US FDA Enforcement in 2018 Reading the Tea Leaves

Transcription

1 US FDA Enforcement in 2018 Reading the Tea Leaves John Avellanet Cerulean Associates LLC Medmarc Insurance Group January 2018 Agenda NIPP and MDSAP quick review of 2017 implications for 2018 This is not legal advice. Information in this presentation draws upon a variety of sources, including published warning letters, personal experiences, interviews and research, all or any of which may or may not have been prepared or conducted by Cerulean Associates LLC. Cerulean Associates LLC does not provide a warranty concerning the accuracy of the information contained in this presentation. The contents of this presentation are intended for general information only and should not be construed as legal advice. Cerulean Associates LLC assumes no liability for actions taken or not taken as a result of the information in this presentation. This presentation is copyrighted 2018 by Cerulean Associates LLC, all rights reserved Cerulean Associates LLC 2 Cerulean Associates LLC 1

2 Presentation Objectives 1. Understand how FDA s 2017 activities are continuing into Learn the new role FDA expects to see for data integrity when inspecting Medical Device firms 3. Recognize business implications of FDA s anticipated 2018 enforcement priorities 4. Identify the real-world implications of FDA s 2018 enforcement focus points to your quality system and other controls 5. Improve your business and regulatory plans to align (or better prepare for) FDA initiatives in 2018 and beyond 2018 Cerulean Associates LLC 3 About Your Presenter John Avellanet john@ceruleanllc.com John Avellanet gives practical, real-world compliance solutions and streamlines quality systems for clients around the world. Winner of the 2009 & 2011 Best of Business Services award by the Small Business Commerce Association, Mr. Avellanet has earned international acclaim for his business-savvy, pragmatic advice Trainer for FDA and Health Canada inspectors and district officers on advanced data integrity inspection techniques and detecting data fraud in clinical, laboratory, and manufacturing operations. Mr. Avellanet served on behalf of the US Department of Justice as the independent overseer for the five-year, multi-million dollar Dr. Comfort Corporate Integrity Agreement Industry reviewer for the international standard, BS Evidential Weight and Legal Admissibility of Electronic Information (2015) Lead expert for the ISPE GAMP Data Integrity Working Group Author of Get to Market Now! Turn FDA Compliance into a Competitive Edge in the Era of Personalized Medicine (2010); co-author of Pharmaceutical Regulatory Inspections (2014) Prior to founding Cerulean, John spent more than 15 years designing, implementing, and being accountable for quality systems and data compliance programs for FDA, DEA, BIS, ICH, IMDRF, and ISO 2018 Cerulean Associates LLC 4 Cerulean Associates LLC 2

3 2018 Cerulean Associates LLC 5 FDA is undergoing some its biggest changes in over 20 years and for some things, since the 1990 s - Alonza Cruse, FDA, Office of Regulatory Affairs, December Cerulean Associates LLC 6 Cerulean Associates LLC 3

4 Impacts in submission reviews and inspections (NIPP and MDSAP) 2018 Cerulean Associates LLC Cerulean Associates LLC 8 Cerulean Associates LLC 4

5 2018 Cerulean Associates LLC 9 New Inspection Methods 2018 Cerulean Associates LLC 10 Cerulean Associates LLC 5

6 New Inspection Protocol Project (NIPP) NIPP leverages 10 years worth of historical data with annual data, plus predictive analytics Uses algorithm to sort site data into inspection priorities Replaces routine inspections for: 50% PAI 50% postmarket surveillance (e.g., PV) inspections for cause will be one-offs Piloted in 2015 and lprocess/smallbusinessassistance/ucm pdf 2018 Cerulean Associates LLC 11 Medical Device Single Audit Program (MDSAP) Covers 7 different subsystems Emphasis on risk management (risk to public safety) Aligns with ISO 13485:2016 Allows harmonized global inspections: Brazil, US, Japan, Canada, EU, Australia Supplemented with specific unique national requirements for cause will be one-off, unique Piloted in 2015 and 2016 So *theoretically* should NOT be inspected more than 1x every 2 years by ANY of these regulatory bodies Cerulean Associates LLC 12 Cerulean Associates LLC 6

