinction between the data itself and the health and safety outcome to which the data lead. This approach should enable the regulatory authorities to exercise the freedom to register competing products based on proven health and safety outcomes if bioequivalence can be established by the applicant. This is acceptable under Article 39.3 of TRIPS.
3. Regulatory authorities should be allowed through domestic legislation to rely on published scientific information to approve competitors’ products. As was noted earlier, TRIPS is not a model law to be copied at the domestic level and due to the contested interpretations of Article 39.3, it would be useful for countries to provide clarity in their legislations, which would enable regulatory authorities more freedom in decision making.
4. Regulatory authorities should adopt the strategy, which EMA has so far used to facilitate access to full clinical research reports for independent meta-analysis for public health benefits. This calls for a shift in the current default position from confidentiality to one of disclosure. The strategy equally requires the enactment of access to information legislation to regulate the disclosure of information and clear exceptions such as those contained in the Japanese AAI.

The arguments for making the raw information in clinical trials from before the breaking of the study’s blind available for independent review are unassailable – downright Constitutional – "Life, Liberty, and the Pursuit of Happiness." If that weren’t enough, the betrayal of trust by industry in keeping this information secret is now a matter in the public record – the stuff of legend. There’s no real question about the wisdom of Data Transparency, only legalistic arguments about commerce, trade secrets, or other things much lower down on any rational hierarchy of human values.

Access to Information and the Right to Health: The Human Rights Case for Clinical Trials Transparency

by Trudo Lemmens and Candice Telfer

American Journal of Law and Medicine. 2012 38:63-112.

[downloadable pdf on-line]

While there is a considerable literature on access to essential medicines and human rights, the topic of access to reliable drug safety and effectiveness information has received little or no attention in human rights discourse. The paper argues that access to information related to clinical drug trials is a fundamental component of the right to health. This approach rejoins the claim of authors who characterize clinical drug trials as public goods. Yet, it offers also a legal and moral basis for the immediate implementation of transparency measures, regardless of more fundamental reform of drug regulation. Framing access to clinical trials data as a component of the right to health offers strong support against the argument that transparency measures may violate international trade obligations related to data secrecy and provides a basis for claiming that states have a duty to implement such measures.

The paper first provides a detailed overview of the historical development of clinical trials and results reporting registries. It then analyzes the arguments invoked against mandatory trial registration and results reporting, zooming in on claims based on data secrecy obligations under TRIPS and TRIPS Plus agreements. The paper explores why registries can generally be justified under public interest exceptions in international trade agreements and how the existence of data exclusivity regimes already provides protection against ‘unfair commercial use’ of clinical trials data.

In the final section of the paper, the implementation of clinical trial and results reporting registries is situated in the context of the right to health. This not only promotes individual empowerment in requesting access to relevant health information, but also suggests that states have a duty to develop reliable and publicly accountable information systems. Such systems should enable independent medical research groups and civil society in general to contribute meaningfully to publicly accountable medical research and health product development.

---

VII. CONCLUSION

We believe that approaching clinical trials registration and results reporting from the perspective of the right to information as a component of the right to health provides significant advantages. It gives advocacy groups, the research community, national governments, and international organizations not only a strong moral but also a legal foundation to reduce the limits imposed on access to clinical trials data by international trade obligations and related national rules. It should enable advocacy groups and health policymakers to argue for the national implementation of mandatory trial registration and results reporting, and should stimulate international organizations such as the WHO and the PAHO to continue with the development of a coherent international system of research transparency. It should also inspire civil society to develop further tools to ensure the transparency and the reliability of medical research. Civil society and, particularly, independent organizations committed to promoting reliable and accountable evidence-informed healthcare systems play a crucial role in this context. Considering the serious problems associated with the design, conduct, reporting of industry-controlled clinical research, and the limits of regulatory control, immediate steps have to be taken to safeguard the reliability of this crucial component of evidence-informed healthcare decision-making. Clinical trials registration and results reporting, we have argued, are crucial pillars of health information governance. A meaningful realization of the right to health is only possible if healthcare decisions, both at the individual and at the systems level, are built on well-governed and publicly accountable health information systems.