MHRA LAUNCHES UK CLINICAL TRIAL REGULATION CONSULTATION

The UK Government, through the Medicines and Healthcare Products Regulatory Agency (MHRA) (the medicines and medical device regulator in the United Kingdom), recently announced a consultation to change the UK clinical trial regulations.

Following the United Kingdom’s departure from the European Union, the UK Government is seeking to create an attractive regulatory environment for clinical trials alongside a programme that is intended to enhance the United Kingdom’s status as a go-to destination for the development of new healthcare products and innovation. The Government set out its wider life sciences ambitions in July 2021 in its Life Sciences Vision.

The current UK clinical trial regulations are derived from the 2001 EU Directive. As a consequence of Brexit, the United Kingdom has not adopted the new EU Clinical Trial Regulation 2014, which came into effect on 31 January 2022.

The consultation’s objectives are wide and include gathering information on how to increase patient and public involvement in clinical trials, improve engagement and diversity of trial participants, streamline clinical trial approvals and reporting processes, share research findings with the health community more transparently and improve labelling of medicinal products.

The consultation seeks views on the proposed changes to the trial regulatory framework applicable in the United Kingdom and will run until 14 March 2022, following which the Government will publish a report and any future proposals. Such proposals would remain subject to Parliamentary scrutiny before becoming law. The recent Medicines and Medical Devices Act 2021 provides the powers to update the United Kingdom’s legislation for clinical trials.

The consultation includes the following key proposed changes:

• Statutory requirement for patient and public involvement in research. Patient involvement is currently expected as part of research ethics approval. The MHRA proposes to issue guidance on how to meet the legislative requirements.

• Research transparency. The proposals include registration of clinical trials; publication of results; and the sharing of clinical trial findings with participants in a suitable format within 12 months of the end of the trial, or provision of an explanation of why doing so is not appropriate.

• “Single front door” for approval processes. In line with the current approach being piloted between the MHRA and the Health Research Authority, the proposals include a single research ethics and clinical trial approval process with timelines for statutory review and response depending on the type of application.

• “Sunset” provisions for applications. The MHRA proposes that clinical trial approval will lapse after a specified time limit if no participants have been recruited.

• Research ethics information requirements. The MHRA proposes to remove the current legislative requirements for information to be submitted as part of a research ethics opinion application, and to replace them with guidance that allows for flexibility in the future.

• Greater flexibility with respect to substantial amendments and timing of Requests for Further Information. This flexibility would allow more iterative communications between sponsors and regulators during a trial.

• Notification scheme for low-intervention trials. For trials where the risk is similar to that of standard medical care, the consultation proposes that the clinical trial could be approved without the need for a regulatory review but would require ethics approval. This proposal is in line with guidance, but in practice there has not been high uptake of this scheme.

• Greater inclusion of underserved populations. The consultation proposes the inclusion of legislative requirements to support diversity in clinical trials, for example pregnant and/or breast-feeding individuals.

• Simplification of informed consent in cluster trials.

• Changes in safety reporting where these obligations do not contribute to participant safety, and removal of duplicative reporting requirements.

• Good clinical practice. MHRA proposes changes to current legislation to incorporate more elements on risk proportionality.

• Electronic master trial files. MHRA proposes changes so that service providers are legally responsible for good clinical practice compliance.

• New sanctions and corrective measures. These include permitting regulators to take into account serious and on-going non-compliance when considering new studies, and enabling regulatory action to be taken against specific parts of a trial rather than the whole trial.

• Changes with respect to labelling that will diverge from the EU Clinical Trial Regulation.

• A risk-based approach with respect to the use of non-investigational medicinal products (which would be re-defined) for labelling of certain products, including those with a marketing authorisation and medicines at the point of care. This approach would allow such products to have reduced or no clinical trial labelling.

• Requirement for a UK-specific reference and removal of the requirement for EudraCT number.

• Real-world evidence. MHRA proposes to permit data collection after MHRA early access approval without the need for clinical trial approval. Ethics approvals may still be required as necessary, as such trials would still be regarded as clinical research.

ICO DRAFT GUIDANCE AND CONSULTATION – HEALTH DATA

What Health and Life Sciences Companies Should Know about ICO Draft Guidance on the UK Data Protection Legislation Research Provisions

The Information Commissioner’s Office (ICO) published new draft guidance on the provisions in the UK General Data Protection Regulation and Data Protection Act 2018 (collectively, the UK GDPR) relating to processing personal data for research purposes.

