Does your firm manufacture a “cyber device”?  A recent amendment to the Federal Food, Drug, and Cosmetic Act (FD&C Act) added a new section about cybersecurity for “cyber devices.”  If a device uses software that connects to the internet, it is most likely a cyber device and subject to new section 524B of the FD&C Act, “Ensuring Cybersecurity of Devices.” This provision became effective as of March 29, 2023.  It will become part of the “refuse to accept” (RTA) checklist on October 1, 2023.

FDA’s New Cybersecurity Authority

Over the past years, FDA has been expanding efforts to encourage mitigation of cybersecurity threats to medical device functionality and device users, but the FDA’s recommendations with respect to the cybersecurity of medical devices were not codified into law prior to the enactment of section 524B of the FD&C Act. The primary vehicle for FDA to request cybersecurity information in premarket submissions has been guidance documents.  However, FDA’s legal standing to insist on cybersecurity features, especially within the substantial equivalence paradigm, has been questionable.  Now, with explicit statutory authority, FDA’s push for cybersecurity has a firm legal footing.

Congress has given FDA the authority to require device manufacturers to provide cybersecurity information in their premarket submissions for a “cyber device.”  Section 524B(a) states:

A person who submits an application or submission under section 510(k), 513, 515(c), 515(f), or 520(m) [i.e., 510(k), premarket approval application (PMA), Product Development Protocol (PDP), De Novo, or Humanitarian Device Exemption (HDE)] for a device that meets the definition of a cyber device under this section shall include such information as [FDA] may require to ensure that such cyber device meets the cybersecurity requirements. . . .

Definition of A Cyber Device

Section 524B(c) defines a “cyber device” as a device that—

(1) includes software validated, installed, or authorized by the sponsor as a device or in a device;

(2) has the ability to connect to the internet; and

(3) contains any such technological characteristics validated, installed, or authorized by the sponsor that could be vulnerable to cybersecurity threats.

The technological characteristics in this context may cover a wide range of device functions, for instance, monitoring features, stimulation parameters, and communications with healthcare providers.  It applies whether the software is the entire device (i.e., Software as a Medical Device, or SaMD) or the software is embedded in a traditional hardware device (i.e., Software in a Medical Device, or SiMD).

Note that section 3060(a) of the 21st Century Cures Act in 2016 amended section 520 of the FD&C Act and removed certain software functions from the statutory definition of a medical device.  Therefore, a firm should first determine whether its product meets the statutory definition of a medical device.  Of course, if a product does not meet the definition of device, it is not subject to the FD&C Act.  We have recently blogged on this topic (“Is my software a medical device?”).

The new requirements

Section 524B(b) requires sponsors to provide the following information in premarket submissions for cyber devices:

(1) submit to the Secretary a plan to monitor, identify, and address, as appropriate, in a reasonable time, postmarket cybersecurity vulnerabilities and exploits, including coordinated vulnerability disclosure and related procedures;

(2) design, develop, and maintain processes and procedures to provide a reasonable assurance that the device and related systems are cybersecure, and make available postmarket updates and patches to the device and related systems to address—

(A) on a reasonably justified regular cycle, known unacceptable vulnerabilities; and

(B) as soon as possible out of cycle, critical vulnerabilities that could cause uncontrolled risks; [and]

(3) provide to the Secretary a software bill of materials, including commercial, open-source, and off‑the‑shelf software components.

Timeline

Section 524B became effective on March 29, 2023.  Through a recent (and very short) Guidance document, FDA indicated that, starting on October 1, 2023, FDA may base “refuse to accept” (RTA) decisions on the information required by section 524B.  Until this deadline, FDA generally intends not to issue RTA decisions based solely on the information required by section 524B.  Instead, FDA “intends to work collaboratively with sponsors of such premarket submissions as part of the interactive and/or deficiency review process.” Id. at 2.

Note that FDA does not conduct an RTA acceptance review for submissions submitted via eSTAR.  As of April 17, 2023, the current eSTAR versions indicate: “A guided walk-through of Section 524B of the FD&C Act is not yet available below. It will be provided in a future eSTAR update.  Please refer to the help text in this section for the content that is required according to this statute.”  Users of eSTAR templates need to add attachments for cybersecurity risk management, cybersecurity management plan, continuing support plan, and cybersecurity labeling.  For those who are not familiar with an eSTAR, please refer to our previous posts: here, here, here, and here.

Loose Ends

IDEs.  There is still uncertainty about section 524B and how FDA is going to marry it to existing programs.  For example, what information needs to be provided in investigational device exemption (IDE) applications with respect to cybersecurity?  In the 2022 draft Guidance for Cybersecurity in Medical Devices, FDA recommends only a subset of the documentation be included in IDE applications, including (1) cybersecurity risks as part of Informed Consent Form, (2) global, multi-patient and updateability/patchability views, (3) security use case views for functionality with safety risks (e.g., implant programming), (4) software bill of materials, and (5) general labeling (connectivity and associated general cybersecurity risks, updateability/process).  Since section 524B(b) of the FD&C Act on its face does not apply to IDEs, it would seem that these recommendations are likely to remain unaltered by the new law.  It would be helpful if FDA would clarify its intentions in this regard.

Special 510(k)s.  If a firm wants to add an additional cyber feature to a currently non-cyber device that is already authorized for commercial distribution through 510(k) clearance or a De Novo classification request, the firm needs to determine if the change can be submitted as a Special 510(k).

