Staffing and scheduling a disclosure package

Preparing a clinical document package for publication runs on a regulator's timeline that leaves little time after the committee opinion, so the work starts well in advance. It takes a company organised for it across functions well beyond medical writing, and the writer's part, at the sponsor or at a contract research organisation, is set within that organisation.

The exchange with the regulator and its timelines

Disclosure runs as a two-stage exchange: a proposal package goes to the regulator, which reviews it, comments, makes recommendations and then asks for the final package, and the final package is the one published. ¹ For the applicant, preparing an anonymised dossier is a labour-intensive, iterative process constricted by strict regulatory timelines. ^{2, 3} Its main steps are the applicant's submission of a redaction proposal document package, consultation between the applicant and the regulatory agencies, submission of the final redacted document package, and publication. ²

The European Medicines Agency's timeline

As EMA Policy 0070 was written, for an initial marketing authorisation application or a line extension under the centralised procedure, the redaction proposal document package is submitted within 30 days before the opinion of the Committee for Medicinal Products for Human Use (CHMP) and 10 days after it, between day 181 and day 220 of the procedure, and the final redacted package is published within 60 days of the Commission decision. ^{4, 5} These timelines apply to initial marketing authorisation applications, line extension applications and extensions of indication, while those for Article 58 applications and withdrawals are set out in the external guidance. ⁶ The process allows a total of 84 calendar days from submission to publication. ⁵ During a consultation of 47 days in total, the agency reviews the anonymisation report, the justification table and the redaction proposal and can seek clarifications, after which the applicant updates the justification table. ⁵ After the agency's redaction conclusion notification, the applicant is expected to submit a redaction consultation agreement within seven calendar days, and it then has 27 calendar days to prepare the final redacted package. ⁵

A 2024 day count of the European exchange also runs to day 84, with the agency's conclusion sent by day 47. ⁷ The redaction proposal package for an initial application is submitted no later than day 30 after the CHMP opinion; the agency's clinical data publication team validates it on days 1 to 10, assesses the commercially confidential information and the anonymisation report and sends its conclusion on days 11 to 47, the applicant responds on the confidential information or accepts the conclusion on days 48 to 54 and responds on the anonymisation report on days 55 to 73, and the final redacted package is submitted and published on days 74 to 84. ⁷ The same 2024 account also counts the process differently, as validation within 10 calendar days of submission, review within a further 60, after which the applicant has 30 calendar days to submit the final redacted documents, with publication on approval. ⁸

On a 2024 timeline for an initial marketing authorisation application or a line extension, the invitation email arrives on procedure day 121, the redaction proposal document package can be uploaded and submitted from day 181, and uploading stays open until 30 days after the CHMP opinion. ^{9, 10} That point is day zero of the clinical data publication process, after which at most 84 days run to the publication deadline, 120 days after the CHMP opinion. ¹⁰ Withdrawals and type II variations run to slightly different timelines. ⁹

The agency's backlog

Between October 2016, when the clinical data publication website went live, and December 2017 the agency published documents for 64 product dossiers, while 337 product dossiers were subject to publication under the policy by December 2017. ^{11, 12} The backlog meant that the timelines defined in the policy did not apply: the agency notified marketing authorisation holders long after the CHMP opinion, and then allowed up to about six months from notification to the due date of the redaction proposal document package, whereas holders of the first dossiers had been given only about two to three months. ^{12, 6} While the backlog lasted, the deadline for the redaction proposal package was the one set in the agency's notification letter, usually several months after the letter, and the documents were published much later than the policy provides, for example more than a year after the Commission decision. ⁴

Teva's first two dossiers under Policy 0070 both received a positive opinion in June 2016. ¹² The larger one was an initial application for a monoclonal antibody, covering six phase 3, four phase 2 and four phase 1 studies in 30 clinical documents and about 29,000 pages, including several old legacy documents without text recognition and clinical study reports built on several different templates and so differently structured. ¹² It was notified in May 2017, its redaction proposal was due in early August 2017 until the agency granted the company's request to defer it to early September, and it was published in April 2018. ¹² The smaller one was an initial application for a combination of two generic substances and a device, covering four phase 1 studies in 9 documents and about 2,500 pages, with two duplicate submissions under different trade names that carried identical sets of clinical documents and needed one proposal package but two final redacted packages. ¹² It was notified in July 2017, its proposal was due in early November 2017, and it was published in February 2018. ¹²

Under the policy, the holder can prepare redaction proposal versions proactively. ⁴ While the backlog lasted, it could instead choose to wait for the agency's notification letter, which is not advisable for a large dossier. ⁴