The guidance provides clarity to health and life sciences companies and will be broadly welcomed in an area that is often difficult to navigate, not least because the law is contained in various provisions and there has been varying guidance on how to interpret the provisions. The ICO consultation on the guidance closed on 22 April 2022.

The ICO is also consulting on its draft guidance concerning anonymisation, pseudonymisation and privacy-enhancing technologies. This consultation closes on 16 September 2022.

Separately, the UK government is currently considering changes to research provisions as part of its proposals to reform the UK data protection regime and build on its vision of enhancing life sciences in the United Kingdom. In April 2022, the UK government published a review on the use of health data for research and analysis. The ICO acknowledged these proposals but says this guidance is important to support organisations using personal data for research now.

ICO DRAFT GUIDANCE ON RESEARCH PROVISIONS 

Why Is This Important?

The guidance is particularly relevant for life sciences, medical device and healthcare technology companies that use health-related data for research purposes, including as part of clinical trials, clinical investigations or wider research. It’s also relevant to health and life sciences companies that are looking to reuse data sets they already hold.

Is an Organisation Processing Health-Data for Research Purposes? What Is the Definition of Scientific Research? 

The UK GDPR references three broad types of research purposes: archiving purposes in the public interest, scientific or historical research purposes and statistical purposes.

In the health and life sciences sector, scientific research is likely the most common purpose, although the guidance also provides helpful pointers on the use of statistical purposes where the primary aim or purpose of the processing is to produce statistical outputs. The ICO notes that there is no definition of scientific research in the UK GDPR and says this term should be understood broadly and extend beyond traditional academic research to research in commercial settings.

How Would an Organisation Show That Their Processing Falls within Research Purposes?

The guidance says that the key feature of scientific research is to produce new knowledge or apply existing knowledge in novel ways, often with the aim of benefiting the public interest. Examples include advancing the state of the art in a given field or providing innovative solutions to human problems, generating new understandings that add to the sum of human knowledge or producing findings of general application that can be tested and replicated.

What are the Indicative Activities and Features of Scientific Research?

In the guidance, the ICO produces a non-exhaustive indicative list of activities and features that will help demonstrate that the purpose of processing is scientific research.

While it’s not necessary to meet all of the features, the ICO stated that it would expect an organisation to meet more than one. This, therefore, appears to be somewhat of a balancing test.

• Activities could include formulating hypotheses, isolating variables, designing experiments, objective observation, measurement of data, peer review and publication of findings.

• Standards could include ethics guidance and committee approval, peer review, compliance with regulatory requirements and involving the public.

• Access could include publication of results and commitment to sharing research findings, however, this does not need to be open access publication.

These features are likely to be met where a health and life sciences organisation conducts a regulated clinical trial or clinical investigation. However, where the research falls outside of the regulatory formalities and in a commercial setting, including for artificial intelligence (AI) or product development, careful assessment is required.

What Lawful Basis Can an Organisation Rely on for Processing Health-Related Data for Research Purposes? 

Health and life sciences companies processing special category data (such as data relating to health) need both an Article 6 lawful basis and an Article 9 special category condition. The ICO notes that there is no specific Article 6 lawful basis for processing and will depend on the controller’s status and context. For example, public organisations may rely on the task being in the public interest while commercial companies and research organisations could seek to rely on legitimate interest.

To satisfy the special category condition of scientific research, the controller must also only process special category data if the processing is: (1) necessary, (2) subject to appropriate safeguards, (3) not likely to cause substantial damage or substantial distress to an individual, (4) not used for measures or decisions about particular individuals except in the case of approved medical research and (5) in the public interest.

What about Consent as a Lawful Basis for Data Processing? 

According to the guidance, in most cases, consent will not be the most appropriate lawful basis for processing special category data for scientific research purposes. This is because under the UK GDPR, the individual must be able to withdraw the consent at any time. If an entity is relying on consent as their lawful basis and the individual withdraws their consent, the entity needs to stop processing their personal data immediately. Additionally, if an entity collects data on the basis of consent and wants to reuse it for secondary research, it is likely that they will have to obtain new consent from the data subjects under the UK GDPR to ensure that an individual’s original informed choice to share that data is not undermined.