7 So what? 2018 Cerulean Associates LLC 13 Previously on Cerulean Associates LLC 14 Cerulean Associates LLC 7

8 QSIT and CAPA+2 Quality System Inspection Technique (QSIT) Covered 5 different subsystems Pharma investigators used a CAPA+2 approach ( CAPA+Production+1 ) Examine 10 CAPAs and 10 production records Examine 1-2 other area such as: design control changes, validation, etc. raw material controls (incoming acceptance, supplier qualification, etc.) outsourced production-related controls (control over CMO, etc.) process validation records controls (records retention, data integrity includes Part 11, etc.) distribution controls (anti-counterfeiting, etc.) postmarket surveillance (PV) and complainthandling/mdr 2018 Cerulean Associates LLC 15 Inspection War Room Setup Meeting Room A FDA investigators and firm s host firm s best response in 4-24 hours Meeting Room B FDA request firm s support staff various document requests out to firm s personnel 2018 Cerulean Associates LLC 16 Cerulean Associates LLC 8

9 During a regulatory inspection, the investigator asks for a specific record. After 24 hours, you cannot find it. Which response is best? a) Give us another 24 hours to locate the record b) The record is at another site c) We noted a discrepancy and opened a CAPA 2018 Cerulean Associates LLC 17 Inspection War Room Change Meeting Room A FDA investigators and firm s host FDA request firm s best response in 4-24 hours Firm s response in MINUTES or less ( real-time ) Meeting Room B firm s support staff various document requests out to firm s personnel 2018 Cerulean Associates LLC 18 Cerulean Associates LLC 9

10 NIPP and MDSAP Realities Team-based inspections (at least 1 Quality System/Data Integrity expert and 1 Product Specialist) Heavy reliance on live access to the firm s digital records and systems (no time for war room reviews) Long-term goal is for ALL members of the ICH and IMDRF to use these methodologies by 2020 Significantly increased likelihood of getting a FDA-483 observation (wouldn t be inspecting your site if not flagged as risk OR as part of a one-off for cause ) All FDA CPGMs, MAPPs, RPMs, Inspection Guides, etc. are being re-written (including inspection policies.) 2018 Cerulean Associates LLC 19 MDSAP v QSIT MDSAP Structure Management Oversight and Involvement Marketing Authorization and Facility Registration Measurement, Analysis and Improvement Adverse Events and Reporting Device Design and Development Production and Servicing Controls Purchasing Controls QSIT Structure Management Controls Corrective and Preventative Actions Design Controls Production and Process Controls Cerulean Associates LLC 20 Cerulean Associates LLC 10

11 MDSAP v QSIT MDSAP Structure Management Oversight and Involvement Marketing Authorization and Facility Registration Measurement, Analysis and Improvement Adverse Events and Reporting Device Design and Development Production and Servicing Controls Purchasing Controls QSIT Structure Management Controls Corrective and Preventative Actions Design Controls Production and Process Controls Cerulean Associates LLC 21 FDA Implementation Timeline For both MDSAP (devices) and NIPP (drugs) 2018 Cerulean Associates LLC 22 Cerulean Associates LLC 11

12 FDA Implementation Timeline For both MDSAP (devices) and NIPP (drugs) 2018 Cerulean Associates LLC 23 Three Hidden Implications lose touch laxity Greater 483 chance 2018 Cerulean Associates LLC 24 Cerulean Associates LLC 12

13 CDER enforcement CDRH enforcement QUICK REVIEW OF Cerulean Associates LLC 25 FDA s Enforcement Evolution High benefits to patients with little risk to public safety FDA exercises enforcement discretion Low benefits to patients with high risk to public safety FDA takes enforcement action 2018 Cerulean Associates LLC 26 Cerulean Associates LLC 13

14 Overall Summary Statistics Enforcement Action Total Count FDA-483 Observations 5,155 FDA Warning Letters 443 Recall Events 2, Cerulean Associates LLC 27 CDER Top 6 Issues (drugs) Procedures Not Fully Followed Responsibilities and procedure applicable to [quality unit] are not fully followed, not in writing, et al No Scientifically Sound Laboratory Controls Laboratory controls do not include scientifically sound and appropriate specifications, sampling plans, test procedures, et al Failure to Investigate Discrepancies There is a failure to review any unexplained discrepancy, the failure of a batch to meet any of its specifications, et al 2018 Cerulean Associates LLC 28 Cerulean Associates LLC 14