The Special 510(k) Program Guidance provides an example of a change involving the addition of wireless control capabilities to a bilevel positive airway pressure (BiPAP) device intended to treat patients with obstructive sleep apnea.  The Guidance notes that “[v]erification and validation should be conducted to ensure that the BiPAP has acceptable wireless quality of service, coexistence, cybersecurity, and maintains EMC in its intended environment of use.”  The Guidance concludes that such a change cannot be reviewed in a Special 510(k), because “there are not well-established methods in an FDA-recognized voluntary consensus standard or in the manufacturer’s previous 510(k) that address the methods to evaluate the addition of wireless control for this BiPAP. The test methods vary depending on the wireless quality of service necessary for the device’s intended use and environment of use.”

This example suggests that the prospects are poor for adding cyber features via a Special 510(k).  However, FDA should update the Special 510(k) Program to clarify if and how the information required by section 524B could be submitted for review in a Special 510(k).

510(k) exempt.  It appears from the plain language that section 524B does not apply to 510(k)‑exempt devices.  An interesting question is whether FDA would take the position that converting a device from non‑cyber to cyber would trip such an exemption and require a 510(k) clearance.

What’s next?

Section 524B(b)(4) of the FD&C Act authorizes FDA to issue regulations with additional requirements for cyber devices.  Given FDA’s track record in issuing regulations, it will likely be many years before that happens, if it ever does.

As noted above, FDA published a draft guidance titled “Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions” just about a year ago.  Per section 3305(e) of the Omnibus, FDA must provide an updated guidance document by December 2024.  Given that it is on the A-list that FDA intends to publish during FY2023, FDA will likely publish the final guidance in a few months.  We look forward to it.

The Draft Guidance

In February 2023, CDER, CBER, and the Oncology Center of Excellence published a draft guidance titled “Considerations for the Design and Conduct of Externally Controlled Trials for Drug and Biological Products” (the “Draft Guidance”) to provide recommendations to those considering the use of externally controlled clinical trials to provide evidence of safety and effectiveness of a drug product.

An “externally controlled trial” is described in the Draft Guidance as a study in which “outcomes in participants receiving the test treatment according to a protocol are compared to outcomes in a group of people external to the trial who had not received the same treatment.”  The external control arm can be either an “historical control” (from an earlier time period) or a “concurrent control” (from the same time period but in another setting).  Because an external control can involve the use of real-world data (“RWD”), the Draft Guidance notes that this guidance is being issued to satisfy, in part, requirements from the 21st Century Cures Act on the use of real-world evidence (“RWE”) in regulatory decision-making, similar to other recent efforts in this arena that we have blogged about.  This Draft Guidance focuses on the use of patient-level data from other clinical trials or from RWD sources.  Notably, the Draft Guidance states that it is not intended to address other types of external controls, such as using summary-level estimates instead of patient-level data, nor does it discuss the use of external control data to supplement a control arm in a traditional randomized controlled clinical trial.

The Draft Guidance states that an external control group is potentially appropriate in a setting where the natural history is well-defined and the disease is known not to improve in the absence of an intervention or with available therapies.  “For example, objective response rate is often used as a single-arm trial endpoint in oncology given the established understanding that tumor shrinkage rarely occurs without an intervention.”  However, it also cautions that in many cases, “the likelihood of credibly demonstrating the effectiveness of a drug of interest with an external control is low, and sponsors should choose a more suitable design, regardless of the prevalence of disease.” Similarly, the Draft Guidance cautions that if the anticipated effect size is modest, an externally controlled trial may not be appropriate due to the concerns regarding the impact of bias and other limitations.  The Draft Guidance also does not recommend using a non-inferiority approach for an externally controlled trial.

As highlighted in the Draft Guidance, a prominent feature of an externally controlled trial is the absence of randomization.  A challenge caused by this is that confounding factors that can affect the measured outcome, such as certain baseline characteristics (e.g., demographic and related factors, disease characteristics, prognostic or predictive biomarkers, comorbidities, and treatments received), start of follow-up, and clinical observations collected may not be captured or similarly measured across groups.  Additionally, for historical controls, changes over time to factors such as diagnostic criteria or methods of obtaining data should be assessed.  The goal is to select similar patients in the treatment and external control groups.  The Draft Guidance recommends that Sponsors confirm that recognized, important prognostic characteristics can be assessed in the data sources used for an externally controlled trial to make the populations as comparable as possible.  Other challenges in the use of an external control include concerns over potentially important treatment imbalances between arms resulting in biases that were not documented or accounted for.  Such imbalances can involve adherence, dose, initiation timing, handling of index date, treatment duration, receipt of additional treatments, and factors in health care delivery.

The Draft Guidance recommends that, where possible, the outcome should be assessed by individuals blinded to treatment status, which may require re-adjudication of externally controlled data.  Well-defined, reliable, and meaningful outcomes that are typically used in clinical trials may not be available in RWD due to the lack of collection of relevant data in routine care or differences in strategies used to identify certain events.  Outcomes of interest are more likely to be recorded in clinical records when the events are objective and require immediate medical attention (e.g., stroke).  The Draft Guidance recommends that sponsors should also evaluate the consistency of timing of outcome assessments, which may be influenced by the patient’s clinical status outside the context of a clinical trial.  Other challenges related to the selection of outcomes include the differential capture of intercurrent events, and the potential lack of standardization and training regarding clinical outcome assessments.

Decisions regarding study design and the statistical analysis plan (“SAP”) should be made in a blinded manner to any external control data, according to the Draft Guidance, with the exception of planned feasibility analyses regarding such things as availability of key variables or missing data.  The analytic method should identify and manage sources of confounding and bias, including a strategy to account for differences in baseline factors and confounding variables, and missing and misclassified data.  Sponsors should also propose additional analyses to evaluate the comparability between the trial arms for important covariates.

The Draft Guidance states that sponsors should consult with the review division early in development about whether an externally controlled trial is reasonable, and they should submit their SAP with the protocol before initiating enrollment.  Specific design elements (such as data sources, baseline eligibility criteria, endpoints, and approaches to minimize missing data and sources of bias) should be prespecified in the protocol.

