By Allyson B. Mullen –

On January 26, FDA issued the draft guidance “Design Considerations and Pre-market Submission Recommendations for Interoperable Medical Devices.” A copy of the draft guidance can be found here. The draft guidance addresses design and premarket issues related to the interoperability of devices, which it defines as the “ability of two or more products, technologies or systems to exchange information and to use the information that has been exchanged.”  Exchange of information is defined as the “transmission, reception or both, that may be accomplished by means of wired or wireless methods that may exist on a local network, or through the internet.”  The guidance indicates that it is addressing more than unidirectional sending of patient data, and includes complex interactions including control of medical devices.

FDA states that in order to ensure the safe performance of the interoperable devices, the manufacturers must establish appropriate functional, performance, and interface requirements. Failure to do so may lead to device malfunction, patient injury, and possibly death according to the draft guidance, which gives as an example the transmission of patient weight in kilograms when the receiving device assumes the weight is in pounds. 

The draft guidance includes three major topic areas: (1) design considerations for interoperable devices, including testing and risk management of interoperable devices; (2) content of premarket submissions for interoperable devices; and (3) labeling considerations for interoperable devices.

Design Considerations.  The draft guidance provides recommendations to be incorporated during the design and development of interoperable devices, including identifying the purpose of the electronic data interface and anticipated users, performing appropriate risk management and verification and validation testing, and adequately labeling of the device. As part of the risk management activities, the draft guidance suggests that manufacturers consider data security, including cybersecurity of interoperable devices.  FDA recently issued a draft guidance on postmarket considerations for device cybersecurity.  Our blog post on this draft guidance can be found here. 

The draft guidance recommends that manufacturers perform testing that appropriately demonstrates the electronic data interface and exchange interactions perform as intended both on the device itself and when incorporated into the intended interoperable system. It provides several examples of tests to consider. 

Content of Premarket Submissions.  The draft guidance also provides suggested premarket submission content that is specific to interoperable devices and goes beyond the standard content described in other FDA guidance documents (e.g., the 510(k) RTA Checklist). The recommended content includes specific device description information, including the purpose of the interface and technical details of the data exchange.  A risk analysis is also recommended.  Risk analyses, although generally prepared during device design and development, are not typically provided in premarket submissions. 

The draft guidance also provides specific suggestions for the verification and validation section of premarket submissions. In addition to test results, FDA recommends that manufacturers clearly specify the other devices with which the subject device is intended to be used.  If there is a class of devices with which the subject device is intended to be used, the submission should explain why the testing is appropriate for the entire class of devices. 

This position is consistent with FDA’s current expectations for devices that are intended to be used together (not specifically interoperable devices). We note that, while FDA leaves open the possibility of testing a device to include an entire class of devices, in our experience, FDA has been unwilling to permit references to a class of products in device labeling and has limited labeling to devices for which data has been provided showing that they work together. 

Labeling.  Finally, the draft guidance provides a detailed list of suggested labeling content for interoperable devices. The draft guidance appears to focus primarily on ensuring that the user is provided with appropriate information regarding the purpose, use, and limitations of the devices and data exchange interface.  The draft guidance recommends that manufacturers perform human factors testing to validate labeling.  While not expressly referenced in the premarket submission section of the guidance, it is likely that FDA would expect the results of human factor testing to be included in a premarket submission.

Although the draft guidance is not yet final or legally binding, it is possible that FDA reviewers may be looking at interoperability during their premarket review of device submissions. Accordingly, applicants would be well advised to be prepared to answer questions regarding interoperability of their devices sooner rather than later.

By Melisa M. Moonan –

FDA has been flooding the zone with new guidance documents. Earlier this week, FDA finalized the human factors guidance, “Applying Human Factors and Usability Engineering to Medical Devices, Guidance for Industry and Food and Drug Administration Staff” (Feb. 3, 2016). At the same time, the agency issued a complementary draft guidance, “List of Highest Priority Devices for Human Factors Review, Draft Guidance for Industry and Food and Drug Administration Staff” (Feb. 3, 2016).  

We will cover the final human factors guidance is an upcoming post. In this post, we focus on the complementary draft guidance, which is intended to help with the question of when human factors data must be included in a premarket submission. Until now, it has always been something of a mystery as to when such data are required and when they are not.

The draft guidance identifies a specific list of devices for which FDA would definitely expect human factors data:

• Ablation generators (associated with ablation systems, e.g., LPB, OAD, OAE, OCM, OCL)
• Anesthesia machines (e.g., BSZ)
• Artificial pancreas systems (e.g., OZO, OZP, OZQ)
• Auto injectors (when CDRH is lead Center; e.g., KZE, KZH, NSC )
• Automated external defibrillators (e.g., MKJ, NSA )
• Duodenoscopes (on the reprocessing; e.g., FDT) with elevator channels
• Gastroenterology-urology endoscopic ultrasound systems (on the reprocessing; e.g.,
• ODG) with elevator channels
• Hemodialysis and peritoneal dialysis systems (e.g., FKP, FKT, FKX, KDI, KPF ODX,ONW)
• Implanted infusion pumps (e.g., LKK, MDY)
• Infusion pumps (e.g., FRN, LZH, MEA, MRZ)
• Insulin delivery systems (e.g., LZG, OPP)
• Negative-pressure wound therapy (e.g., OKO, OMP) intended for use in the home
• Robotic catheter manipulation systems (e.g., DXX)
• Robotic surgery devices (e.g., NAY)
• Ventilators (e.g., CBK, NOU, ONZ)
• Ventricular assist devices (e.g., DSQ, PCK)

FDA indicates that it will expect a human factors report (as described in Appendix A of the Final Human Factors Guidance) for the listed devices unless the submission is for a modification to an approved or cleared device that does not affect usability, i.e., no change to users, use environment, user tasks, or user interface. Alternatively, a submission can provide a detailed rationale for why human factors data are unnecessary based on a risk analysis showing that the severity of potential harm from user error is not serious.

In providing the list, FDA utilized the following standard to identify the device types for which it expects submission of such human factors data: “Device types that have clear potential for serious harm resulting from use error.” FDA states that the draft list was derived by the agency from MDRs and recall information, and the list does reflect recent and historical agency concerns such as AEDs, infusion pumps, and reprocessing methods. However, there is not a detailed analysis as to how FDA applied the standard when generating the list.

Accordingly, we hope the agency will further clarify the terms “clear potential” and “serious harm” in the final guidance, particularly as they relate to established regulatory standards and definitions regarding product risk, such as those for reporting adverse events and malfunctions in the MDR regulation, 21 CFR Part 803, and for reporting recalls in the Corrections and Removals reporting regulation, 21 CFR Part 806.

Of perhaps greater concern, FDA states that additional device types may be identified in various ways, including through guidance, special controls, and classifications, as well as by individual reviewers on a case by case basis. The latter method is troubling. The welcome transparency provided by this draft guidance could be swallowed whole by case by case reviewer decisions to request human factors data for device types that are not on the list.

FDA has attempted to put guardrails around this possibility in two ways. First, the draft guidance puts the onus on manufacturers to proactively submit human factors data when their risk analysis indicates that user error (whether by failing to perform tasks, or by performing them incorrectly) could result in serious harm.

Second, the agency proposes that reviewer requests for such data could be made only if one or more of a group of factors apply. FDA lists certain factors where it states the factor also must be accompanied by a potential for serious harm resulting from use error, and other factors where it appears to presume that the potential for serious harm is inherent.

