With the recent publication of numerous, previously unpublished complete response letters, coupled with its plans to increase these disclosures going forward, FDA has taken a significant step forward in its previously stated commitments to transparency. FDA has framed this initiative as a way to assist drug developers in learning from prior deficiencies, to ensure that the public has accurate information regarding FDA’s assessment of applications and to strengthen public trust in FDA’s decision-making. However, applicants should be aware of these changing practices, FDA’s obligations in regard to them, and proactively consider and potentially adjust current practices in reaction to this changing landscape.
The complete response letters (CRLs), which are issued to drug or biological product applicants when the FDA determines it cannot grant an approval of an application in its current form and (which we discussed previously) have been ostensibly redacted to remove trade secret and confidential commercial information (CCI). However, historically, CRLs were not publicly released, even in redacted form, unless and until the application was subsequently approved because the existence of an application, complete response letter, and/or the content of the CRL was considered sensitive commercial information, or CCI. With the administration stating that FDA is exploring ways of providing the public with greater transparency into its decision-making process, and as additional batches of complete response letters now continue to be released, this post explores the legal limitations on FDA’s ability to disclose information and actions an applicant may consider to prepare for or address any such disclosures by FDA.
The Federal Food, Drug, and Cosmetic Act (FDCA) and FDA’s disclosure regulations preclude the FDA from publicly disclosing an applicant’s confidential information consisting of trade secrets and confidential commercial information. FDA also considers the need for the agency to promote frank internal deliberations. Similar principles apply to records FDA provides in response to requests under the Freedom of Information Act (FOIA). In practice, this means that FDA can publicly disclose nonpublic records after redacting the following most common categories of information:
- Personal privacy information (PPI): FDA must redact names and other information that would identify patients or research subjects in any medical or similar report, test, study, or other research project (e.g., social security numbers, birthdates, etc.). In brief, this requirement is designed to protect the personal privacy of individuals. This protection of personal information does not extend to business or product names, nor does it apply to the names of individuals conducting investigations, studies, or tests on products or ingredients.
- Trade secrets: Not only must FDA redact trade secrets, but FDA could also face civil and monetary penalties for improper disclosure of trade secret information. FDA’s regulations (at 21 CFR 20.62(a)) define a trade secret as consisting of “any commercially valuable plan, formula, process, or device that is used for the making, preparing, compounding, or processing of trade commodities and that can be said to be the end product of either innovation or substantial effort.” The FDCA also prohibits FDA employees from revealing trade secret information outside the US Department of Health and Human Services and unauthorized or improper disclosure of trade secrets can also be a criminal violation of the Trade Secrets Act.
- CCI: FDA must also protect CCI, which, per FDA’s regulations at 21 CFR 20.62(b), includes “valuable data or information which is used in one’s business and is of a type customarily held in strict confidence or regarded as privileged and not disclosed to any member of the public by the person to whom it belongs.” This is a broad category that can apply to many types of business records, and as long as the company policy and practice is to keep the information confidential, the information would be considered CCI and must be redacted.
- Inter- or Intra-agency memos or letters: FDA may also choose to withhold internal emails and drafts of documents that are part of the agency’s internal deliberations, in particular prior to taking final agency action on a given issue. Because this category captures records created by FDA, FDA has discretion, in accordance with its regulations and policies, to disclose information that falls within this category. Typically, FDA carefully protects this information while consideration of an issue is ongoing to avoid confusing the public with information that is inconsistent with final documents and to protect and foster an open working environment. However, if and once disclosed, these records would still be redacted by FDA with respect to PPI, trade secrets, and CCI contained within them, as described above.
Importantly, the categories of protected information, above, only apply to otherwise nonpublic information. Not all information companies provide to FDA is nonpublic. Specifically, any information that a company discloses to the public is considered public information. This means that, for example, if information about the status of a drug application is provided in a public SEC filing or in a press release, this information would be considered publicly available, and FDA would not be required to redact such information in accordance with the principles listed above. And historically, when dealing with complicated records, FDA would often consult companies about its proposed redactions to ensure that the agency had properly redacted company trade secrets and CCI before publicly releasing the record.
In addition to the general disclosure principles, there are specific rules governing the disclosure of the information in a drug application. Specifically, FDA’s regulations in 21 CFR 314.430 state that FDA will not publicly disclose the existence of a new drug application or an abbreviated drug application before an approval or tentative approval letter is sent to the applicant, unless the existence of the application or abbreviated application has been otherwise publicly disclosed or acknowledged. If the existence of an unapproved application or abbreviated application has not been publicly disclosed or acknowledged, FDA’s regulations mandate that no data, not even a redacted version, is to be made public. Despite FDA’s recent disclosures of CRLs and its announced plans to disclose more CRLs going forward—and its intent to do so close in time to their issuance to applicants—FDA has not to date explained how this new practice squares with this requirement.
Implications and Recommendations for Industry
FDA’s shift toward contemporaneous disclosure of CRLs carries important consequences for applicants. First, applicants should re-evaluate disclosure practices with regard to ongoing development programs, including (as we have previously written) with investor communities and Securities and Exchange Commission obligations in mind.
Second, applicants should consider developing prospective response plans and practices in the event a CRL is issued by FDA. For example, rapid coordination with FDA regarding PPI, CCI, or other sensitive information contained or referenced in a CRL may help ensure that any disclosure of a CRL is properly redacted, as needed, by FDA.
Third, in the event that FDA’s publication of a CRL does improperly disclose an applicant’s data or information, remedies available to an applicant, in particular any real ability to undo any improper disclosure, may be limited as a practical matter.
In short, applicants must prepare for a more transparent environment where FDA’s pre-approval regulatory feedback is no longer confined to confidential correspondence. Proactive planning—across compliance, investor relations, and litigation strategy—will be critical to managing this new normal.