The Draft Guidance also states that sponsors must include in their marketing applications relevant patient-level data for both arms.  If sponsors do not own the data used for the external control arm, they should structure agreements with the data owner to ensure that patient-level data can be provided to FDA.

Outstanding Questions

This Draft Guidance expands on the 2001 ICH E10 guidance (Choice of Control Group and Related Issues in Clinical Trials) and does a fairly thorough job describing the limitations and challenges facing sponsors seeking to use an externally controlled trial, particularly using RWD.  As the determination is ultimately case-specific, the Draft Guidance does not provide many examples of scenarios where such approaches would be feasible and acceptable.  This is potentially discouraging to sponsors of drugs intended for rare and serious diseases.  If the Draft Guidance was interpreted to mean that applicability was limited to superiority trials in diseases with a well-understood natural history where the anticipated effect size is large, that would not address the reality facing many sponsors of drugs for rare diseases and potentially chill development of important drugs.  Nor is this Draft Guidance entirely consistent with ICH E10, which does not, for example, entirely foreclose the use of an external control in a non-inferiority trial (“An external control study could be a superiority study . . . or a non-inferiority study.”).

Additionally, the Draft Guidance states: “Sponsors must include in their marketing applications relevant patient-level data (i.e., data on each participant and patient in the externally controlled trial), as required under FDA regulations, for both the treatment and external control arms.”  The regulation that FDA cites as preventing it from considering summary-level estimates in an NDA is 21 C.F.R. § 314.50(f), which states in relevant part:

The NDA is required to contain tabulations of the data from each adequate and well-controlled study . . . .  The tabulations are required to include the data on each patient in each study, except that the applicant may delete those tabulations which the agency agrees, in advance, are not pertinent to a review of the drug’s safety or effectiveness. Upon request, FDA will discuss with the applicant in a “pre-NDA” conference those tabulations that may be appropriate for such deletion.

However, as the Draft Guidance explicitly does not apply to the use of summary-level estimates in an external control arm, it is unclear how sponsors of NDAs seeking to utilize summary-level information available may best make use of such information and still comply with this regulation.

Summary-level information should be able to serve a regulatory purpose, and it has, in some circumstances.  It is particularly important in the rare disease space, where patient-level data is often difficult to find.  It is not unusual for summary-level estimates, such as data published by an investigator drawing on information from one (or a few) academic centers, to be the only data available for a particular disease or condition.  It would be unfortunate to interpret the Draft Guidance to mean that these data would be entirely dismissed.  FDA should acknowledge that there is value in such data, while remaining true to its regulatory constraints.  For example, summary-level data can be very helpful in putting an observed placebo control or active control arm response into “real world” perspective. Rather than dismiss summary-level information entirely, the Draft Guidance should at least acknowledge that summary-level information may be used for other regulatory purposes.

Comments on the Draft Guidance are due May 2nd.

Last week FDA checked off another item on its to-do list for implementing the Coronavirus Aid, Relief, and Economic Security Act (CARES Act) OTC monograph reform provisions.  As provided in the OMUFA Performance Goals letter, FDA issued draft guidance on the content and format of submissions.  The draft guidance for industry entitled Over-the-Counter Monograph Order Requests (OMORs):  Format and Content, outlines the information (content) and the form of and manner in which the Agency recommends that an OMOR be submitted in order for FDA to make a determination that the OMOR is sufficiently complete and formatted to permit a substantive review.

If that language sounds familiar, that’s because it is very similar to the language used to describe the process by which FDA determines that a new drug application (NDA) will be filed (or not).  The new draft guidance continues to borrow heavily from the NDA process and FDA notes that it used the same source material on which other drug application recommendations are based including the Common Technical Document (CTD).  Multiple International Council for Harmonization (ICH) documents are referenced throughout the draft guidance as sources of further direction.

The draft guidance outlines five modules into which a request should be organized and includes detail about each of the modules’ expected content:

• Module 1: Administrative Information
• Module 2: Summaries
• Module 3: Quality
• Module 4: Nonclinical Study Reports
• Module 5: Clinical Study Reports

FDA also explains that certain information related to the nonprescription use, such as consumer behavior studies (e.g., label comprehension studies, self-selection studies, actual use studies, and human factors studies), should be included in Module 5 even if they are not clinical studies.  Module 5 should also include information about safe nonprescription marketing and use if the proposed drug contains an active ingredient not previously contained in certain OTC monographs or orders, and any postmarketing safety information.

Reminders of the need to fulfill existing environmental assessment requirements and make all submissions electronically are also included.

The section “General Considerations for an OMOR” goes through several basic submission requirements that clearly reflect the desire to avoid the chaos that the monograph docket files became over the years.  As anyone who spent any time searching through those can attest, between the quality and organization of the submissions and the less-than-optimal results of a long-ago effort by a third-party contractor to scan the paper submissions, it could take hours of sometimes fruitless searching to sort through the comments and other documents in any given monograph.  Now FDA has made it clear that submissions are expected to be in English, electronically searchable, of reasonable size font, generally on 8.5 x 11-inch paper, and with hyperlinks to references and numbered pages.

It is probably safe to assume that most are not surprised by these basics, but the amount of information FDA expects to be included in the modules is a far cry in terms of both quality and quantity from what in many cases has been provided by industry in the past.   The OTC monograph review is implementing process and data standards more akin to what its formerly more formal kindred NDA has had in place for decades.