The factors where a potential for serious harm from user error must be present are:

• The submission is a PMA or a De Novo Petition
• The submission includes a change of intended users, e.g., from professional to lay use
• The device was modified or differs from the predicate in any of the following ways:

• The user interface has been modified (even if simplified)
• User tasks have been added or changed
• The severity of possible harm resulting from use error has increased
• The device will be used in a new use environment (e.g., in a home or vehicle)

The factors for which such potential for serious harm appears to be presumed are:

• The user interface was modified to satisfy a special control or recommendation (in a device-specific guidance document) related to its use. This factor makes sense if such controls and recommendations were promulgated primarily based on a potential for serious harm resulting from use error.

• The device type has been associated with recalls, adverse events, problem reports or complaints for which the cause has been attributed to use error or use error is the only explanation. This factor does not make sense unless the recalls considered are associated with a risk to health and “adverse events” means MDR reported events that have been vetted by the agency and confirmed to represent a potential device use issue. Inclusion of complaints does not make sense, as any complaint associated with use error resulting in serious harm would fall under MDR reported events. It is unclear what is meant by “problem reports,” but those too should meet the criteria for MDR reportability and be vetted by the agency to determine whether they represent a potential device use issue.  

We strongly encourage FDA to provide transparency and opportunity for comment for non-listed device types before permitting reviewer requests for human factors data on a case by case basis. Perhaps the agency could periodically propose any updates to the list under good guidance practices. At a minimum, such requests should require approval by the reviewer’s supervisor. Otherwise, there is a clear potential for surprise requests that could unfairly delay clearances and approvals.

Comments are due within 90 days from February 3rd to Docket No. FDA-2015-D-4599.

By John A. Gilbert, Jr. & Larry K. Houck –

The Government Accountability Office (“GAO”) recently released a report examining issues related to state marijuana legislation and federal monitoring of such actions. GAO, State Marijuana Legalization: DOJ Should Document Its Approach to Monitoring the Effects of Legalization, GAO-16-1 (Dec. 2015). The report evaluates the extent to which the U.S. Department of Justice (“DOJ”) is monitoring the effects of state marijuana legalization in relation to DOJ policy as promised in the marijuana enforcement guidance memorandum from Deputy Attorney General James M. Cole in August 2013 (“Cole Memo”). The report also reviews the controls that Colorado and Washington have enacted to regulate recreational marijuana and the factors affecting Drug Enforcement Administration (“DEA”) field officials’ enforcement actions in states that have legalized marijuana for medical purposes.

In summary, GAO found that federal officials reported monitoring these state initiatives through prosecution of cases threatening federal enforcement priorities, consulting with state officials about federal concerns and collaboration among DOJ components (that is, DEA, ONDCP, etc.) in sharing data on marijuana enforcement areas. However, GAO found that DOJ did not document this monitoring process and recommends that DOJ conduct such monitoring to ensure that its efforts are addressing the intended goals and to better assist DOJ in identify state systems that are not adequately protecting federal enforcement priorities and take appropriate action.

The report provides background on marijuana in general and summarizes marijuana’s current status under federal and state law. The report also identifies the federal enforcement priorities articulated in the Cole Memo and provides a chronology of state action related to actions to legalize medical marijuana and recreational use. See our blog dated November 11, 2015. GAO notes that while 24 states and the District of Columbia have legalized marijuana and 15 states have legalized cannabidiol, an active ingredient in marijuana plants, for medical purposes, and 4 states and the District of Columbia have legalized marijuana for recreational use, marijuana remains a schedule I controlled substance under the federal Controlled Substances Act (“CSA”).

1. The GAO report provides a detailed description of the Colorado and Washington regulation of recreational marijuana but does not opine on the impact or effectiveness of these regulatory systems.  

GAO reviewed the laws and regulations governing recreational marijuana in Colorado and Washington to determine how those states regulate its production, processing and sale and interviewed state regulatory officials. GAO found the Colorado and Washington recreational marijuana regulatory schemes to be quite similar. Both states require licenses for marijuana production, processing, selling and testing. Both require applicant background checks of state residency, age and criminal history to determine licensing eligibility. Both states require recreational marijuana facilities to have specific physical security measures in place to prevent theft and diversion and that licensees implement inventory systems that allow state officials to track specific plants and products through the supply chain. Licensees must submit marijuana and marijuana-infused product samples to state-approved labs for testing. The states have established labeling and packaging standards. Colorado and Washington regulations set restrictions on consumer use of recreational marijuana, limiting who can possess, how much they can possess and where they can use it. The states require licensees to grant access to regulatory authorities to inspect facilities. Regulatory violations in both states can lead to progressive discipline with escalating penalties that could include monetary fines, suspension or cancellation of a license, and criminal charges.

Despite providing a detailed summary of these regulatory requirements, GAO did not opine on the effectiveness of the Colorado and Washington recreational marijuana regulatory systems.

2. GAO finds that DOJ has not documented monitoring of state marijuana legalization as outlined in the Cole Memo.

The Cole Memo set forth DOJ’s expectation that state and local governments implement strong and effective regulatory and enforcement systems to ensure that the laws and regulations do not undermine the eight federal enforcement priorities. The memo asserted that “[i]f state enforcement efforts are not sufficiently robust to protect” threats to the federal enforcement priorities, “the federal government may seek to challenge the regulatory structure itself in addition to continuing to bring individual enforcement actions, including criminal prosecutions.” Memorandum from James M. Cole, Deputy Attorney General, Guidance Regarding Marijuana Enforcement (Aug. 29, 2013). In determining how DOJ monitors the effects of state marijuana legalization laws relative to its marijuana enforcement policy, GAO reviewed DOJ documentation related to enforcement and monitoring efforts, and interviewed DOJ and other responsible federal officials.

GAO found that DOJ monitors the effects of state marijuana legalization related to DOJ’s enforcement policy in two ways. First, DOJ continues to enforce the CSA by taking action against marijuana activity that threatens the eight federal enforcement priorities, and U.S. Attorneys in those states monitor whether the cases implicate the enforcement priorities and prosecute cases that do. Second, Office of the Deputy Attorney General (“ODAG”) officials reported that DOJ uses various sources of information to monitor the effects of marijuana legalization under state law, noting that “DOJ’s focus was on monitoring the effects that legalization has had relative to DOJ’s enforcement priorities, rather than evaluating specific requirements within states’ legalization laws or regulatory systems.” The report notes that ODAG officials did not state how they make use of information from various qualitative and quantitative sources including federal surveys on drug use, state and local research, and feedback from federal, state and local law enforcement, to monitor the effects of state marijuana legalization or how DOJ uses information to determine whether federal action is necessary to challenge a state’s regulatory system. ODAG officials reported that it had not documented their monitoring process and that they do not see a benefit in documenting how it would monitor the effects of state marijuana legalization on the Cole Memo guidance.

GAO concluded that “[d]ocumenting a plan specifying its monitoring process would provide DOJ with greater assurance that control activities – such as the ways DOJ is monitoring the effect of state marijuana legalization relative to federal enforcement priorities – are occurring as intended.” ODAG could gain institutional knowledge with respect to its monitoring plan by sharing it with officials from DOJ components who provide the data that the DOJ uses to monitor state legalization. GAO concludes that incorporating feedback from officials into its monitoring plan could assist ODAG to ensure that it is using the most appropriate data and better identify the state systems that do not effectively protect the federal enforcement priorities. 

3. DOJ’s marijuana enforcement priorities have affected DOJ and DEA marijuana enforcement efforts in states that have legalized medical marijuana.

GAO interviewed DEA and U.S. Attorney Office (“USAO”) officials in Colorado, Washington, Alaska, California, Maine and Oregon to determine the factors affecting their enforcement actions in states that have legalized marijuana for medical purposes. GAO also reviewed information in those states regarding enforcement actions, including letters sent to medical marijuana dispensaries and public case information from fiscal year 2007 through 2014, two years before DOJ’s first marijuana enforcement guidance and after the August 2013 guidance.

