EMA Policy 0070: 5 ways to balance patient privacy with better data utility

Drawing on experience of helping a wide range of life sciences companies with early submissions, Pooja Phogat, regulation and compliance expert at Kinapse, provides insight on the most effective approaches that reflect the spirit of the Policy.

EMA Policy 0070 provides important guidelines and processes attached to the European Medicines Agency’s moves towards creating a public database of clinical research findings. Its higher purpose is to provide greater industry transparency, and invite broader industry collaboration, but without compromising trial participants’ privacy.

With the EU’s new General Data Protection Regulation (GDPR) now imminent, the impetus for life sciences firms to cement their data management strategies has further increased. Initiatives by other regions such as North America and Canada  around the external publication of clinical findings provide an additional driver for improving approaches to managing outward-facing information.

Want more? Behind the scenes: GDPR and data-driven innovation in the pharmaceutical industry

A shaky start

Early attempts by companies to fulfil Policy 0070 requirements have left a lot of room for improvement. A common approach to date has been to redact public-facing content: here, any clues to people’s identities are simply blocked out. Yet the value of a heavily redacted clinical study report (CSR) is questionable.

Redaction is laborious too. With other anonymisation methods, several priorities can be addressed simultaneously – the delivery of higher-value output; strong measures to protect patient privacy (information is simply hidden in plain sight); accurate risk measurement; and support for process automation. So, not surprisingly, EMA is encouraging companies to distance themselves from document redaction in favour of more sophisticated approaches to data anonymisation.

[inlinead]

A better way

Based on our work in helping life sciences companies prepare early Policy 0070-compliant submissions, Kinapse has identified the following optimal compliance approaches:

1.       Keep one eye on the bigger picture.

Policy 0070 is an evolving requirement, so the most effective strategies will be those that take into account longer term requirements - as well as what is being demanded of firms now.

Policy 0070 was first introduced in January 2015, with guidance on CSR anonymisation published in March 2016, and the first submission made public that October. Phase 2 of Policy 0070, which will require that life sciences companies provide anonymised copies of all of their clinical trial data, is coming down the line, albeit that there isn’t currently a known timeline for this next stage. It is something companies should prepare for nonetheless, as it will require a more systematic and repeatable process than most companies have in place currently.

2.       Start now.

Do not wait to start planning how to tackle document anonymisation. Once companies submit a marketing authorisation application to EMA, the guidance specifies that they should ideally take no more than 180 days to provide the equivalent anonymised content for the designated EMA portal, where anyone can look at it. Four and a half months might sound like a long time, but it isn’t really. While there are about 100 different ways we can address a company’s anonymisation needs for a given submission package, those options are reduced the closer firms are to the public submission’s deadline. The tightest timeframe Kinapse has worked to so far has been two months - although we still delivered as planned, this was far from ideal.

3.       Set expectations.

EMA Policy 0070 compliance is not something the majority of life sciences companies can easily manage themselves. The requirements are new, and expertise is in short supply. It’s also easy to underestimate the need for collaboration between different stakeholders.

Using a specialist service provider offers greater efficiency and reliability, not least through the chance to centralise activities. It is probably also the best route to accessing enabling technology and tools - including smart algorithms/machine learning, which over time produce faster and more accurate results by building on each anonymisation cycle.

Anonymisation methods geared to de-identification generally rely on IT to maintain data integrity, measure and manage risk, and provide auditable evidence of measures that have been taken. These techniques can deliver benefits starting at 60 per cent improvements in time and cost efficiency compared to non-technology enabled anonymisation processes.

Managed service providers will also keep abreast of data security as they process documents, keeping companies compliant with GDPR and other data safeguarding measures. For clinical trial sponsors, this all adds up to the lowest-risk and most efficient option for managing compliance.

4.       Don’t view redaction as the definitive solution.

Other than in exceptional cases, defaulting to redaction as a strategy is a false economy. It is not in the spirit of clinical data transparency and it adds the least value for everyone concerned. As international requirements dovetail with EMA’s ambitions, and as Policy 0070 enters its next phase, redaction’s limitations will be exposed. This will mean that any money spent on redaction processes and work now will not count, and companies will have to invest afresh in alternative anonymisation strategies.

Keep in mind that EMA has now established a dedicated anonymisation taskforce to help sponsors come up with ideal methods and techniques for maintaining data utility.

5.       Choose your compliance partner carefully.

Once companies have accepted the need for professional help, they will need to decide what kind of outsourced service is appropriate for their requirements. Some service providers offer advisory services, but not the practical operational delivery – or the other way round. Some are light on technology; others focus too much on automation, with a risk to quality control. The optimum combination is likely to be an end-to-end service.

Stick with the programme

Yes, the demands of EMA Policy 0070 are considerable. But putting off the inevitable or cutting corners is not recommended. The costs and pain will merely end up being greater. A better strategy is to retain a clear sense of purpose – that greater goal of transparency, increased public trust and accelerated clinical breakthroughs - which key stakeholders can buy into. Again, this is where a trusted partner can add value.