Informed consent is required for clinical trials and clinical investigations. The guidance confirms that consent as a lawful basis for data processing under the UK GDPR is distinct from, and not to be confused with, consent to participate in a research study.

In practice, consents for clinical investigations and clinical trials can often be muddled. Health and life sciences companies should clearly set out the basis on which they are processing data in any informed consent form.

A New Purpose: Can an Organisation Reuse Data It Collected for Secondary Research?

The guidance provides a helpful interpretation of the purpose limitation in Article 5 of the UK GDPR, which has sometimes been narrowly viewed. The guidance states that the purpose limitation requires a processor to be open and honest about their reasons for obtaining data and helps to prevent “function creep.” However, the ICO goes on to say that this limitation specifically does not apply to research. This means an organisation is permitted to reuse existing personal data for research-related purposes if they have appropriate safeguards, such as technical and organisational measures to ensure data minimisation, and the processing is otherwise fair and lawful.

However, the ICO also states that data cannot be repurposed if the original basis of processing was consent.

A New Purpose: What about Data Obtained from Another Organisation?

The guidance states that if data were obtained from another organisation, then the recipient organisation is collecting new data rather than repurposing data that they already collected. In this case, the recipient organisation cannot rely on the original organisation’s purpose. Instead, they need to identify their own lawful basis for processing and should update their privacy information. Additionally, data subjects should be informed of this practice unless informing them would prove impossible or involve disproportionate effort.

Medical Confidentiality: Is Consent Required for UK GDPR Research?

The ICO says that clinical trial or ethical consents should not be confused with UK GDPR consent. This is an important clarification.

However, one thorny question that remains unanswered in the ICO draft guidance is the interplay between medical confidentiality consent and the lawful basis and special category conditions in the UK GDPR.

In 2017, the ICO held that processing by Royal Free London NHS Trust in the context of research on a possible medical device was in breach of the common law duty of confidentiality because patients were not adequately informed that their records would be processed for clinical safety testing and that informed consent was likely to be required. Accordingly, the ICO found that the processing was not lawful under UK GDPR.

BRING ME SUNSHINE?

The Health and Care Bill — now in the final Parliamentary stage before receiving Royal Assent and becoming legislation — gives the UK’s Secretary of State for Health and Social Care power for the first time to introduce regulations that would require manufacturers and commercial suppliers of healthcare products to report payments or benefits that they provide to healthcare providers and others that provide healthcare or activities connected with the provision of healthcare. This power would allow the Secretary of State to introduce new laws to the United Kingdom that reflect the approach used in the US Physician Payments Sunshine Act that compels pharmaceutical and medical device manufacturers to declare transfers of value (including expenses) to physicians or teaching hospitals. The draft legislation reflects concerns that there is insufficient transparency about payments to healthcare professionals and institutions.

The proposals would bring the United Kingdom into line with the United States and many other European countries that have similar rules. The proposals also reflect recommendations in the “First Do No Harm” report of the Independent Medicines and Medical Devices Safety Review published in 2020 and chaired by Baroness Cumberlege that it should be mandatory for pharmaceutical and medical devices companies to report any payments that they make to teaching hospitals, research institutions and individual clinicians.

Currently, pharmaceutical industry associations have codes of practice that require disclosure, but the legislation will put these requirements on a statutory footing.

The draft regulations have not yet been published, and the timing for the new disclosure requirements are unclear. It is also currently unclear how the statutory requirements will affect the current codes on disclosure.

NEW UK INTERNATIONAL DATA TRANSFER PROVISIONS

The UK international data transfer agreement (IDTA) and the UK addendum to the new EU standard contractual clauses (SCCs) (the UK Addendum) came into force on 21 March 2022 following Parliamentary approval.

Both the IDTA and the UK Addendum fully reflect the requirements of the UK General Data Protection Regulation (GDPR) as well as the European Court of Justice judgement in Schrems II and represent a significant improvement from the old EU SCCs (originally drafted under the Data Protection Directive) which were still being relied upon for international transfers from the United Kingdom following Brexit.

The UK GDPR requires companies that transfer personal data from the United Kingdom to a third country that is not considered to offer adequate personal data protection to implement safeguards for the protection of the personal data subject to the transfer. These requirements mirror those under the EU GDPR. Companies within the scope of the UK GDPR will be able to rely on either the IDTA or the UK Addendum to the EU SCCs to meet their safeguarding requirements in respect of international transfers under Article 46 of the UK GDPR.¹ For both the IDTA and the UK Addendum, the governing law will be either (i) England and Wales, (ii) Scotland or (iii) Northern Ireland. The choice of which transfer mechanism to use will depend upon the specific nature of the transfers and jurisdictions involved:

• UK businesses who already implemented the new EU SCCs or international businesses transferring data from both the European Union and United Kingdom will prefer to rely on the UK Addendum.