In addition to regulating drugs of abuse, the federal Controlled Substances Act (“CSA”) controls the manufacture and distribution of chemicals used in the illicit manufacture of controlled substances.  As the primary agency enforcing the CSA, the Drug Enforcement Administration (“DEA”) previously designated nine chemicals used in the illicit manufacture of fentanyl or its analogues as List I or List II chemicals.  To further address the fentanyl crisis, DEA has issued a final rule designating 4-piperidone a List I chemical after concluding that “the vast majority of, if not all” of that chemical is being used in the illicit manufacture of fentanyl.  Designation of 4-Piperidone as a List I Chemical, 88 Fed. Reg. 21,902, 21,907, 21,909 (to be codified at 21 C.F.R. § 1310.02(a)(38) (Apr. 12, 2023).

The List I designation includes 4-piperidone’s acetals, amides, carbamates, salts and salts of its acetals, amides, and carbamates, and any combination thereof as a List I chemical.  Id. at 21,909 (to be codified at 21 C.F.R. § 1310.12(c)).

The designation subjects 4-piperidone (also called “piperidin-4-one”) manufacturers, distributors, importers, and exporters to DEA registration, recordkeeping and reporting, importation/exportation, and security requirements.  DEA did not establish a threshold for 4-piperidone, so all domestic and international transactions including all chemical mixtures, are regulated transactions.  DEA has assigned chemical code 8330 to 4-piperidone.  Id.

DEA is aware of at least 38 domestic suppliers and 19 foreign suppliers of 4-piperidone and those entities must obtain an agency registration unless exempt, or cease handling the chemical.  Id. at 21,904.  The final rule becomes effective May 12th, and DEA is allowing “continued legitimate commerce” in 4-piperidone by temporarily exempting handlers from required registration as long as it “receives a properly completed application for registration or application for exemption of a chemical mixture” on or before that date.  Id. at 21,906 (to be codified at 21 C.F.R. § 1310.09(s)(1)).

The final rule is attached here.

On April 13, the Federal Trade Commission (“FTC” or “Commission”) issued a press release that it had sent letters to “almost 700 marketing companies that they could face civil penalties if they can’t back up their product claims.” FTC indicates that the notices were sent to companies involved in the marketing of OTC drugs, homeopathic products, dietary supplements, or functional foods. The press release included a link to the list of the recipients.

Interestingly, FTC notes that a recipient’s inclusion on the list does not in any way suggest that it has engaged in deceptive or unfair conduct. According to the press release, FTC sent the notices to companies that it believes are making or likely to make health-related product claims.  So what is the purpose of this notice you may ask?

As readers of our blog may recall, this is not the first time that FTC issued notices of penalty offenses to a seemingly random sample of the industry.  As we reported in October 2021, FTC apparently resurrected its penalty offense authority as an enforcement tool after the Supreme Court decided that the FTC is not allowed to seek penalties against alleged wrongdoers under section 13(b) of the FTC Act.

In the letter sent out last week, FTC asserts that: “Receipt of a notice of penalty offenses puts your company on notice that engaging in conduct described therein could subject the company to civil penalties of up to $50,120 per violation. See 15 U.S.C. § 45(m)(1)(B)” (emphasis in original).

FTC seems to be overstating the effect of the notices.  Under the plain text of the statute, FTC only has authority to pursue such penalties against a person with “knowledge” either “actual knowledge or knowledge fairly implied on the basis of objective circumstances that such act is unfair or deceptive and is prohibited by such rule.”  FTC must prove that the defendant committed the same conduct and did so with actual knowledge that the conduct was unfair or deceptive.

The letter refers to two Notices of Penalty Offenses, one regarding endorsements and the other regarding claim substantiation.  The notice of penalty offence regarding endorsements is identical to and relies on the same cases as the notice from 2021.  The notice of penalty offense regarding substantiation is new.  The FTC’s webpage for Penalty Offenses Concerning Substantiation lists cases dated between 1974 and 2017 on which the FTC relies for its notice regarding product claims substantiation, but provides no explanation whatsoever for how those earlier cases relate in any way to the hundreds of companies who received the 2023 letters

The letter appears to be a general statement of FTC’s interpretation of law, as it lacks any factual information that clarifies what conduct FTC would consider to be  violative.  It seems doubtful that these notices are adequate to allow FTC to impose civil penalties.  On her last day as a Commissioner, now former Commissioner Wilson seemed to agree with us in her dissenting opinion.  It remains to be seen how heavily FTC will lean on these notices in any upcoming actions.

To our knowledge the Commission has not relied on the 2021 notices in any public enforcement action or publicly announced settlement.  While the Commission did settle cases in 2022 against Walmart and Kohl’s, those settlements were not based on 2021 notices.

That said, the notices are a good reminder of a company’s obligations regarding truthful and non-misleading advertising.

Eric Idle, as a body collector, immortalized the phrase, “Bring out your dead,” in the 1975 comedy classic, Monty Python and the Holy Grail.  The Drug Enforcement Administration (“DEA”) could voice a modern variation, “Bring out your meds,” as the agency and its law enforcement partners host local drop-off locations nationwide for safe disposal of unneeded medication on Saturday, April 22, 2023, from 10:00 a.m. to 2:00 p.m. local time.

Stockpiles of old, unwanted and expired controlled prescription medication in medicine cabinets are susceptible to theft, misuse and abuse.

DEA hosts National Prescription Drug Take Back Days each spring and autumn.  DEA’s Take Back Day last October collected almost 650,000 pounds of unneeded medication at about 5,000 collection sites.  DEA’s bi-annual Take Back Days have collected nearly 17 million pounds of medication since 2010.  More information about DEA’s National Prescription Drug Take Back Day, including disposal locations, can be found at: https://www.deadiversion.usdoj.gov/drug_disposal/takeback/index.html.  That DEA website also lists permanent, year-round disposal locations.

So, bring out your meds!  Bring out your meds!

On Thursday, April 20, from 1:30-3:00pm, John Claud of Hyman, Phelps & McNamara, P.C. will present a webinar entitled “Medical Device Enforcement: Latest Developments from the FDA, DOJ and FTC.”