Health Canada's timeline

Health Canada's exchange ran to a 120-day target from initiation of the process to publication in both 2019 and 2024. ^{5, 13, 8} In 2019 the applicant could request a process initiation meeting at any point from 120 calendar days before the final regulatory decision to 20 days after it, and the redaction proposal package was due within 60 days of a positive decision. ⁵ Health Canada reviewed the package in 30 days and returned the redactions it rejected for revision. ⁵ Revising and finalising them was allocated 25 days: 15 for the applicant's revision, five for Health Canada's reassessment and five for the applicant to submit the finalised documents. ⁵ Publication followed within five days. ⁵ After a negative decision the process could start 31 days later, and where a letter of intent to seek reconsideration was filed it started only after the reconsideration, which takes 70 to 140 days. ⁵

The 2024 day count runs from a process initiation meeting with Health Canada on days 1 to 20, through the applicant's redaction proposal package on days 21 to 60, Health Canada's review on days 61 to 90 and the applicant's response to its comments on the anonymisation report and confidential business information on days 91 to 115, to submission and publication of the final package on days 116 to 120. ^{13, 8} Health Canada gives a further 30 days in the case of a notice of deficiency-withdrawal or of non-compliance, to allow for a reconsideration appeal. ⁸

Japan's timeline

In Japan, the final redacted package is submitted within three months of marketing approval. ⁸

When to start

With so quick a turnaround after the CHMP opinion, work on the package has to be under way well in advance of submission. ^{10, 14} On the timeline of a centralised procedure, one practitioner advises, thinking about anonymisation and disclosure should start with the first trial, when the paediatric investigation starts, because that is where the clinical trials start. ^{15, 16} The end of the procedure is tight, with a redaction proposal to submit and publication due 270 days after submission, so an applicant that thinks about anonymisation proactively from the trial level onwards is in good shape for its marketing authorisation application. ¹⁶

Preparing the company

The stakeholders in disclosing trial summaries and data, in one practitioner's assessment, are everyone involved in planning, evaluation and document preparation, and above all upper management, who must be convinced that the requirements are legally binding and not just suggestions from special interest groups. ¹⁷

The regulatory landscape and the technology that supports disclosure and transparency requirements are evolving rapidly, and effective use of internal and external resources is critical for meeting the requirements and timelines. ⁵ An applicant has to make sure its organisation is ready to deliver anonymised dossiers, and the key steps include understanding the regulatory requirements and anonymisation techniques, assessing internal competencies or commercially available software or both, and establishing the infrastructure to deliver anonymised dossiers on time. ² Because the European and Canadian timelines may require an applicant to prepare the redaction before the health authority has decided, the applicant needs a company-wide readiness strategy for engaging vendor services and for global transparency. ⁵ Such a strategy may include these steps:

• understanding the global transparency regulatory landscape and the anonymisation methods, and educating the key stakeholders in them;
• identifying the members of a transparency committee;
• defining the committee's scope in a charter;
• setting standards for the acceptable re-identification risk thresholds of anonymised packages submitted into the public domain;
• running a feasibility analysis and choosing an anonymisation framework, such as one managed entirely in-house, partly outsourced or completely outsourced;
• vetting and selecting an anonymisation vendor, software and solution;
• writing standard operating procedures for managing anonymisation requests, covering how requests are managed, what is expected of the people reviewing anonymised documents and data sets, standard internal review timelines, how comments are adjudicated, and the point person for the vendor;
• completing vendor procurement in advance, so that the company is ready at dossier submission or on a regulator's request;
• investigating whether information technology can support the software platforms and compliant document and data transfer;
• developing document and data checklists;
• making sure documents and data sets can be reached and transferred quickly;
• improving the process continuously with each anonymised package submitted. ⁵

Automated software is recommended for anonymising dossiers, given their scope and complexity and the need to maintain data utility. ¹⁸ Applicants with many dossiers to anonymise may build in-house capability, with biostatistics and data management customising SAS-based macros, a resource-intensive exercise that should be supported by a transparency team, governed by standard operating procedures and refined continually as regulations and practice change. ¹⁸ Applicants with restricted in-house resources, or who expect only a few dossiers, may therefore outsource the work, and a middle route is to outsource it partly, for example by running a vendor's software platform in-house with the vendor providing consulting support. ¹⁸