• Businesses only transferring data from the United Kingdom who have not yet transitioned to the new EU SCCs and do not also transfer data from the European Union may prefer to rely on the IDTA.

For life sciences companies operating on an international scale, the UK Addendum will likely be the preferred way to comply with the UK GDPR, as it can easily be incorporated into existing data processing agreements incorporating the new EU SCCs.

The timeline for businesses within scope of the UK GDPR to transition to the new transfer mechanisms is as follows2:

21 March 2022               Businesses can use either the IDTA or the UK Addendum to the EU SCCs to legitimise international data transfers from the United Kingdom.

21 September 2022     The old EU SCCs can no longer be used in new contracts to cover international data transfers from the United Kingdom.

21 March 2024                All contracts involving the international transfer of data from the United Kingdom will need to incorporate either the IDTA or the UK Addendum.

The IDTA and UK Addendum will not be required for transfers to countries that are considered as providing adequate protection for UK data, which includes all countries part of the European Economic Area, as well as countries covered by existing “adequacy decisions” by the European Union (such as Canada and Switzerland).

The UK’s Information Commissioner’s Office (ICO) has published brief guidance on the IDTA and UK Addendum here. We expect more detailed guidance to be published soon.

WHAT STANDARD OF CARE IN CRO AGREEMENTS?

The recent High Court case of Cardiorentis AG v IQVIA Limited and another (EWHC 250 (Comm) (10 February 2022) (Butcher J)) demonstrates the ever-present risks to contract-research organisations (CROs) and their clients.

The long and highly technical judgment in Cardiorentis, in particular, highlights the necessity for clear, well-drafted and bespoke legal documentation for all parties when outsourcing research to CROs.

In Cardiorentis, Cardiorentis AG engaged IQVIA, a CRO, to conduct clinical trials. After disappointing results, Cardiorentis claimed that IQVIA had committed various failures that resulted in a significant number of ineligible subjects being included in the clinical trial, which made the data unreliable and of little value. IQVIA counterclaimed for unpaid invoices for completed services and withheld access to trial data, which the legal documentation permitted despite also stating that the data was owned by Cardiorentis.

Summary of the claim

The below is a snapshot of Cardiorentis’ claim in the English Courts, leading to a trial lasting almost seven weeks:

• Breach of contract (in particular, the general service agreement (GSA) and the clinical quality agreement (CQA)), including allegations that:

  • IQVIA failed to provide services to the agreed standard of care (which was set by a clause referring to “the standard of care customary in the contract research organization industry” and by section 13 of the Supply of Goods and Services Act 1982).

  • IQVIA failed to meet its contractual obligation to conduct source-document verification for all of the data.

  • The CQA was not  governed by the laws of  England and Wales, but rather by North Carolina law. Cardiorentis further argued that several terms (express and implied) were breached by IQVIA.

• Negligent breach of duty (in relation to the services and representations about the services).

• A claim under the North Carolina Unfair and Deceptive Practices Act.

• A claim for injunctive relief that IQVIA should give Cardiorentis access to the data and information generated in the trial.

Result of the case

• Cardiorentis’ claim for damages failed, but it successfully obtained an injunction that it should have access to data relating to the study.

• The court found that it was not necessary to distinguish between the standard “customary in the contract research organization industry” and a standard of reasonable skill and care. In this case, what was customary was largely set out within the legal documentation.

• The judge concluded that the achievement of 100% source-document verification was not a contractual requirement. Rather, the obligation was subject to the general standard of care and a requirement that it be conducted in a timely manner (no specific timeframe had been agreed).

• The data produced was robust and interpretable despite some deviations from protocols. Moreover, the court concluded that there is no specific number of deviations that make a study unreliable. The negative outcome of the study accurately reflected the effect of the drug.

• The court also provided useful commentary on wasted costs incurred by Cardiorentis on the study and claimed as damages by setting out a “Scientific Community Test”. In brief, costs are not wasted if the study yielded an answer that satisfied the scientific community (and, in practical terms, such an answer would also suffice to satisfy the relevant regulators). In this case, the data was satisfactory, so costs were not wasted.