15 CDER Top 6 Issues (drugs) Absence of Written Procedures There are no written procedures designed to assure that the drug product has the identity, safety, quality, and purity expected Cross Contamination Inadequate or insufficient cleaning of equipment and utensils in manufacturing, in laboratory, et al Releasing Product that Does Not Meet Specifications Testing procedures for final product are insufficient in that they do not test whether product meets approved specifications, etc Cerulean Associates LLC 29 CDER Numbers (drugs) Regulation Issue No. of FDA- 483s 21 CFR (d) Procedures not fully followed CFR (b) No scientifically sound laboratory controls CFR Failure to investigate discrepancies CFR (a) Absence of written procedures CFR (b) Procedures for equipment cleaning not followed CFR (a) Failure to test products to spec before release CFR (b) Computer controls over data CFR (b) Failure to prevent contamination of drug product CFR (a) Calibration/inspection/maintenance not done CFR (a) Lack of a stability program Cerulean Associates LLC 30 Cerulean Associates LLC 15

16 Implications for Pharma Firms Basics Science Data Integrity Liability 2018 Cerulean Associates LLC 31 CDRH Top 6 Issues (devices) Lack of or Inadequate CAPA Procedures Procedures for corrective and preventative actions (CAPA) are not adequately followed, enforced, documented, et al Remember this for data integrity and cybersecurity. Lack of or Inadequate Complaint Handling Procedures Procedures for receiving, reviewing, and evaluating complaints by a formally designated unit are not established, followed, enforced, et al Lack of or Inadequate Purchasing Controls Procedures Procedures to ensure that all purchased or otherwise received product and services conform to requirements are not established, enforced, et al 2018 Cerulean Associates LLC 32 Cerulean Associates LLC 16

17 CDRH Top 6 Issues (devices) Lack of or Inadequate Process Validation A process whose results cannot be fully verified by inspection and testing has not been validated according to established procedures Lack of MDR Procedures Procedures for when a device error or adverse event needs to be reported to the FDA have not be written, followed, enforced, et al Remember all of these for data integrity and cybersecurity. Lack of Non-Conforming Product Procedures Procedures have not been [adequately] established to control product that does not conform to specified requirements 2018 Cerulean Associates LLC 33 CDRH Numbers (devices) Regulation Issue No. of FDA- 483s 21 CFR (a) Lack of or inadequate CAPA SOPs CFR (a) Lack of or inadequate complaint handling SOPs CFR (a) Lack of or inadequate purchasing controls SOPs CFR (a) Lack of or inadequate process validation CFR Lack of or inadequate MDR procedures CFR (a) Lack of non-conforming product procedures CFR (b) Inadequate documentation and follow-ups CFR (i) Lack of or inadequate design control procedures CFR Lack of or inadequate quality audit procedures CFR (d) Lack of or inadequate final testing procedures Cerulean Associates LLC 34 Cerulean Associates LLC 17

18 CDRH and Data Integrity September 4-8, 2017 First set of CDRH investigators receive inspecting for data integrity training in St. Louis FDA trains the device investigators to cite device firm records for Part 11 data integrity requirements under the specific FD&C citations of 21 USC 331(e)(w), and 360i(a), and under the specific predicate citations of 21 CFR (c)(d), (c), (b) search text of any regulation, law, or guidance for years or data or record that s a citation point September 12, 2017 FDA informs all CDRH investigators that they will receive data integrity inspection training over the course of the next 4-9 months 2018 Cerulean Associates LLC 35 Everything that we do is based on the integrity of the data. Data integrity is mission critical. - Doug Stearn, Director, ORA, US FDA, November Cerulean Associates LLC 36 Cerulean Associates LLC 18

19 Implications for Device Firms Audit Actions Data Integrity SOPs Supplier Oversight 2018 Cerulean Associates LLC 37 overall data integrity MDSAP and NIPP international cooperation 2018 ENFORCEMENT FORECAST 2018 Cerulean Associates LLC 38 Cerulean Associates LLC 19

20 Overall CDRH will continue training its investigators improved ability to trace safety and efficacy features and testing from design through post-market surveillance reporting and investigation (public safety risk aligned with MDSAP) how to look for data integrity issues during an inspection (e.g., is the device firm s data TRUSTWORTHY?) cybersecurity awareness design and post-market processes CDER will continue to focus on data integrity slow growing scrutiny around data controls from critical suppliers priority focus is completing rollout of NIPP by year end 2018 Cerulean Associates LLC 39 Data Integrity Expansion of CDER/CBER/CVM s 2010 data integrity special focus inspections to CDRH see FDA BIMO CPG, Attachment A: Computerized Systems ring/ucm htm Assessment of data trustworthiness controls around device and component testing, in apps, in post-market controls and non-conforming product controls Review of cybersecurity controls on any computerized medical device and/or app documentation and validation as part of design control change management as part of postmarket changes and reporting 2018 Cerulean Associates LLC 40 Cerulean Associates LLC 20