DEA and USAO officials reported that they continue to apply their limited resources to address the most significant threats within their jurisdictions. They sent warning letters to 1,900 owners and lien holders of medical marijuana dispensaries during fiscal years 2007 through 2013 in response to concerns about the growth of the medical marijuana industry. Officials in California, Oregon and Washington also reported conducting criminal investigations and prosecutions or civil suits with the letter campaigns. Some officials reviewed their open marijuana cases and closed cases that did not threaten the federal priorities. Moreover, a number of officials report that they now decline to consider some marijuana-growing cases for investigation and prosecution because they do not threaten the federal priorities. Officials in California, Colorado, Oregon and Washington that had sent warning letters to medical marijuana dispensaries have not sent warning letters since the Cole Memo because in part the guidance requires that they consider not the size or commercial nature of a dispensary alone, but rather whether it is implicating the enforcement priorities.

Recommendations

The GAO report recommends the Attorney General to direct ODAG to document a plan specifying DOJ’s process for monitoring the effects of marijuana legalization under state law in accordance with the Cole Memo, that identify the various data ODAG will use and its limitations, and how ODAG will use the information sources to determine whether state systems are effectively protecting the federal priorities. GAO also recommends that the Attorney General direct ODAG to use existing mechanisms to share DOJ’s monitoring plan with DOJ component officials responsible for providing information to DOJ about the effects of state legalization to ODAG, obtain their feedback and incorporate the feedback into its plan.

DOJ received a draft of the GAO report and concurred on November 13, 2015 with both recommendations. DOJ indicated that that ODAG will document a plan to identify the various data sources that assist DOJ and USAOs in making enforcement decisions that include individual criminal prosecution or civil enforcement in marijuana crimes. DOJ stated it will monitor this data and other sources of information to determine if states are protecting the federal enforcement priorities.

By Kurt R. Karst –

Those folks who have been following this blog for several years have a good sense about the depths of this blogger’s passion for the Orange Book. There’s the license plate (“ORNGBUK”), the trip to the summit of Mt. Kilimanjaro with the publication (yes, we got a few odd stares from other climbers), the new chapter in the book this blogger authors – Generic and Innovator Drugs: A Guide to FDA Approval Requirements – exploring nearly all of the Orange Book minutiae you can imagine, the various posts about Orange Book firsts and developments (here, here, and here for example), and, of course, the Hatch-Waxman/Orange Book trivia.  So it should come as no surprise that around this time each year, anticipation for FDA’s release of the annual edition of the Orange Book is at its highest.  (We’d call it a “Code Orange,” but we used that line in a another post about the Orange Book a couple of years ago – see here.)  

Why is the anticipation so high? We like perusing the Orange Book Preface each year to see what (if anything) has changed from the previous year.  Most years it’s merely a fun “where’s Waldo” type exercise (Hatch-Waxman style) looking for minor word changes or the Office of Generic Drugs’ sense of humor.  (For that sense of humor, take a look at Section 2.2 [DRUG PRODUCT ILLUSTRATION] of the Preface.  Applicants identified in the illustrations are – or were – members of FDA’s Orange Book Staff – e.g., GREENBERG PHARM; TIMOKIM LLC; JOHNSON MED; KENDRA PHARM.).  But sometimes we’ve seen new FDA policies announced in the Orange Book Preface (see our previous post here).  

The Preface to the 2016 and 36th Annual Edition of the Orange Book includes a lot of changes. Clearly, someone took a close look at the Preface to clean it up.  Many of the changes are just nips and tucks.  They start on the cover page, which now identifies the recently-established Office of Generic Drug Policy as the office housing the Orange Book Staff.  Other minor updates include corrections to grammar, word choice changes (e.g., “When the Citizen Petition is approved” to “If the citizen petition is approved”), and greater use of more contemporary terms (e.g., “authorized generic”).  

There are also a few moderate changes that have been made to the Preface. In a largely revised Section 1.12, titled “Changes to the Orange Book,” FDA reminds manufacturers that the Agency must be notified when the marketing status of a product changes.  Previously, FDA was more passive on this requirement, merely stating: “Applicant holders are requested to inform the FDA Orange Book Staff (OBS) of any changes or corrections.  Please inform the OBS when products are no longer marketed.”  In more active language, the Preface now states:

Applicants are requested to inform the FDA Orange Book staff of any changes or corrections, including any change in a product’s marketing status that would result in the product being moved to the Discontinued Drug Product List. FDA notes that 21 CFR 314.81(b)(3)(iv) requires an applicant to submit a notice to the Agency within fifteen working days of the withdrawal from sale of a drug product. 

Section 1.12 has also been updated to express FDA’s policy that the Agency does not intend to update listings with the evolution of product description conventions: 

To the extent that conventions for describing product identification information (i.e., active ingredients, dosage forms, routes of administration, product names, applicants, strengths) evolve over time, the Agency generally does not intend to revise such information for drug products already included in the List, but rather intends to apply the change prospectively to drug products added to the List.

This policy is also relayed in an addition to Section 1.2 discussed below. 

The 2015 Preface (as well as previous editions) included Section 1.3, titled “Statistical Criteria for Bioequivalence,” that went on for about two pages. That section, renamed “Further Guidance on Bioequivalence,” in the 2016 Preface is now significantly shorter, and merely states: “FDA’s regulations and guidance documents provide additional information regarding bioequivalence and bioavailability, including methodologies and statistical criteria used to establish the bioequivalence of drug products.”  In a footnote, FDA notes the revision and includes links to the Agency’s regulations and guidance documents for additional information regarding bioequivalence and bioavailability requirements.

Aside from the minor and moderate changes, there are a couple of more significant changes FDA made to the Orange Book Preface in 2016.

First, in Section 1.2, titled “Therapeutic Equivalence-Related Terms,” FDA adds the term “Strength” and a definition:

Strength. Strength refers to the amount of drug substance (active ingredient) contained in, delivered, or deliverable from a drug product.  Note that if the criteria the Agency establishes for determining and expressing the amount of drug substance in a product evolves over time, the Agency generally does not intend to revise the expressions of strength for drug products already included in the List, but rather intends to apply the criteria prospectively to drug products added to the List.

The strength of drug products in the List is generally expressed in terms of the amount of drug substance (active ingredient) in the drug product, but is sometimes expressed in terms of the amount of the active moiety. For example, certain drug products included in the List include a designation of “EQ” next to their expression of strength.  This “EQ” designation generally is used in connection with salt drug products to indicate that the strength of such drug product is being expressed in terms of the equivalent strength of the active moiety (e.g., “EQ 200MG BASE”), rather than in terms of the strength of the active ingredient.

The description of salt drug products reflects the 2013 adoption of the USP Salt Policy, which is discussed in an FDA guidance.  FDA also cleans up the description of an “AP” therapeutic equivalence rating insofar as how the strength of parenteral drug products is expressed.

The most significant change to the 2016 Orange Book Preface appears to be in Section 1.10, titled “Change of the Therapeutic Equivalence Evaluation for a Single Product.” The change concerns the assignment of therapeutic equivalence ratings to drug products approved under 505(b)(2) NDAs.  At the end of Section 1.10, FDA adds a new paragraph:

We recognize that certain drug products approved in 505(b)(2) applications may not have therapeutic equivalence codes, and that FDA may undertake therapeutic equivalence evaluations with respect to such drug products. A person seeking to have a therapeutic equivalence rating for a drug product approved in a 505(b)(2) application may petition the Agency through the citizen petition procedure (see 21 CFR 10.25(a) and CFR 10.30).