John will provide participants with a greater understanding of new guidance implications, as well as recent guidance on delaying, denying, limiting, or refusing an inspection, and the DOJ’s revised Corporate Enforcement Policy, which altered the way the agency reviews corporate criminal prosecution decisions.

Other key takeaways will include: a  comprehensive understanding of how FDA, DOJ, and FTC coordinate their priorities and resources for enforcement actions of medical devices; a review of recent FTC enforcement cases, with a focus on the perils of promoting claims that aren’t supported by science; an explanation of the FTC’s health products compliance guidance and other rules; key updates from the FDA’s guidances on medical device-related cybersecurity; and, tips for navigating DOJ’s new Corporate Enforcement Policy.

Register here!

Drugs and substances classified within schedule I of the federal Controlled Substances Act (“CSA”) by definition have a high potential for abuse, no currently accepted medical use in treatment in the United States, and lack accepted safety for use under medical supervision.  21 U.S.C. § 812(b)(1).  Last month bipartisan legislation, S. 689 and H. 1393 introduced in the Senate and the House, would facilitate removing barriers to research and compassionate use for schedule I controlled substances including the psychedelics psilocybin and 3,4-methylenedioxymethamphetamine (“MDMA”).

Senator Cory Booker (D-NJ), a co-sponsor of the Breakthrough Therapies Act in the Senate with Senator Rand Paul (R-KY), stated that MDMA and psilocybin “have shown exceptional promise in treating an array of mental health conditions, including treatment-resistant suicidal depression, anxiety, PTSD, and substance use disorders.”  Booker, Paul, Mace, Dean Introduce Bipartisan Legislation to Promote Research and Access to Potential Life Saving Drugs, Mar. 8, 2023.  Booker opined that the Act would expedite rescheduling schedule I substances that receive breakthrough therapy designation to schedule II that “with DEA oversight-will enable patient access and reduce the burden on further clinical investigation.”  Id.

On the House side, Representative Nancy Mace (R-SC), a cosponsor of the companion House bill with Madeleine Dean (D-PA), noted that MDMA and psilocybin research “has been so promising” that the Food and Drug Administration (“FDA”) designated them as “Breakthrough Therapies,” meaning that “they demonstrate substantial improvement over any currently available treatments with a clear demonstration of efficacy.”  Rep. Mace & Dean with Sen. Booker & Paul introduce the Breakthrough Therapies Act for Veterans and Patients, Mar. 7, 2023.

Mace cited recent research in the U.S. and United Kingdom demonstrating “significant medical benefits” of MDMA and psilocybin, noting that The New England Journal of Medicine published Phase 2b clinical trial results showing that a small dose of psilocybin caused remission of treatment-resistant depression in about 30% of patients.  Id.  Likewise, a 2020 National Center for PTSD study of MDMA use by military veterans led to significant reductions in suicidal thoughts, PTSD, depression, and anxiety.  Id.

The Breakthrough Therapies Act would facilitate access research with schedule I substances like MDMA and psilocybin by amending the CSA’s “currently accepted medical use with severe restrictions” criteria.  Id.  The Act would revise criteria to include the active ingredients of therapies that receive FDA Breakthrough Therapy Designation or Expanded Access approval “to treat patients with serious or life-threatening diseases for which no comparable or satisfactory therapies are available.”  S. 689, § 1 (to be codified at 21 U.S.C. § 802(a) (7)(A)).  With this definition, DEA would begin making findings necessary to transfer breakthrough therapies involving schedule I substances to schedule II for limited research and compassionate medical use.  Schedule II regulatory requirements for research are less restrictive than schedule I requirements, which require schedule I researchers to submit and receive approval of a research protocol with detailed information depending upon whether their research involves human or animal subjects.

The legislation, while loosening requirements for necessary MDMA, psilocybin, and other research, presents no increased risk of diversion of those substances from legitimate channels.  The Act would create an expedited process for DEA to transfer an Expanded Access drug from schedule II back to schedule I if the drug is placed on clinical hold.  Id.

If enacted, the Act would facilitate research, access to, and potential roll-out of promising psychedelic and other potentially lifesaving therapies via compassionate use pilot programs.

The bills were introduced in their respective chambers on March 7th, then referred to the Senate and House Committee on the Judiciary, and to the House Committee on Energy and Commerce.

The text of the bill can be found here.

South Korea has made significant achievements over the years in the biohealth industry, establishing the world’s second-largest biopharmaceutical manufacturing capacity. South Korea continues to drive the effort in the biohealth industry, which will lead to more Korean players in the U.S. market.

The South Korean government has recently announced its plan to provide support for the growth of the nation’s biohealth industry, aiming to establish it as a significant and strategic sector in the nation, similar to the semiconductor industry. South Korean President Yoon Suk Yeol plans to provide full support to create a Korean version of the Boston Biotech Cluster. President Yoon also urged lawmakers to pass the digital healthcare bill that would protect personal data while boosting the industry’s competitiveness through data usage.

In line with President Yoon’s orders for biohealth and digital healthcare development, the Ministry of Health and Welfare proposed new strategies with the following five core tasks to achieve the objectives of making new digital markets and activating biohealth exports.

1. “Innovation of data-driven medical, health, and care services;
2. Activation of exports of the bio-health industry;
3. Ramp up of R&D in advanced convergence technologies;
4. Development of advanced bio-health experts and increase of startup support;
5. Establishment of laws, frameworks, and infrastructure.”

The Ministry of Health and Welfare also announced that it will pursue regulatory innovation in the following seven core areas of the biohealth industry for protecting public health and promoting innovation by the private sector.