Organising the work across functions

Transparency initiatives impose additional and differing obligations on sponsors with regard to scope, format and timelines. ¹⁹ To be compliant, a company needs to establish internal processes and increase its capacity to meet the evolving requirements. ¹⁹ Meeting Policy 0070's requirements needs well-defined cross-functional processes with clearly defined responsibilities. ^{20, 21} The sponsor's first preparatory step is identifying the clinical reports in scope within the dossier and, for clinical trial reports, the sections in scope. ²² Further steps are identifying and protecting commercially confidential information and the personal data of trial participants and of sponsor and non-sponsor personnel. ²² The exchange with the agency starts with the submission of the redaction proposal document package, which may need to be updated in response to the agency's feedback before it is finally submitted and made public. ²²

Protecting personal data and commercially confidential information requires close cross-functional communication and collaboration among all the relevant stakeholders in a company: the relevant internal stakeholders are identified first, and then the responsibilities, interfaces and sequence of interactions are determined and agreed across functions. ^{23, 22} Every functional unit involved has to be trained in Policy 0070's requirements and in its own role and kept informed of changes to the requirements, and the units may include regulatory affairs, medical writing, data transparency, legal and data protection, statistics, programming, publishing and patents, as well as subject-matter experts from many different areas for protecting commercially confidential information. ^{22, 21}

In one example allocation of the dossier-specific tasks, interaction with the agency sits with regulatory affairs. ²⁴ Identifying the reports and the sections in scope for a dossier is shared by regulatory affairs, data transparency and publishing. ²⁴ Developing the anonymisation concept for protected personal data — identifying the categories of identifier the reports contain, assessing each trial's risk level, defining trial- and document-specific anonymisation rules, and weighing data utility — involves medical writing, data transparency, publishing, legal, the data protection officer, and statistics and programming. ²⁴ The same functions other than publishing describe the approach in the anonymisation report. ²⁴ Protecting commercially confidential information — reviewing the clinical reports to identify potential confidential information, checking and confirming that the information is not publicly available, and justifying it in the justification tables — involves medical writing, the subject-matter experts and the patents function. ²⁴ Performing or coordinating the redaction and anonymisation sits with publishing. ²⁴ Incorporating the agency's feedback on the proposal package, where it is required, by updating the anonymisation report, the justification tables and the redaction and anonymisation of the clinical reports, involves every function above except regulatory affairs. ²⁴

Four standing tasks sit outside any one dossier: following regulatory and technical developments related to transparency, which falls to data transparency, medical writing and regulatory affairs; implementing lessons learnt and new or updated requirements in existing processes, which falls to medical writing, data transparency, publishing, regulatory affairs, and statistics and programming; keeping every involved function adequately trained in the evolving regulatory requirements and in its responsibilities under the updated processes, which falls to medical writing, data transparency and publishing; and improving the transparency-readiness of the clinical reports themselves, which falls to medical writing, and statistics and programming. ²⁴ Resources have to be allocated both to the operational dossier work and to oversight of regulatory changes and of scientific and technological developments, to keep company strategies and processes up to date. ^{21, 22} The agency's guidance on implementing Policy 0070, first published in March 2016, had been updated three times by September 2017, each time with major changes that affected which clinical reports were in scope or substantially modified procedural aspects, so established procedures had to be adapted and internal stakeholders retrained. ^{25, 26} The new processes have to be written into standard operating procedures or work instructions, and over time lessons learnt and changes to the guidance have to be implemented in them. ²⁵

Teva's medical writing function was tasked to lead the company's Policy 0070 preparations well before the expected CHMP opinions for its first dossiers under the policy. ²⁶ It engaged a medical writing vendor with Policy 0070 experience and a software tool for finding protected personal data, raised awareness of the policy across a broad cross-functional group, and developed draft redaction rules for personal data from the published guidance with the vendor. ²⁶ In parallel, a dedicated transparency and disclosure team of four full-time equivalents was formed within the medical writing function, and only one of them had prior experience of the policy. ²⁶ Because all the documents had been written without publication in mind, they had to be prepared for publication retrospectively. ²⁶ By the time the notification for the larger dossier arrived, the draft redaction proposals for personal data and a draft anonymisation report were almost complete, but the identification of commercially confidential information had not begun. ²⁶ With no internal procedural guidance available, the team wrote ad hoc process plans, guidance documents and quality control checklists. ²⁶ It took the team's entire workforce to deliver the proposal package for the larger dossier on time, while the small dossier needed substantially fewer in-house resources. ²⁶ The agency's external guidance was revised while the two dossiers were in preparation, so changes in its requirements had to be followed continuously, and uncertainties in interpreting it were clarified through industry associations' webinars, direct interaction with the agency, and discussion with the vendor and other companies. ²⁶ The personal-data steps — finalising the redaction rules, the redaction proposals and the anonymisation reports — were carried out by the transparency and disclosure team in consultation with a legal expert for data protection and a regulatory affairs representative, involving colleagues from clinical development, pharmacovigilance compliance and statistics as needed. ²⁷