You may recall that in recent years there’s been a decent amount of controversy over the issue of therapeutic equivalence rating assignment to 505(b)(2)-approved drug products, from citizen petitions (see our previous post here), to a lawsuit against FDA that was later dropped (see our previous post here).  In addition to substitutability, the assignment of therapeutic equivalence ratings to drug products approved under 505(b)(2) NDAs has an effect on whether or not a manufacturer is subject to annual PDUFA user fees.  

Is FDA’s pronouncement that the citizen petition process may be utilized for therapeutic equivalence rating assignment purposes an indication that FDA will no longer make therapeutic equivalence rating decisions for 505(b)(2)-approved drug products on its own initiative? Or maybe it’s that FDA will not make such determinations in non-obvious and difficult cases absent a citizen petition.  (Of course, what constitutes non-obvious or difficult will differ from one person to another.)  We’ll see.  

In the past, FDA has made the calls in complicated 505(b)(2) situations. . . . sometimes leading to inconsistencies in how (or if) 505(b)(2) drug products are rated. For example, FDA rated as “BX” three strengths of SEROSTIM (NDA 020604) with respect to corresponding strengths of other Somatropin Recombinant Injection drug products notwithstanding differences in labeled indications between the drug products. In other cases, however, products one would think might have a “B” therapeutic equivalence rating are not rated at all. For example, VELETRI (epoprostenol sodium) 1.5 mg Injection (NDA 022260) is not rated to the listed drug relied on for approval, FLOLAN Flolan (epoprostenol sodium) 1.5 mg Injection (NDA 020444). VELETRI is a 505(b)(2) by virtue of a formulation with a so-called non-exception excipient – arginine – that makes the product more stable upon reconstitution and administration. The improved stability of the product led to different labeled storage conditions, and apparently to FDA’s decision not to assign a “B” rating among the two drug products, notwithstanding pharmaceutical equivalence and bioequivalence.

By Allyson B. Mullen –

On January 15, FDA issued the draft guidance “Postmarket Management of Cybersecurity in Medical Devices.”  This draft guidance is the postmarket counterpart to the draft premarket guidance that FDA released in 2013, which we previously posted on here and here. 

Without finalizing the draft premarket guidance, FDA has turned its attention to postmarket cybersecurity, likely because as the draft guidance states “cybersecurity risks to medical devices are continually evolving.” Thus, to comprehensively protect devices against cybersecurity threats, FDA believes that manufacturers must assess cybersecurity during design and development and during postmarket surveillance. 

Like the draft premarket guidance, which was picked up by the Wall Street Journal, the draft postmarket guidance was also the focus of a Wall Street Journal article just after it was released.  Two-and-a-half years after issuance of the draft premarket cybersecurity guidance, Wall Street and investors are still interested in the cybersecurity of medical devices, but what does this new guidance mean for industry?  A lot.  FDA expects manufacturers to implement a comprehensive cybersecurity program throughout the entire device life cycle (pre- and postmarket).

The draft guidance recommends that manufacturers engage in what it calls “good cyber hygiene,” performing “routine device cyber maintenance, assessing postmarket information, employing a risk-based approach to characterizing vulnerabilities, and timely implementation of necessary actions can further mitigate emerging cybersecurity risks and reduce the impact to patients.” The guidance also encourages manufacturers to comply with the voluntary NIST standard, “Framework for Improving Critical Infrastructure Cybersecurity,” and participate in an Information Sharing Analysis Organization (ISAO), such as the National Health Information Sharing & Analysis Center, with which CDRH has entered into a Memorandum of Understanding.  The draft guidance provides an appendix with additional details regarding the recommended elements of a comprehensive cybersecurity program. 

The draft guidance emphasizes that in order to effectively mitigate cybersecurity risks the manufacturer should have a risk management program that incorporates both premarket and postmarket phases. The risk management program should use a tool that is appropriate for scoring and rating cybersecurity vulnerabilities such as the “Common Vulnerability Scoring System,” and it should have a process for assessing the potential health impact (e.g., ISO 14971).  The end result should be a conclusion as to whether each cybersecurity risk is controlled (i.e., “sufficiently low (acceptable) residual risk”) or uncontrolled (i.e., “unacceptable residual risk that the device’s essential clinical performance could be compromised”).  If a risk is deemed to be uncontrolled, FDA expects that additional risk control measures will be applied.  The draft guidance provides examples of both controlled and uncontrolled risks. 

The draft guidance states “for the majority of cases, actions taken by manufacturers to address cybersecurity vulnerabilities and exploits are considered ‘cybersecurity routine updates or patches,’ for which the FDA does not require advance notification or reporting under 21 CFR part 806.” The guidance indicates that a “routine update or patch” is one that is intended to “increase device security and/or remediate vulnerabilities associated with controlled risk” and does not affect a software’s “essential clinical performance.”  Essential clinical performance is defined by the guidance as “performance that is necessary to achieve freedom from unacceptable clinical risk.”  Interestingly, FDA’s final guidance regarding distinguishing a recall from a product enhancement (which we previously posted on here) did not acknowledge that companies making routine updates or patches to address known vulnerabilities with acceptable (low) levels of risk in its software would not require reporting under Part 806.  Although the guidance speaks directly to cybersecurity vulnerabilities, we expect – or at least would like to think – this line of reasoning would also be applied to other known vulnerabilities with acceptably low levels of risk at the time of software release. 

With regard to PMA devices, changes made to mitigate cybersecurity vulnerabilities should be reported in periodic annual reports to FDA. The draft guidance provides suggested content for such reports. 

One key question left to be answered is how FDA will enforce this draft guidance. Unlike the draft premarket guidance where FDA can review a device’s cybersecurity information during 510(k) or PMA review, the postmarket guidance merely sets out recommendations for new and existing devices once they are on the market.  FDA will be left to enforce these recommendations during device facility inspections.  The draft guidance appears to imply that a failure to comply with the guidance would be violation of the Quality System Regulation (QSR).  The draft guidance states “it is essential that manufacturers implement comprehensive cybersecurity risk management programs and documentation consistent with the Quality System Regulation (21 CFR part 820), including but not limited to complaint handling (21 CFR 820.198), quality audit (21 CFR 820.22), corrective and preventive action (21 CFR 820.100), software validation and risk analysis (21 CFR 820.30(g)) and servicing (21 CFR 820.200).”  While we do not expect to see this guidance cited in any FDA Form 483 observations – or at least not in the short term – it is likely that investigators will at some point start looking for the elements described in this guidance when they inspect device manufacturer’s quality systems. 

By Alan M. Kirschenbaum, Michelle L. Butler & David C. Gibbons –

The February 1st Federal Register contains CMS’s final rule implementing changes to the Medicaid Drug Rebate Program (MDRP). The rule had been released for prepublication review on January 21. This rule, which has an effective date of April 1, 2016, will require pharmaceutical companies to make substantial changes in their MDRP policies, procedures, calculation methodologies, and systems within a very short time frame. To help our readers understand the final rule and how to implement it, HP&M today released a memorandum summarizing the rule, which is available here.

Also, in collaboration with KPMG’s government pricing leaders, HP&M will conduct a free Webinar entitled “A Practical Guide the Medicaid Rebate Final Rule” on Friday, February 19 from 1:00 to 3:00 pm EST. For information about the Webinar and how to register for it, click here.