1. “Innovative medical devices;
2. Innovative and essential pharmaceuticals;
3. Digital health care;
4. Advanced regenerative medicine and advanced bio-pharmaceuticals;
5. DNA tests;
6. Brain-machine interface;
7. Infrastructure”

We are excited to hear that South Korea is investing in the growth of the biohealth industry and promoting digital healthcare. This effort shows a strong commitment to the development of its biohealth industry and, if implemented effectively, could potentially position South Korea as a significant player in the industry globally. As this blogger is originally from South Korea, we look forward to working with many Korean companies to bring their innovative products to the U.S. market.

On March 31, the Federal District Court for the District of Maryland upheld CMS’s definition of a “new formulation” under the Medicaid Drug Rebate Program (MDRP).  Vanda Pharmaceuticals, Inc. v. CMS, Civ. No. MJM-22-977 (Dist. Md. 2023).  By way of background, manufacturers are subject to an additional per-unit Medicaid rebate if they increase their prices greater than the rate of inflation.  The amount of the additional rebate is the excess (if any) of a drug’s current Average Manufacturer Price (AMP) over the inflation-adjusted AMP for a statutorily specified baseline quarter.  In 2010, concerned that manufacturers were making minor changes to a drug merely so that it could be characterized as new covered outpatient drug with an updated baseline AMP, Congress added to the statute an alternative rebate for line extensions of oral dosage form innovator (i.e., NDA or BLA) drugs.  Under that provision, a manufacturer that introduces a line extension with a new baseline AMP must pay the greater of the rebate calculated in the ordinary manner, or an alternative rebate calculated in a manner that is tied to the inflation rebate of the predicate drug (and therefore indirectly to the predicate drug’s baseline AMP).  Under the statute, a line extension is a ‘new formulation” that is not an abuse-deterrent formulation.

Over ten years after this statutory amendment, on December 31, 2020, CMS finalized a broad definition of “new formulation” as “any change to the drug, provided that the new formulation contains at least one active ingredient in common with the initial brand name listed drug.”  Examples in the regulation include extended-release formulations, new strengths, dosage forms, routes of administration, ingredients, and combinations.  See our memo summarizing CMS’s regulation here.

In 2014 Vanda introduced Hetlioz (tasimelteon) capsules to treat a rare sleep disorder.  In 2020, Vanda obtained approval of an NDA to market Hetlioz LQ, an oral suspension of tasimelteon, to treat children with Smith-Magenis Syndrome (SMS), a neurodevelopmental disorder that causes sleep disturbances (among other things), and Vanda also obtained approval of an sNDA to expand the indication of Hetlioz capsules to include adults with SMS.  Vanda is also conducting clinical studies of a long-acting injectable form of its marketed drug Fanapt tablets, an anti-seizure drug.  All of these products are line extensions under CMS’s definition.  Vanda therefore filed a complaint in the Maryland Federal District Court in April 2022 to challenge CMS’s definition on Administrative Procedure Act grounds.  The essentials of Vanda’s complaint were that (1) a drug approved under a new NDA cannot be a line extension; (2) a line extension, like its predicate drug, must be an oral solid dosage form; (3) CMS’s definition exceeds the plain meaning of “line extension”; and (4) Congress intended to target only slight alterations of a drug, as evidenced by the sole example in the statute of “an extended-release formulation”.

The court rejected all of these objections, either citing the plain meaning of the statute or applying Chevron deference to CMS’s interpretations of ambiguities.  As to Vanda’s argument that a drug approved under a full NDA cannot be a line extension, the Court reasoned that the line extension provision applies to single source drugs or innovator multiple source drugs, both of which are defined, in part, as a drug approved under an NDA.  Accordingly, the Court concluded that a line extension can be a new drug product approved under an NDA.

The court next dismissed Vanda’s claim that, in order for the alternative rebate to apply, the line extension (in addition to the predicate drug) must be an oral solid dosage form.  (Neither Vanda’s Hetlioz LQ nor Fanapt injectable is an oral solid dosage form.)  The alternative rebate provision applies to “a line extension of a single source drug or an innovator multiple source drug that is an oral solid dosage form,” leaving a question as to whether the underscored text qualifies “line extension,” “single source drug”, and innovator multiple source drug” or merely the latter two.  In an extended grammar lesson explaining the “rule of the last antecedent,” the Court held that CMS could permissibly construe “oral solid dosage form” to refer only to the latter two terms, so that the line extension does not have to be an oral solid dosage form.  The Court also rejected Vanda’s attempt to define “line extension” by reference to the dictionary definitions of each word.

Finally, the court addressed Vanda’s claim that CMS’s definition of line extension was overly broad, exceeding Congress’ intent to capture only slight alterations to existing drugs.  This objection echoed a criticism that had been expressed by industry ever since CMS’s proposed rule in 2012.  After all, the statute gives only the example of “an extended-release formulation,” and from that CMS has fabricated a broad net that captures everything from new strengths to new ingredients to new combinations and indications.  Nevertheless, the Court found that a narrow interpretation would be inconsistent with Congress’ intent to reduce Medicaid drug costs.  Somewhat more convincingly, the court also reasoned that Congress recently used the identical statutory language in the August 2022 Inflation Reduction Act (more on this below), and declined to further define “new formulation” despite its presumed knowledge of CMS’s previous Medicaid interpretation.

Absent a successful appeal by Vanda, this decision will have implications going beyond the MDRP.  Beginning this fiscal year (October 1, 2022 through September 30, 2023), the Inflation Reduction Act (IRA) imposes inflation rebates for Medicare Part D drugs whose price increases exceed the rate of inflation. See our summary of the IRA drug provisions here.  The IRA directs CMS to establish a formula for determining the inflation rebate for line extensions consistent with the formula under the MDRP, and defines “line extension” in a manner substantially identical to the MDRP definition.  In a guidance issued on February 9, CMS did as instructed, tying the inflation rebate for a line extension drug to that of initial drug, as under the MDRP.  Given that drug spending under Medicare Part D is over 2.5 times that of Medicaid ($98 billion and $38.1 billion, respectively, in FY 2021), the impact on drug manufacturer rebates of CMS’s line extension definition, and the Court’s failure to overturn it, will be that much magnified.

