It is well known that digital health technologies have the potential to generate and record a large amount of data, and have the potential to greatly increase the efficiency and effectiveness of healthcare systems. However, how such data is collected, and how it might be used to support regulatory filings for products, continues to evolve, and in the past, the public and regulators have been sceptical about the quality and security of the data. The guidance and procedures that set out a framework for collection and use of RWE are either not in place in the EU, or not fully understood by all the players that take part in a product’s development. Understanding these rules will be important to ensure the value of any RWE collected, and ultimately, the success of any product that seeks to rely on it.
Regulatory issues
Regulatory and clinical decision-making continues to focus on the use of randomised controlled trials (RCT) to evidence the safety and efficacy of a product or device, and to avoid bias being introduced into the data. In contrast, RWE is collected, by definition, without these controls being in place, and RWE often generates data that is not collected by RCTs and to answer research questions that might not have been studied. As such, RWE is increasingly seen as a complement to RCT data.
However, many regulatory authorities are still cautious about using RWE, largely because the data encompasses large data sets from a variety of sources, of uncertain quality, which leads to issues related to completeness, accuracy and consistency. There is therefore uncertainty about how and when RWE will be accepted.
There is currently no established legal framework in the EU on the collection or use of RWE in regulatory or clinical decision-making, and there is limited guidance available. However, the broad wording of the medicinal products legislation has not prevented the European Medicines Agency (EMA) from accepting data from uncontrolled trials in applications. In relation to new products, the use of RWE has been confined to a limited number of orphan products where RCTs are more difficult to conduct, although it is used more where there is an extension to an indication or claim rather than for a new product. Beyond that, the use of RWE has been largely limited to post-marketing follow-up to explore areas where there is insufficient evidence pre-market, or to support pricing and reimbursement approval. In relation to medical devices, the clinical evaluation needed to obtain a CE mark refers to data collected in clinical investigations, but also includes consideration of relevant post-marketing data, and Notified Bodies generally accept RWE to support such applications and updates to the claims made, although the weight given to such data is generally less than data generated through a clinical investigation.
Looking forward, the EMA has acknowledged that: “It is clear that the data landscape is evolving and that the regulatory system needs to evolve as well.” The regulatory authorities are continuing to develop an understanding of the strengths and limitations of RWE, and there are a number of ongoing working parties and strategies looking to develop a framework for the future. The EMA’s “DARWIN” initiative is also seeking to establish a catalogue of observational data sources for use in medicines regulation. However, as yet, there is no concrete guidance on how RWE should be collected, or when RWE will be accepted by the authorities.
From our experience, the key to using RWE to support regulatory decisions and the authorisation of products is reproducibility, i.e. being able to use RWE to demonstrate that what is seen in small data sets can be extrapolated to the wider population. How effective this is and whether RWE will be accepted will depend on how and why the data was originally collected, and how the company is seeking to use it. It will be important to demonstrate to the regulatory authorities that robust controls have been put in place, with a clear design and analysis methodology, and that the accuracy and integrity of the data has been maintained. There are also a number of ongoing consultations from the EMA and UK MHRA about collection of RWE in registries, or about generating RWE as part of clinical trials. The outcomes of these consultations will provide best practice for companies seeking to collect RWE in other settings.
Data Protection
Unless the data is irreversibly anonymised or aggregated, RWE contains patients’ personal health data. This is a “special” category of personal data and its collection and use is subject to very stringent rules under the General Data Protection Regulation (GDPR). This can cause difficulties for companies collecting RWE as if these rules are not complied with, the RWE may not be able to be used, and there is also the potential that fines may be imposed.
As a general principle, only personal data that is necessary, adequate and proportionate to the research purposes should be collected. The personal data should not be retained longer than what is needed for these purposes and the GDPR rules on security, confidentiality and patients’ rights must be complied with at all times.
An appropriate legal basis for the collection and use of patients’ personal health data needs to be identified. While patients’ consent could be an option, care should be taken to ensure that all GDPR requirements concerning the free, specific, explicit, unambiguous and informed nature of the consent are complied with. Some European data protection authorities express doubts concerning the validity of patients’ consent for the processing of personal health data for research purposes.
In addition, patients must be informed of why, how, where, when and by whom their personal health data would be used. This information must also cover data retention periods, legal basis for processing and patients’ rights granted under the GDPR.
Once collected, the patients’ personal health data, as contained in RWE, must be pseudonymised to protect the patients. While irreversible anonymisation would render the data “non-personal” and GDPR requirements would no longer apply, irreversibly anonymised RWE may be less useful or usable for research purposes or to support approval of a product.
Transfer of personal data outside the UK/EEA is also subject to strict GDPR rules, although is often a reality of companies and how products are developed. Following the Schrems II ruling of the European Court and the invalidation of the “Privacy Shield” that had previously been used by companies, transfers of personal data to countries which are not deemed to offer adequate protection of personal data (which includes the US) are under increased and constant scrutiny by the authorities. Therefore, if RWE will be made accessible/available in such countries, a valid transfer mechanism must be put in place, such as the Standard Contractual Clauses.
Article by Jackie Mulryne and Alexander Roussanov, Arnold & Porter
About the authors
Jackie Mulryne is a member of the Life Sciences practice group, and provides regulatory, policy and compliance advice to clients in the pharmaceutical, medical devices, cosmetics and foods sectors. She advises on complex UK and EU regulatory issues that arise throughout the product life cycle, including maximising regulatory protections and the overlap with IP rights, borderline classification, clinical research, authorisation, advertising and promotion, and market access strategy.
Alexander Roussanov, a former senior legal adviser in the Legal Department of the European Medicines Agency (EMA), focuses his practice on a broad range of issues related to the life-cycle of medicinal products and medical devices.