The final rule goes a long way toward clarifying ambiguities in the Affordable Care Act amendments to the Medicaid Rebate statute and CMS’ 2012 proposed rule, and contains a number of favorable changes from the proposed rule. Among the highlights are the following (page numbers refer to our summary memorandum):

• Wholesaler sales: For the treatment of wholesaler sales in AMP, CMS has retreated from its proposal to require a so-called buildup method, and instead is permitting manufacturers to use the traditional presumed inclusion approach. (P. 3)

• Line Extensions: CMS has withdrawn its complex proposed methodology for determining line extensions of solid oral dosage form single source and innovator multiple source drugs, and is instead soliciting additional comments on this subject. A drug will not be considered a line extension of a drug marketed by another manufacturer unless there is a corporate relationship. (Pp. 20-21)

• Territories: The MDRP will be extended to the U.S. Territories beginning April 7, 2017, and sales to customers located in the Territories will be includable in AMP and best price. (P. 2)

• 5i AMP: Exclusions from AMP for 5i drugs are added to the regulation, specifically identifying government sales, bona fide service fees, and other excluded transactions. (Pp. 11-14)

• Entities conducting business as retail community pharmacies:   CMS has withdrawn its proposal to include in AMP sales to entities that “conduct business as retail community pharmacies,” such as specialty pharmacies, home infusion pharmacies, and home health care providers. (P. 5)

• Best price definition: CMS is narrowing the scope of customer categories included in best price so that it is consistent with the statutory definition. For example, sales to patients are not included in best price. (P. 14)

• 340B sales and best price: All prices to 340B covered entities are excluded from best price, not just “prices charged under the 340B program,” as proposed. (P. 15)

• “Original NDAs”: Although an “original NDA” is defined to mean an NDA as in the proposal, certain drugs approved under an NDA may be eligible for a “narrow exception” to the definition of an innovator drug, with approval from CMS. (Pp. 18-19)

• Federal Upper Limits: FULs for multiple source drugs will be calculated as 175% of the weighted average of the A-rated drugs, as proposed, except that a FUL will not be lower than the National Average Drug Acquisition Cost (NADAC) published by CMS. (P. 26)

• Actual acquisition cost: Beginning April 1, 2017, states must base their fee-for-service Medicaid ingredient cost reimbursement to pharmacies on actual acquisition cost, determined using pharmacy surveys or other reliable data. (P. 25)

By Allyson B. Mullen & Jeff N. Gibbs –

Before the multiple feet of snow that the DC area recently received, CDRH had been creating its own storm of device guidance documents. One of the most recent ones is the final guidance “Submission and Review of Sterility Information in Premarket Notification (510(k)) Submissions for Devices Labeled as Sterile,” which was released on January 21, 2016.  This guidance is the final version of the draft by the same name, which was issued in December 2008.  FDA is holding a webinar to discuss this guidance on February 11th from 2–3:30pm ET. Webinar details can be found on FDA’s website.

This guidance applies to devices that are labeled as sterile through microbial inactivation. It distinguishes established sterilization methods and those that are novel.  That is FDA has established a bifurcated universe of “established” versus “novel.”  It is unlikely, though, that all 510(k)s will neatly fall into this scheme.  This scheme is also different from the original scheme proposed by FDA in the draft guidance with more methods falling under the “established” category than the draft, which proposed a three-tier system of “traditional,” “non-traditional,” and “novel non-traditional.”

Established methods are those for which there is an FDA-recognized standard and are well-accepted, for example dry heat, EO, steam, and radiation. Established methods are also those for which there is no FDA-recognized standard, but there is “published information on development, validation, and routine control available” and/or FDA has previously reviewed and accepted the sterilization method as being acceptable (e.g., through clearance of a 510(k) for a device sterilized with such a method).  These established methods include, for example, hydrogen peroxide, ozone, and flexible bag systems.

On the other hand, novel methods are “newly developed methods for which there exists little or no published information, no history of comprehensive FDA evaluation” and no FDA-recognized consensus standard. Novel methods include, among other things, brand new sterilization methods, changes to parameters of established methods, and combinations of established sterilants which FDA has not previously reviewed or cleared.  It is worth noting that the guidance states that a method is novel if “parameters of an FDA-cleared sterilizer have been altered.”  The guidance does not address how significant the alterations must be in order to be considered novel.  As a result, on its face, it appears that any change to an FDA-cleared sterilizer’s parameters would result in a “novel” sterilization method.

The guidance indicates that FDA intends to inspect device manufacturing facilities that employ novel sterilization methods prior to clearing 510(k)s for such devices.  The draft guidance also indicated that pre-clearance inspections would be required for novel sterilization methods.  The draft guidance also stated that FDA would perform priority post-clearance inspections of device manufacturing facilities utilizing sterilization methods for which there is no FDA-recognized standard, but there is published information on its validation and FDA has previously reviewed and accepted the sterilization method as being acceptable (previously referred to as non-traditional methods, and now encompassed within the definition of “established” methods).  The statement regarding post-clearance inspections has been omitted from the final guidance, and it should be noted that it is unclear what FDA meant by a “priority” inspection in this context.  It is not to say, however, that FDA will not still consider performing such post-clearance inspections. 

With regard to pre-clearance inspections, the guidance does not indicate how FDA will ensure that such an inspection takes place within the Federal Food, Drug, and Cosmetic Act mandated 90 day review time frame for 510(k)s. Nor does the guidance indicate how FDA will handle inspectional findings that result from such pre-clearance inspections, what effect those findings will have on a pending 510(k) or its review timing, or what the inspectional criteria will be.  Historically, FDA has not considered QSR compliance as part of making a substantial equivalence determination, and its ability to use QSR compliance in making an initial classification decision is limited by statute.  FDC Act § 513(f)(5).

Moreover, the guidance creates a new standard for sterilization information required in 510(k)s, and although the guidance is nonbinding, failure to comply will likely result in a finding of not substantially equivalent. For devices sterilized by established methods, the guidance indicates that the sterilization information from the current 510(k) Refuse to Accept policy (a copy of the current requirements for sterile devices is at the end of this post) and the CDRH premarket coversheet (i.e., the sterilization facility) should be submitted in a 510(k) plus the following information:

• A description of the sterilization chamber (e.g., rigid or fixed);
• If the sterilization method is not the subject of an FDA-recognized consensus standard, but the sterilizer or sterilization method has been cleared by FDA:
  • the 510(k) number,
  • the make and model of the sterilizer, and
  • whether the proposed sterilization cycle is identical to a cleared cycle or has been altered (note: if it has been altered then it would be considered a novel method under the guidance);
• If the method has not been previously cleared by FDA, but there is “published information on development, validation, and routine control available” it should be stated;
• The radiation dose, if the device is sterilized by radiation;
• If the sterilization method is not the subject of an FDA-recognized consensus standard, “a comprehensive description of the process and the complete validation protocol;” and
• A description of not only the packaging, but also how it will “maintain the device’s sterility, and a description of the package test methods, but not package test data.”

For novel methods, the above information must be provided along with the following additional information:

• “A comprehensive description of the sterilization process;
• The method used to validate the sterilization cycle (e.g., the half-cycle method);
• The validation protocol; and
• The sterilization validation data. The submission should also identify any applicable published scientific literature.” Note: the requirement to provide the sterilization validation data is in direct contradiction of the current version of the 510(k) RTA, which expressly states that “the sterilization validation report is not required.” We think it would be too cute for FDA to say that asking for the data rather than the report was not a contradiction.

The guidance also provides additional information regarding the information needed to support a “non-pyrogenic” claim and the types of devices for which pyrogenicity data should be provided. These sterilization and pyrogenicity requirements have been modified in the final guidance compared to the draft guidance. 

The draft guidance also set out detailed steps for how the reviewers should route sterilization information during a 510(k) reviewing, including, requesting inspections and involving the Infection Control Devices Branch (ICDB) in its review of novel sterilization methods. This detailed routing information and references to the ICDB’s involvement have all been omitted from the final guidance.  It is possible that the review team will follow the draft process internally, and it was simply omitted from the public-facing final guidance.