Perhaps you obtain controlled substance quotas or submit ARCOS reports?  Maybe you identify and report suspicious orders or thefts/losses.  Or you obtain import or export permits, submit import or export declarations or listed chemical DEA-486s.  Do you want to learn more?  You have your chance.

DEA’s Diversion Control Division is hosting a Supply Chain Conference for registered manufacturers, distributors, importers and exporters on controlled substance and listed chemical requirements in Houston on May 2-4, 2023.  The first day is dedicated to manufacturers, while Days 2 and 3 are for regulatory compliance personnel and mid-level to senior managers.  DEA will offer virtual accessibility to those who cannot attend in person.  Relevant information and links follow.

Click here to VIEW AGENDA.

Click here for In-Person Registration or Live Stream Registration

Refer questions to VDAT@dea.gov with subject line “Supply Chain Conference.”

Early on March 29, 2023, FDA announced the landmark approval of Narcan (naloxone hydrochloride) Nasal Spray for use as a nonprescription opioid overdose reversal agent.  I previously blogged on the February 15, 2023 Joint Meeting of the Nonprescription Drugs Advisory Committee (NDAC) and the Anesthetic and Analgesic Drug Products Advisory Committee (AADPAC) which unanimously agreed that the benefit-risk profile of Narcan Nasal Spray (NNS) is “supportive of its use as a nonprescription opioid overdose reversal agent.”  FDA Commissioner Robert M. Califf, M.D. announced that “Today’s approval of OTC naloxone nasal spray will help improve access to naloxone, increase the number of locations where it’s available and help reduce opioid overdose deaths throughout the country.”  Both harm reduction experts and FDA have long agreed that the prescription status for naloxone posed a barrier to wider access to this safe and life-saving drug.  While many states have had standing orders that allow for the dispensing of naloxone without an individual prescription, “harm reduction programs” that provide products and services to at-risk individuals still faced logistical difficulties in acquiring naloxone due to its prescription-only status which I discussed in this October 2022 blog post.

Now what?

When OTC NNS will become commercially available is ultimately determined by the sponsor of the drug—Emergent BioSolutions.  Emergent will need time to manufacture and distribute NNS with the new OTC labeling, so the public should not expect to be able to walk into their local pharmacy and grab a box off the shelf in the coming days.

NNS (N208411) is the reference listed drug (RLD) which applicants have relied on for approval of generic versions of naloxone nasal spray.  The sponsors of the currently approved 4 mg generic naloxone nasal spray products that rely on Narcan as the RLD will need to submit supplements to their applications (A209522, A211951) to also switch their drugs to OTC status.  However, additional naloxone products will remain prescription drugs.  The OTC approval of NNS will not change the prescription status of the 21 injectable naloxone products listed in the Orange Book.  Additionally, 8 mg naloxone nasal spray (N212045) is also still a prescription drug.

Today’s OTC naloxone approval is limited to NNS specifically, but we are aware of other OTC naloxone applications currently being reviewed by FDA.  I previously blogged on the cancellation of the Joint Meeting scheduled on March 20 to discuss the direct-to-OTC application for 3 mg naloxone nasal spray submitted by Harm Reduction Therapeutics under the trade name RiVive.  Last week Harm Reduction Therapeutics announced that it has entered into a commercial supply agreement with Catalent which will manufacture RiVive—if approved—at its facility in Morrisville, North Carolina.  According to this announcement, FDA approval of RiVive is anticipated in July 2023 and the U.S. launch would be in early 2024.

How “accessible” will OTC naloxone really be?

In announcing the approval, Commissioner Califf encouraged the manufacturer to make OTC NNS available “at an affordable price,” but FDA does not ultimately have control over Emergent’s pricing.  Prescription naloxone has generally been covered by private health insurance, Medicaid, and Medicare Part D meaning that it has been available to many people for free or at a low price through their insurers.  However, many insurance plans do not cover OTC drugs so there are concerns that the out-of-pocket price for OTC NNS could potentially increase for those accessing the drug through their health insurance.  In addition to price, physical barriers such as placing NNS in a locked box or behind-the-counter in the pharmacy would also impede accessibility.  While accessibility is an open and important question, approval of OTC NNS is nevertheless a crucial and life-saving step in combatting the ongoing opioid crisis.

The Unique Device Identification (UDI) System final rule requires all medical devices to bear a unique numeric or alphanumeric code in easily readable plain-text and machine-readable form. Such codes need to be placed on device labels and packages to allow devices to be easily identified and tracked throughout their lifecycle, except where the rule provided for an exception or alternative. In addition, the final rule requires the submission of product information to the Global Unique Device Identification Data (GUDID).

FDA has been implementing the UDI system with different compliance dates for different types of medical devices to ensure a smooth implementation. The compliance dates were first published in 2013, and subsequently updated in various guidance documents and regulations published by FDA. Most of the compliance dates have been passed. So, what is special about September 24, 2023?

The Transition from the Use of Legacy Identifiers on Device Labels to UDI

The September 24, 2023, date is specific to the enforcement policy described in the May 2021 FDA Guidance, which applies to the requirement that legacy FDA identification numbers should no longer be used on a device label or device package. Legacy FDA identification numbers refer to both National Health Related Item Code (NHRIC) and National Drug Code (NDC) numbers created using labeler codes previously assigned to device manufacturers by FDA. Once the device is required to bear a UDI, any NHRIC and NDC codes will no longer be permitted on the device label or device packaging. Firms can continue to include catalog numbers, inventory numbers, ordering numbers or other identification numbers on device labels and packaging. This transition does not apply to Class I devices that had a Universal Product Code (UPC). For Class I device, the UPC can serve as the UDI required by 21 CFR 801.20.  See 21 CFR 801.40(d).

