Publishing the full plan in the public assessment report
The full EU risk management plan of every centrally authorised product is published in its European public assessment report. Preparing a plan for publication means knowing which of its parts are published, reviewing and redacting it for protected personal data and commercially confidential information, settling who decides what is confidential, and producing the published version from the approved plan.
What is published
Since 20 October 2023, for all centrally authorised products in the EU, the European Medicines Agency has been publishing full risk management plans, both initial evaluations and post-marketing updates, in European public assessment reports. This publication aims to further increase the transparency of safety information for the public, and it replaces publication of the risk management plan summary for the public, Part VI. The published plan is a single PDF file of the main body, annex 4 (follow-up questionnaires for specific adverse events) and annex 6 (key messages of additional risk minimisation measures). For publication, the plan has to be reviewed to identify potential protected personal data and commercially confidential information for redaction, and the marketing authorisation holder submits its proposals for redacting them. All changes are editorial and are implemented in the plan during the scientific review that precedes the opinion and the adoption of the final plan. At the time of the public assessment report's update, the redacted plan is published on the agency's website, on the product's page.
The redaction process
One patient safety writing group used to handle third-party requests for plans by reviewing them ad hoc, at the agency's request, and redacting them manually outside its document management system. Because the new requirement applies to all initial evaluations and post-marketing updates, the group considered that a dedicated process, covering everything from front-loading the work to creating redacted plans inside the system, would increase its efficiency. That group has taken over responsibility for redacting plans, and its process runs as follows:
- In general, for initial plans and updates, the safety writer front-loads the work and advises the product team not to include content that could potentially hold personal data or confidential information, to reduce redaction efforts later. The plan's review should also cover identifying personal data and confidential information, so that a submitted plan is ideally already anonymised and nothing needs redacting later.
- When the agency's requirement applies, the global regulatory lead requests the published version. If there was no redaction-specific review while the plan was prepared, which could be the case for existing plans with very tight timelines for the update, the safety writer coordinates one within the timelines given. Even if no content needs redacting, there may be standard items to redact, such as post-marketing exposure by country in module SV, which is considered confidential.
- Before redactions are applied, a copy of the submitted plan is saved in the document management system as the pre-redacted version, in which the safety writer marks the proposed redactions in red rectangles.
- The document specialist creates the published version in the system from the latest approved plan according to the agency's requirements, with the main body, annex 4 and annex 6, an adjusted table of contents and sequential page numbering. The redactions proposed in the pre-redacted version are implemented in it.
- Both versions, pre-redacted and redacted, are reviewed by the document specialist and the safety writer, e-approved by the EU qualified person for pharmacovigilance, and submitted to the agency by the global regulatory lead.
Every initial or updated plan submitted to the agency for a centrally authorised product needs a redacted version in addition, and thanks to the group's structure this additional workload has been spread across two functions, the safety writers and the document specialists.
What counts as confidential
The agency's guidance gives examples of protected personal data and commercially confidential information in plans, as well as rules for anonymisation. In general a plan is not expected to include either personal data, meaning information at the level of a trial participant or patient, or confidential information, but plans submitted before October 2023 might need redaction. The safety writer reviews the plan according to the guidance and marks any personal data and confidential information for redaction. Confidential information in particular may need content review by specific functions, because a plan might include detailed information on ongoing clinical trials, or unpublished data with an impact on future clinical development, manufacturing or regulatory strategies. The safety writer's pre-reviewed draft is therefore shared with the plan's authoring team, which the writing group has trained on the requirement.
In case of doubt about what to redact, the ultimate responsibility lies with the lead safety physician, and the safety writer advises from the guidance and from experience with the agency. In one case, medical colleagues proposed extensive redactions of clinical data, and pharmacovigilance colleagues proposed a reworded sentence to replace redacted information. The group knew that the agency would not accept extensive blackening and rewording and that all changes to the plan should be editorial only, and after discussion with the lead safety physician it made the final decision and communicated it to the team.
Patent review was part of the first plan reviews, while the teams were gathering experience of what might be confidential. That experience showed that most information in plans is either already shared through clinical documents under Policy 0070 or published, so the standard process does not require involving patent or legal functions. The authoring team is usually asked whether it considers involving patent or legal functions necessary. In the group's experience, it does not make sense to involve them routinely in reviewing the complete plan, and it makes more sense to ask them specific questions on selected sections or paragraphs, if required.
Producing the published version
In the group's process, a published version is created even when there are no redaction proposals, because it is an agency requirement and is submitted for publication whether or not it contains content redactions. At a minimum, the "Confidential" marks or other confidentiality statements in the document's headers and footers are redacted. When the published version is created in the document management system, those statements and selected appendices are removed automatically, and the table of contents and page numbering are adapted to include annexes 4 and 6 only. The published version could be prepared manually, but for the group's company, which submits a high volume of plan updates, the process in the system is more efficient and less error-prone. The system generates an output ready for publication, so nobody has to remove the "Confidential" statements from the headers and footers or the appendices not intended for publication by hand, or adapt the table of contents and page numbering. Both solutions are valid, and in the group's experience both seem to be accepted by the agency. Timelines for submitting published versions can be short, however, and with many submission documents to finalise, the process in the system saves time and resources. Because the published version is a new version of the latest approved plan in the document management system, it cannot technically be prepared in parallel with the plan and can only be created after the submission plan has been e-approved and archived. In the only couple of instances where it had to be provided shortly after the plan's submission, this was challenging but worked, and having the process in the system helped gain time.
Lessons learnt so far
Companies and the agency are still learning and gathering experience with the requirement, and the lessons learnt so far are these:
- The group's output from its document management system is well accepted by the agency, but scanned plans and plans with no bookmarks have also been published.
- The group holds that the best approach is to create new plans and updates in an anonymised way and to front-load the redaction review, to reduce efforts later, when time is tight.
- If in doubt when applying the agency's guidance, common sense will help.
- Even with a process and a technical solution, the group keeps the flexibility to prepare a published version manually, with no adapted table of contents and page numbering, if needed.
- The group's process in its system addresses the requirement efficiently whatever the timelines, which may vary with the regulatory procedure or variation.
- The agency also seems to be still learning: in one procedure it asked for a redacted version plus a version highlighting the proposed redactions.