21 MDSAP and NIPP 2018 Cerulean Associates LLC 41 International Cooperation 2018 Cerulean Associates LLC 42 Cerulean Associates LLC 21

22 International Cooperation We will be updating FDA s requirements for accepting foreign clinical data used to bring new medical devices to market. While helping to ensure the quality and integrity of clinical trial data and the protection of study participants, this rule should also reduce the burden on industry because it will harmonize with the standards currently used in drug regulation. - Scott Gottlieb, M.D., US FDA Commissioner, December 14, Cerulean Associates LLC 43 Key Point Recap FDA is expanding its data integrity enforcement to devices as it rolls out modernized inspection techniques of NIPP and MDSAP FDA is strengthening its enforcement of harmonized international standards and guidelines; the agency already enforces ICH guidelines as regulations and has repeatedly stated its intention to use the IMDRF to harmonize device regulations no later than 2020 FDA s NIPP and MDSAP inspection techniques allow the agency to more easily ferret out data integrity issues such as data fraud and weak product safety controls, especially in post-market situations FDA s MDSAP and NIPP mean reduced inspection frequency with higher chances of receiving FDA-483s and a Warning Letter (e.g., FDA would not be inspecting you if they had not detected a postmarket signal OR if you had not made a submission); this will inevitably lead to an increase in product liability litigation and disgruntled shareholder litigation 2018 Cerulean Associates LLC 44 Cerulean Associates LLC 22

23 Agenda Recap NIPP and MDSAP quick review of 2017 implications for Cerulean Associates LLC 45 Request Expert Training Visit Cerulean s website to learn more about our private, tailored, highly interactive workshops held onsite at your location Sample agendas and Request form at Cerulean Associates LLC 46 Cerulean Associates LLC 23

24 About Your Presenter John Avellanet John Avellanet gives practical, real-world compliance solutions and streamlines quality systems for clients around the world. Winner of the 2009 & 2011 Best of Business Services award by the Small Business Commerce Association, Mr. Avellanet has earned international acclaim for his business-savvy, pragmatic advice Trainer for FDA and Health Canada inspectors and district officers on advanced data integrity inspection techniques and detecting data fraud in clinical, laboratory, and manufacturing operations. Mr. Avellanet served on behalf of the US Department of Justice as the independent overseer for the five-year, multi-million dollar Dr. Comfort Corporate Integrity Agreement Industry reviewer for the international standard, BS Evidential Weight and Legal Admissibility of Electronic Information (2015) Lead expert for the ISPE GAMP Data Integrity Working Group Author of Get to Market Now! Turn FDA Compliance into a Competitive Edge in the Era of Personalized Medicine (2010); co-author of Pharmaceutical Regulatory Inspections (2014) Prior to founding Cerulean, John spent more than 15 years designing, implementing, and being accountable for quality systems and data compliance programs for FDA, DEA, BIS, ICH, IMDRF, and ISO 2018 Cerulean Associates LLC 47 About Your Presenter John Avellanet john@ceruleanllc.com Recent Resume Highlights Trainer for FDA and Health Canada on advanced data integrity inspecting Industry Expert Reviewer, BS Evidential Weight and Legal Admissibility of Electronic Information Lead author of 2 certification courses for US RAPS Lead Expert, ISPE GAMP Data Integrity Working Group Independent Reviewer for DOJ-Dr. Comfort Corporate Integrity Agreement 2010 and 2011 Top 10 FDA Compliance Blog 2010 Top 50 Pharma/Biotech Blog 2009 and 2011 Best of Business Services Award Guest Lecturer at NIH 2006 Lifetime Achievement Award Who s Who of Biopharma & Device Executives FDA Lean Compliance Consulting Services Streamline SOPs and policies Simplify Part 11 and Data Integrity compliance Perform audits for compliance and cost-effectiveness Develop FDA recordkeeping and corporate retention policies Conduct private training and corporate workshops Serve as consent decree IRO and litigation support 2018 Cerulean Associates LLC 48 Cerulean Associates LLC 24

25 thank you 2018 Cerulean Associates LLC 49 Picture Credits Photos, images and clip art that appear on these slides have been used to enhance this presentation and may NOT be used for commercial or promotional purposes without permission from copyright holders. Do not remove or copy from this presentation. Contact: istockphoto.com Shutterstock Google Images Cerulean Associates LLC 2018 Cerulean Associates LLC 50 Cerulean Associates LLC 25