Although the guidance is neither binding nor set out in the 510(k) RTA, we expect that FDA will begin enforcing these requirements sooner rather than later, even if not officially. As a result, manufacturers will want to ensure that they are familiar with these new sterilization requirements prior to submitting a 510(k) to FDA.

By John R. Fleder & Mark I. Schwartz –

We all know that under the so-called “Park Doctrine”, corporate executives can be criminally prosecuted under the FDC Act for violations of that Act even absent any showing that the executives acted with any wrongful intent.  A prosecution is possible when violations are committed by an employer even though the executive did not directly participate in the alleged unlawful conduct and did not even know the conduct was occurring.  At least since United States v. Park was decided by the United States Supreme Court in 1975, there has been substantial debate about the level of responsibility at a corporation that should subject an individual to a criminal prosecution.  The government’s position has been understated but basically consistent since this writer was in the government between 1973 and 1992:  Any person, no matter what his/her level of responsibility, is theoretically subject to criminal prosecution under 21 U.S.C. 333(a)(1) because: (1) that person directly committed a prohibited act under 21 U.S.C. 331; (2) the person “caused” a prohibited act  to have occurred or aided and abetted in such an act by his/her employer; or (3) the person was in a position of authority to prevent Section 331 violations from occurring.

On January 14, 2016, the United States Court of Appeals for the Eighth Circuit affirmed the convictions of three individuals convicted of selling misbranded synthetic drugs.  Charges had been brought under the FDC Act, the Controlled Substances Act and its Analogue Act.  The Court affirmed the FDC Act felony convictions of two of the defendants, ruling that the jury instructions given by the District Court were correct in terms of the “knowledge” element required for a conviction under 21 U.S.C. 333(a)(2).  Slip Op. at 12-13.

Two other paragraphs of the Court’s Opinion make this ruling particularly noteworthy.  The Court of Appeals affirmed the FDC Act misdemeanor convictions of Joseph Gellerman, who worked as a store clerk for the business run by one of the other two defendants.  Gellerman was sentenced to three years of probation, a $1000 fine, and 90 days of home electronic monitoring.

Mr. Gellerman did not own the business or run it, although he was the son of the owner.  Nor was he a high level executive.  Instead, he was what the Court referred to as a “store clerk.”  See Slip Op. at 13-14.  The Court ruled that the government could hold Gellerman criminally liable as a store clerk under the FDC Act because he sold misbranded drugs.  “[T]he government only had to prove beyond a reasonable doubt that Gellerman was responsible for, or aided and abetted in the commission of, delivering misbranded drugs after they had been received in interstate commerce.”  The Court further ruled that “[m]isdemeanor liability stems not from ‘corporate hierarchy,’ but from an individual’s role in the sale of misbranded drugs” [citing United States v. Park. 421 U.S. 658 (1975)].  The Court upheld his conviction because government agents had purchased misbranded drugs from him even though “Gellerman had limited responsibilities as a store clerk.”

As precedent, the government’s appellate brief cited only to a 1986 case where a low-level employee, a store clerk, was prosecuted under the FDC Act.  The brief also asserted that the language in Park holding what the government calls “responsible parties” to be liable under the FDC Act did not apply in this case because Gellerman personally sold misbranded drugs to customers.  In contrast, Gellerman’s brief argued that he lacked responsibility and authority as a clerk, he believed the products he sold were legal, and he received no prior notice that the drugs he sold were misbranded or otherwise illegal.

This case perhaps answers the question regarding who can be criminally prosecuted for personal involvement in FDC Act violations.  The answer, according to this Court, appears to be anyone!  Although the Supreme Court in Park and an earlier Supreme Court decision had noted that relying on the “good sense of prosecutors” provides some protection to defendants being unfairly targeted, that is hardly a comfort to lower level employees in an FDA-regulated world.

We do not know the reasons why Gellerman was charged and we are not opining about whether this was an appropriate use of prosecutorial discretion.  Rather, the notable (and potentially troubling) aspect of the Eighth Circuit’s Opinion is that the legal principle announced in the case appears to be that there is no legal limit on who can be prosecuted.  That is an extremely powerful tool to place in the hands of government prosecutors.

This decision presents a number of very sticky issues for corporations, outside corporate counsel, and employees of a corporation.  For instance, when the government investigates a corporation for alleged FDC Act violations, government investigators will frequently ask to speak with “lower-level” employees such as the sales force.  Can anyone now assure such an employee that he/she will not be prosecuted absent a grant of immunity?  Should company counsel represent both the corporation and lower-level company employees in a corporate criminal investigation when it is at least possible that the government may decide to prosecute low level employees for their actions?

Moreover, we have read numerous articles about the “Responsible Corporate Officer” Doctrine in the context of FDC Act prosecutions.  It appears that this Court may have misunderstood Park.  The Eighth Circuit said that misdemeanor liability does not stem from “corporate hierarchy” under Park, but instead turns on an individual’s role in the violations charged.  In fact, Mr. Park’s conviction was based on his position at his company and his legal duty to prevent violations (as opposed to participating in them).  In any event, here Gellerman was prosecuted for what he did, rather than any duty imposed on him to prevent others from violating the FDC Act.

As Congress and others debate the propriety of strict liability “no mens rea” prosecutions, the Gellerman prosecution is likely to be used (perhaps improperly) as Exhibit A by people who believe that strict liability prosecutions give the government too much power.

By Melisa M. Moonan –

FDA has granted stakeholders an additional 30 days to comment on its the December 31, 2015 draft guidance “Public Notification of Emerging Postmarket Medical Device Signals ('Emerging Signals').” The new deadline for comments is March 29, 2016.   We previously commented on the significant issues raised by this draft guidance here and in relation to User Facility MDR inspections here.

FDA stated in its announcement of the extension that it was “taking this action due to the unanticipated high-level of interest from external stakeholders and the medical device community[.]”  We are baffled by FDA’s lack of anticipation of stakeholder interest. Considering the risks for manufacturers, users, and patients of  FDA publicly communicating theoretical risk information about emerging signals that have not been fully analyzed or confirmed, this high level of interest was foreseeable.

The extension appears to respond to requests for an additional 30 days to comment by two industry groups, AdvaMed and the 510(k) Coalition.  The grounds are unsurprising to us, and accord with the concerns we noted in our blogpost on the draft guidance.   AdvaMed ’s request stated that the draft guidance “represents a significant departure from the Agency’s current postmarket communication policies” and requires consideration of the potential impact across a broad range of products that have a variety of indications for use and use settings.  The 510(k) Coalition’s request similarly stated  that the draft “represents a significant change,” from current policy and process and presents “complex legal and regulatory issues and public health implications.”    

Given recent Congressional and press interest in FDA’s efficiency in communicating public health issues,  interested stakeholders should submit their comments by the new deadline.  We do anticipate that finalizing the Emerging Signals guidance will be a high-level priority for the agency.

By Kurt R. Karst –

Whether in the context of asserting First Amendment protection for a pharmaceutical manufacturer’s off-label promotion of an otherwise approved drug (see our previous post here), or challenging FDA’s denial of New Chemical Entity (“NCE”) exclusivity for VASCEPA (icosapent ethyl) Capsules (NDA 202057) (see our previous post here), Amarin Pharma, Inc. (“Amarin”) blazed new trails in food and drug law with victory after victory in court against FDA in 2015. Amarin’s litigation track record continues in 2016 with another court victory last Friday when much of the East Coast of the United States was bracing for Winter Storm Jonas (a.k.a. Snowmageddon 2016).  Although this time Amarin’s win was not against FDA, it’s another first-of-its-kind ruling, and it is of interest to the Hatch-Waxman Community. 