The Expiration Date of FDA UDI Alternatives: UDI-A160001 and UDI-A160002

The FDA has granted a variety of time-limited alternative requests since the publication of the UDI Rule. For the stakeholders who use UPC as their device identifier, UDI alternatives UDI-A160001 and UDI-A16002 will expire on September 24, 2023. Check out here and here to see if a device is classified with product codes included for these two alternatives. Devices can have both a UPC code and a UDI on their label and package.

Once UDI-A160001 and UDI-A16002 expire, devices previously using these alternatives must comply with applicable requirements of the UDI Rule, including placing a UDI to device labels and packages and submitting updated device information to the GUDID. FDA notes the following: “The FDA does not object to the continued use of the alternative for finished devices that are manufactured and labeled prior to September 24, 2023. Devices that are manufactured and/or labeled on or after September 24, 2023, cannot use this alternative.” (Emphasis added.)

Planning Now is a Good Idea

If a firm needs to remove NHRIC and NDC legacy identifiers or currently relies on UDI-A160001 and UDI-A160002, it would be wise to plan for the transition.  It is not far off! If not already started, firms need to start soon to implement the UDI requirements. When a firm develops requirements for UDI, an important step is to determine if the products can utilize any of the existing general exceptions from the requirement per 21 CFR 801.30. Use the FDA’s resources to determine the best UDI implementation strategy.

The single-use device exception under 21 CFR 801.30(a)(3) and the convenience kit exception 21 CFR 801.30(a)(11) (see UDI Convenience Kits Guidance) may be useful in some cases.  We recommend working with the issuing agency to determine if the NHRIC or NDC number may be used as part of a UDI code. In planning for UDI compliance, remember to determine if the product must bear a permanent marking per 21 CFR 801.45 (see UDI Direct Marking of Devices Guidance).

While the final UDI Rule allowed labelers to request an alternative to UDI compliance, the Agency emphasized that the time for extensions is over:  “… the FDA does not intend to grant additional extensions to alternatives UDI-A160001 and UDI‑A160002 beyond September 24, 2023.”

Finally, as a general matter, every firm needs to make sure its supply chain stakeholders (e.g., retail stores, pharmacies, and payors) are ready for the UDI transition by September 24, 2023.

Thank you to those who registered for and attended Hyman, Phelps & McNamara’s March 23, 2023 lunchtime webinar addressing the “End of the COVID-19 Emergency and the Ryan Haight Act: Telemedicine and Next Steps.”  Our in-house team brought together many talented HPM attorneys, including Karla Palmer, John Gilbert, Jeff Wasserstein, John Claud, and Kalie Richardson, who gave not only a broad overview of timely and relevant legal, regulatory, and enforcement considerations, but also discussed some interesting, more detailed matters involving the use of telemedicine and telehealth in a post-pandemic environment, and various important DEA and Controlled Substances Act considerations.  As promised during the 90-minute program, we provide our slides here, and a recording of the program, here (passcode.   Our attorneys are happy to respond to questions you may have, and look forward to hearing from you.

On April 18, the Supreme Court will hear oral argument in two consolidated cases that present the question of whether a defendant can “knowingly” submit a false claim under the Federal False Claims Act when the alleged falsity is based on an objectively reasonable legal interpretation of an ambiguous provision of law and no authoritative guidance from the government warned the defendant away from its interpretation.

The defendants in the cases recently submitted their brief arguing that the answer to that question should be “no.”  On the other side of the issue are the whistleblowers/relators in the case and the DOJ, which the Court has granted leave to participate in the argument. Much has already been written on this issue and more is sure to come as the tea leaves from the argument are read, and a decision is ultimately issued.   We will continue to follow the developments, but for today’s blog, focus on what’s at stake—in short, massive amounts of damages and penalties.

When an ambiguous law or regulation is presented to a court, it is the court’s job to decide what it means, no matter how ambiguous or inartful the provision may be.  The upshot is that a court, for the first time in a False Claims Act case may be called upon to decide what a law means, and therefore whether a claim submitted well before the issue reached the court is a “false” claim.

Unlike the FDC Act, the FCA is not a strict liability statute, however. So, even if the court resolves the ambiguity and determines that a claim was “false” there is no FCA liability unless, among other elements, the defendant acted “knowingly.”  Under an objective reasonableness standard for “knowingly,” if the court finds that when the defendant was engaged in the allegedly violative conduct, the provision was ambiguous and the defendant’s interpretation objectively reasonable, the case can be dismissed at the pleading stage or summary judgment avoiding trial.

Much of the objection to an objective reasonableness standard suggests that creative lawyers using post-hoc rationalizations could allow defendants who subjectively “knew” to “get away” with something. That commentary does not typically focus on the stakes for a defendant that believes it was right, goes to trial and loses.  A recent case before the Minnesota District Court shows how high those stakes are.  In a recent trial, a jury verdict finding $43M in single damages has, according to the government, resulted in $490M in statutorily mandated liability.  The sheer size of that type of exposure gives the government and relators an outsized hammer in negotiating with a putative or actual defendant.  Even defendants that ultimately prevail can spend years defending their actions.  We recently blogged about a qui tam suit that was dismissed despite an en banc review at the 4th Circuit, but not before spending nearly a decade defending its reasonable interpretation of an ambiguous best price statute.

Given the already stacked scales of justice in these FCA cases, we are hopeful that the Court will adopt the objective reasonableness standard, but regardless we will be following the issue closely and keep you apprised of the latest developments.