Lessons learned

Despite the highly technical judgement, what remains abundantly clear is the importance of contracts to provide clarity on the obligations and options for recourse of both parties. Whilst some of the issues were fact-specific and so may not affect future disputes, the dispute nonetheless underlines the wide array of complex issues that can arise when engaging with CROs.

Arbitration: a good option in these cases?

The judgment also provides a detailed description of the parties’ performance of the contract and the product that was the subject of the clinical trial. Given the potentially sensitive information revealed, the question arises of whether the parties would have been better served by referring their dispute to arbitration. By agreeing in their contract to arbitrate any disputes, the parties could have avoided details becoming public, as arbitration is generally confidential and hearings take place behind closed doors.

Other advantages offered by arbitration would be a highly enforceable final award, a more streamlined process with more limited document discovery, and a much shorter—and thus less costly—hearing.

“SPRING STATEMENT” 2022

At the end of March 2022, UK Chancellor Rishi Sunak set out in his Spring Statement the current state of the economy, the outlook for the future and his planned changes to UK tax policy.

His statement contained several pointers regarding the provision and funding of healthcare generally, and possible enhanced incentives for the life sciences industry.

NHS and Healthcare

The 2021 budget saw the Government announce a three-year deal for funding the National Health Service (NHS), a new health and care levy to raise more funding for healthcare services, and capital/infrastructure investments aimed at expanding NHS capacity and contracting-hospital waiting lists.

The Spring Statement has implications for all of these initiatives. The Chancellor confirmed the increase in healthcare spending to £177 billion in 2024/25, while also clarifying that figure is fixed and will not be adjusted to a “real terms” amount, even against the backdrop of increased and increasing inflation. Part of that increased funding was due to come through the new healthcare levy, which in turn would “source” a portion of that money from national insurance revenue. The Chancellor announced changes to national insurance thresholds, which should reduce the amounts raised, and so also the amounts available for the new levy. The spending commitments, however, remain; therefore, funding will need to be sourced from other Government coffers or through the Chancellor’s focus on NHS “productivity and efficiency” increases.

Life Sciences Industry  

Of interest to UK life sciences companies and overseas companies seeking to internationalise their businesses was that section of the statement titled “Ideas”. Perhaps buoyed by the very public success of the UK’s life sciences industry, especially in COVID-19 vaccine research development and production, the Chancellor’s statement focused substantially on science and technology-based businesses and their benefit to the UK economy.

With the aim of ensuring the UK is “globally competitive” in attracting talent and finance for innovative businesses, reference is made to existing “programmes like British Patient Capital, the Future Fund and the Future Fund: Breakthrough”, where “the government has increased access to finance for innovative, high-growth and R&D intensive companies”, and research and development (R&D) tax reliefs which are under review “with the objectives of ensuring the UK remains a competitive location for cutting edge research”.

Following a review last year, tax-relief-qualifying R&D expenditure was expanded to cover data and some cloud-computing costs, while refocusing R&D relief on activity carried out in the UK.  The Statement expanded this so that “[a]ll cloud costs associated with R&D [fall] in the scope of the reliefs”, including “costs related to the storage of vital data, supporting data-heavy research such as genomic sequencing”, and all R&D “underpinned by pure mathematics” is now included, which “will support nascent sectors where the UK has a comparative advantage such as Artificial Intelligence, quantum computing and robotics”.

To come is legislation ensuring that R&D undertaken “overseas” by UK businesses will qualify for tax reliefs “where there is a material or regulatory requirement for this work to be carried out overseas” (e.g., for clinical trials).

The Government will also “consider increasing the generosity of Research and Development Expenditure Credit to boost R&D investment in the UK [to] make RDEC more internationally competitive”.

An ongoing review of the Enterprise Management Incentive (EMI) scheme is to include a consideration of whether “the other discretionary tax-advantaged share scheme, the Company Share Option Plan, should be reformed to support companies as they grow beyond the scope of EMI”.

These matters will be kept under review, as we await developments and as the Government’s “considerations” convert to policy and legislation.

ENDNOTES

[1] Unless the international transfer is otherwise covered by an adequacy decision or other transfer safeguards such as Binding Corporate Rules.

Michaela Novakova and Derek Safadi Contributed to this article