On January 22nd, the U.S. District Court for the District of New Jersey issued an unpublished Memorandum Opinion and Order granting Amarin’s Motion to Dismiss (without prejudice) Paragraph IV patent infringement litigation with several companies that had submitted ANDAs to FDA seeking approval to market generic versions of VASCEPA (opposition, response, and reply briefs available here, here, and here). 

According to FDA’s ANDA Paragraph IV Certifications List, the first ANDA submitted to FDA containing a Paragraph IV certification to a patent listed in the Orange Book for VASCEPA occurred on January 15, 2013. Subsequent Paragraph IV ANDAs followed.  Each ANDA, however, was submitted to FDA earlier than the not-yet-here four-year anniversary of the approval of NDA 202057 for VASCEPA (i.e., July 26, 2016).  Why is that important?  After all, the electronic Orange Book does not even identify an unexpired period of non-patent exclusivity associated with VASCEPA; and the period of “New Product” 3-year exclusivity that previously appeared in the Orange Book expired on July 26, 2015.  So what’s the hang-up?

As folks may recall (and as noted above), on May 28, 2015, the U.S. District Court for the District of Columbia issued an Opinion vacating FDA’s February 21, 2014 Exclusivity Determination that VASCEPA is not eligible for 5-year NCE exclusivity and remanded the matter to FDA for proceedings consistent with the court’s Opinion. ANDA sponsor (and suspected first applicant) Watson Laboratories Inc. (“Watson”), which was not a party to the proceedings before the district court issued its May 2015 decision, sought to intervene and appealed the district court ruling.  In October, 2015, the district court deferred resolution of Watson’s Motion to Intervene pending further action from the U.S. Court of Appeals for the District of Columbia Circuit. In December 2015, the DC Circuit dismissed Watson’s appeal for lack of jurisdiction. 

Meanwhile, FDA, in light of the district court’s May 28, 2015 decision, issued letters to ANDA applicants notifying them that review of their ANDAs was suspended, and that the status of their applications was (and still is) “submitted, but not yet received.” “If, after further review, FDA determines that Vascepa qualifies for NCE exclusivity, the exclusivity will bar an applicant from submitting an ANDA which references Vascepa until July 26, 2017 or an ANDA containing a [Paragraph IV certification] until July 26, 2016,” wrote FDA. FDA has not yet issued an exclusivity determination based on the district court’s May 2015 ruling; however, to avoid complicating matters even further, we suspect FDA will issue a ruling in the coming months, and almost certainly before July 26, 2016, which is the so-called NCE-1 date if 5-year exclusivity is granted. If FDA denies NCE exclusivity a second time, then we suspect Amarin will challenge that decision as unlawful.

Moving back to last week’s dismissal of ANDA Paragraph IV litigation, the New Jersey District Court relied on previous case law concerning so-called “premature” Paragraph IV certification notice. In those cases (see our previous post here), and in SB Pharmco P.R., Inc. v. Mutual Pharm. Co, Inc., 552 F. Supp. 2d 500 (E.D. Pa. 2008), in particular, the court found that notice sent prior to FDA’s acceptance (i.e., receipt, or filing) of an original ANDA is considered premature and ineffective.  Citing and quoting SB Pharmco P.R., the New Jersey District Court reasoned as follows:

The current procedural posture of the Consolidated [Patent Infringement] Actions demonstrates the “important distinction between physically-received ANDAs . . . and officially-received ANDAs.” SB Pharmco P.R., 552 F.Supp.2d at 506.  Therefore, “the FDA’s role in accepting an ANDA for review, so that it is received and not merely delivered, acts as a safeguard” against premature litigation. Id. at 508 (emphasis in original).  Therefore, this Court must grant [Amarin’s] Motion to Dismiss because [this Court] lacks the authority to adjudicate the Consolidated Actions for want of an ANDA having been deemed as “received” by the FDA. Id. at 511. . . .

The court granted Amarin’s Motion to Dismiss despite arguments from ANDA sponsors that FDA’s suspension action was premature and improper because the Agency has not made a final exclusivity determination with respect to VASCEPA. Moreover, wrote several ANDA applicants:

It would lead to unnecessary litigation and a waste of judicial resources if the Court were to dismiss the case now, while the action is stayed, and before the FDA has an opportunity to rule on Vascepa’s NCE status. Accordingly, the Court should deny Plaintiffs’ Motion, or at minimum, stay the action and defer its decision until after a final determination on Vascepa’s NCE status . . . .

So where do we go from here? Absent an appeal by the ANDA sponsors, everyone is waiting for FDA to act.  A grant or denial of NCE exclusivity will almost certainly spawn more litigation . . . not only over the merits of FDA’s exclusivity decision, but what the exclusivity decision means for companies that previously submitted ANDAs (and in light of the New Jersey District Court’s January 22nd dismissal). 

By Riëtte van Laack & John R. Fleder –

In hockey parlance, a player gets a “hat trick” when the player scores three goals in one game. In the FDA enforcement world, a “hat trick” – and perhaps a “Gordie Howe hat trick” – would be the use of FDA’s three traditional enforcement mechanisms in one matter: a criminal prosecution, an injunction action and a civil seizure.  In a case announced late last week, we saw the government come very close to scoring a hat trick with regard to cheese products that were connected to a Listeria outbreak in 2014.

FDA and the Department of Justice (DOJ) have an arsenal of methods for dealing with alleged violations of the Federal Food, Drug, and Cosmetic Act (FDC Act). The government typically uses one of those remedies against a company. Although, in the past, it has on numerous occasions used multiple enforcement methods against the same company, as far as we can recall, it has never used three remedies against the same company in the same matter. While the East Coast was getting ready for a historical snowstorm, DOJ did just that. On January 22, 2016, it filed a civil Complaint and proposed Consent Decree for Permanent Injunction. It also filed a separate criminal Information, which includes as part of the remedy sought “forfeiture” (which is akin to a civil seizure action) of adulterated food products. Seeking a forfeiture of allegedly violative products regulated by FDA in a criminal case is highly unusual but not unprecedented.

The government announced a guilty plea involving the company, Roos Foods, Inc. (Roos) to the Information and the other actions taken by the government.

The civil Complaint, criminal Information, and previous announcements by FDA suggest that Roos had a history of non-compliance issues. Allegedly, Roos manufactured and distributed several varieties of ready-to-eat cheese, including ricotta, queso fresco and fresh cheese curd and sold and distributed its products to wholesale customers in Maryland, New Jersey, Virginia and Washington D.C. In 2014, investigations by FDA (together with CDC and state authorities) linked Roos cheese products, contaminated with Listeria monocytogenes (L.m.), to a multi-state outbreak of listeriosis. Allegedly, a subsequent inspection of the facility revealed numerous deficiencies in good manufacturing practice and the presence of Listeria monocytogenes in various environmental samples.

Roos issued a recall and, in March 2014, FDA suspended the facility’s registration. Facility suspension is a relatively new enforcement power which gives FDA the authority to suspend the registration of a facility when FDA determines that a food manufactured, processed, packed, received, or held by a facility has “a reasonable probability of causing serious adverse health consequences or death to humans,” and “the facility created, caused, or was otherwise responsible for such reasonable probability.” Because a food facility registration is required for the legal manufacture of food for consumption in the United States, the suspension of the facility registration effectively put the company out of business for the duration of the suspension.

It is not clear what, if anything, happened since March 2014. According to the civil Complaint, the government believes that the permanent injunction is required because without it, Roos will continue to violate the law. Although, the facility suspension should prevent any further violations by the facility, the proposed Permanent Injunction is broader as it includes the owners.

According to both the Complaint and the Information, the 2014 inspection was not the first time that FDA identified violations of GMP and sanitation requirements involving Roos. According to those documents, FDA inspections in 2010 and 2013 revealed similar violations. Both times, “FDA investigators issued a Report of Investigational Observations . . . and discussed . . . the observations with” Roos management. According to the civil Complaint, Roos did not respond in writing to the Form 483s FDA issued in 2010 and 2013. Yet, as far as we know, FDA did not take any further action until 2014.

One wonders why the agency did not take earlier enforcement action as a result of 2010 and 2013 violative inspections. In fact, the Complaint alleges that FDA’s observations in the 2010 and 2013 inspections were, in some instances, the same as or similar to the observations made by FDA in its February-March 2014 inspection.

As mentioned above, as far as we can recall, the government has never before filed criminal and civil charges against a company and also sought the forfeiture of violative products against a company.

It is also noteworthy that the civil Complaint alleges that Roos Foods and the individual owners violated the FDC Act by, among other things, introducing or delivering for introduction into interstate commerce articles of food that were adulterated in that the food was prepared, packed or held under insanitary conditions whereby it may have become contaminated with filth or rendered injurious to health.  The criminal Information, however, is directed only at the company. Does this mean that the government worked out a deal where no individuals would be criminally prosecuted? Or, does it mean that the government is still investigating to determine if it should file criminal charges, presumably against the individual defendants in the civil case? We cannot determine the answer to these questions because the Plea Agreement between the company and the government is not yet public.

By Ricardo Carvajal – 

It’s getting hard to turn around without bumping into a Food Safety Modernization Act (FSMA) consultant.  Perhaps it was inevitable, given the compliance dates that suddenly don’t seem so far away, the law’s many moving parts, and the mantra that FSMA is the most sweeping reform of the nation’s food safety laws in the last 70 years.  The temptation to turn the reins over to someone claiming to have all the answers is understandable, but here are some reasons to question that strategy.

• No one has all the answers.  Yes, four of the major regulations have already published, but they are accompanied by hundreds of pages of preambles that need to be digested, and there are guidance documents under development at FDA that will help flesh out the regulations.

• The law is here to stay.  As a long term strategy, query whether it might be more beneficial to start investing in developing your internal expertise up front.

• No one is likely to understand your facility, products, and processes as well as you.  Someone who doesn’t appreciate that could try to saddle you with answers that are appropriate in a different context, but aren’t in yours.

• Self-proclaimed experts are under significant pressure to give substantive answers, and will find it uncomfortable to answer a question with the phrase “I don’t know.”  This can lead to answers that, upon further investigation, turn out to be wrong.  Wrong answers can lead to wasted resources, or worse.

• There is no training or certification system for FSMA consultants.  This means that there is little to stop an individual or entity from claiming expertise that they might or might not have – but would be happy to acquire at your expense. 

This is not to say that seeking external help to ensure readiness with the law or even ongoing compliance with its requirements is a bad idea.  Indeed, the regulation on preventive controls for human food recognizes that a “qualified individual” or a “preventive controls qualified individual” can be a third party, and there might be perfectly good reasons to outsource those or other functions.  Just beware how loosely you hold the reins, or you could find yourself meandering the long – and potentially expensive – way home.

By Alan M. Kirschenbaum –

Just ahead of a predicted snow storm in the Baltimore-Washington area, CMS yesterday issued a blizzard of 658 pages constituting its final regulation implementing changes to the Medicaid Drug Rebate Program. Although this is a final rule, CMS will be accepting comments on certain provisions relating to the alternative rebate for line extension drugs.

Hyman, Phelps & McNamara, P.C. will be preparing a memo summarizing the rule in the near future. We’ll also be conducting a webinar on the rule in collaboration with KPMG’s government pricing group.  The date and other details will be announced on this blog over the next few days.

By Ricardo Carvajal - 

On January 4, FDA denied the Weston A. Price Foundation’s citizen petition seeking revocation of the health claim for soy protein and coronary heart disease (CHD).  As reported in a prior blog posting, the Foundation filed the citizen petition in 2008, and sued the agency in 2014 to compel a response. 

By way of background, FDA authorized the challenged health claim in October 1999, having concluded that it met the standard of significant scientific agreement.  In December 2007, FDA initiated a reevaluation of the challenged claim in response to the emergence of new scientific evidence.  In reevaluating a health claim, FDA engages in as exhaustive a review as it does in the claim’s approval, by poring over the “totality of publicly available scientific evidence.”  Thus, the claim was already under scrutiny when the Foundation filed its petition seeking revocation of the claim.

FDA denied the Foundation’s petition because it “fails to reflect the totality of scientific evidence that was publicly available at the time of the petition… and is insufficient to support the conclusion that the SSA standard has not been met.”  FDA reviewed the studies cited in the petition and winnowed out those of no relevance, which left only six studies “of moderate quality” that “did not show a benefit for intake of soy protein and risk reduction of CHD.”  However, the petition failed to address the significant number of intervention studies that do show a reduced risk of CHD – a critical deficiency given the obligation in FDA’s citizen petition regulation to include “all relevant information and views on which the petitioner relies, as well as representative information known to the petitioner which is unfavorable to the petitioner's position.”

Although FDA’s response should bring the related litigation to a close, it doesn’t mean that the health claim is entirely in the clear.  FDA intends to complete its review, after which FDA will decide “whether there may be grounds to initiate the rulemaking process for amending or revoking the health claim.”

By Riëtte van Laack –

On January 15, 2016, the National Organic Program of USDA's Agricultural Marketing Service (NOP) announced the availability of guidance on substances that may be used in the post-harvest handling of organic products and in facility pest management.

Under the Organic Food Production Act (OFPA), the NOP of the USDA is authorized to establish the National List of Allowed and Prohibited Substances (National List). The National List identifies the synthetic substances that may be used and the nonsynthetic (natural) substances that may not be used in organic crop and livestock production. It also identifies a limited number of non-organic substances (natural as well as synthetic) that may be used in or on processed organic products. The National List is spread over several regulations identifying the allowed and prohibited substances for crop production (7 C.F.R. §§ 205.601; 205.602); livestock production (7 C.F.R. § 205.603; 205.604); and in (or on) processed food products (7 C.F.R. §§ 205.605, 205.606). However, no regulation addresses use in post-harvest handling, i.e., “the act of handling raw agricultural commodities without further processing” (e.g., washing, cleaning, sorting, packing, cooling, storing of raw agricultural products).

Post-harvest handling of raw agricultural products can take place either on a farm or in a handling facility. It was unclear whether substances allowed in handling (listed in section 205.605) could be used in post-harvest handling on the farm, and if nonsynthetics allowed in crop products could be used in post-harvest handling taking place in a handling facility. NOP developed the guidance to resolve this confusion.

Under the NOP guidance, substances that may be used post-harvest on raw agricultural commodities include substances allowed for use in handling in § 205.605 of the National List, without specific use restrictions that would prevent such post-harvest use, and nonsynthetic substances allowed for use in crop production (without restriction in § 205.602 that would prevent such use). Synthetic substances listed in § 205.601 may only be used if they are specifically annotated to permit post-harvest use.

The organic regulations specify what substances may be used in facility pest management. If management practices fail, a nonsynthetic or synthetic substance “consistent with the National List” may be applied. NOP interprets this to mean that “nonsynthetic substances and synthetic substances” identified in the National List as permitted substances “may be used for facility pest management in accordance with any restrictions” and prohibitions. If a substance is listed as permitted in livestock production but prohibited for use in crop production, the use is not consistent with the National List. If all else fails, substances that are not on the National List may be used “provided that there is no contact with organic products or ingredients” and meet certain other requirements.

Appendices to the guidance include a number of examples illustrating the application of the scheme described in the guidance. In addition, NOP published its responses to comments.