Aligning the publication channels

Each further channel for the public disclosure of clinical documents adds complexity to a company's transparency activities. ²³ Besides Policy 0070, ClinicalTrials.gov is a key channel for disclosing clinical trial information. ²³ The channels make different types of clinical data available to different audiences at different points in drug development, and their requirements for publishing documents such as the protocol and the statistical analysis plan can differ greatly. ²³ A selection of the channels that existed in 2018:

Type of clinical data	Channel	Note
Structured results	ClinicalTrials.gov	Together with the protocol and statistical analysis plan for applicable clinical trials
Key findings	Publication in journals	Together with the protocol and statistical analysis plan
Clinical trial synopsis	EU Clinical Trials Register; company website
Clinical trial report, clinical overview and summaries	The agency's clinical data website	As part of dossiers in scope of Policy 0070
Clinical trial protocol	The agency's clinical data website; ClinicalTrials.gov; together with a publication in a journal following the International Committee of Medical Journal Editors (ICMJE) recommendations	As part of clinical trial reports in scope of Policy 0070; on ClinicalTrials.gov, to contextualise the structured results of applicable clinical trials
Trial statistical analysis plan	The agency's clinical data website; ClinicalTrials.gov; together with a publication in a journal following the ICMJE recommendations	As part of clinical trial reports in scope of Policy 0070; on ClinicalTrials.gov, to contextualise the structured results of applicable clinical trials
Other clinical documents	EMA Policy 0043; request via company website	A request via the company website comes with a document sharing agreement

²⁸

To increase efficiency and limit the sponsor's workload, a transparency-ready document should be usable for all the channels, but the time of data sharing differs between them. ²⁹ The protocol and the statistical analysis plan of a trial in scope of Policy 0070 are published on the agency's website at a time linked to the date of the Commission decision or the withdrawal letter. ²³ If the same trial is a so-called applicable clinical trial, they need to be published with the structured results on ClinicalTrials.gov one year after completion of each of three milestones: the primary endpoint, the secondary endpoints and the whole trial. ²³ Their public sharing may also be requested when the results are submitted as a manuscript to a journal that follows the ICMJE recommendations. ^{23, 28} The differing timing may lead to inconsistencies in the type and extent of information needing protection. ²⁹ For commercially confidential information in particular, the relation between the time of release and the degree of protection needed is complex: some initially confidential information may be published during drug development, so the need to protect it usually decreases over time. ²⁹ One approach is to make documents more transparency-ready while they are written, either by limiting cross-references, commercially confidential information and personal data to what standard regulatory review needs, or by identifying confidential information and personal data early and marking them up for later redaction and anonymisation. ²⁹ The time for such efforts appears well spent, as more transparency initiatives are about to be established. ²⁹ With national and international transparency initiatives multiplying, the key challenge for sponsors is to fulfil all the non-aligned requirements and still harmonise the data protection processes for the different publication channels. ²¹ Efficient organisational structures, together with documents made transparency-ready from the start, will provide an efficient approach. ²¹

The writer's part

In a submission, the job is to identify what actually falls within Policy 0070's definitions of commercially confidential information and protected personal data, and this needs to be agreed in advance with the key stakeholders as the redaction strategy for the submission. ³⁰ A writer at a contract research organisation or other vendor may be more likely to help the sponsor define that strategy than a writer inside the sponsor. ³⁰ Writers will need to work with biostatisticians, regulatory advisers, privacy and intellectual property colleagues and key members of the clinical and non-clinical teams to build a predefined anonymisation strategy. ³⁰ They are also quite likely to be involved in producing the anonymisation report. ³⁰ Deciding what is removed from a report is not solely the writer's role but a collaborative review and approval process, so the writer should make sure the support they need is in place. ³¹ A writer at a contract research organisation should check that responsibilities are clearly defined in the contract and consult the company's privacy experts, while a writer inside the sponsor will need input from the group responsible for privacy there. ³¹

Writers have a role in educating reviewers about the need for later redaction and should actively encourage process change, and senior writers should be involved as reviewers in identifying the variables to be anonymised. ³²

Data anonymisation is a complex and new area for writers, and it will require some changes in working practices and the development of new processes. ¹⁷ A writer involved in it must become familiar with its practical aspects. ¹⁷ Developing processes for Policy 0070's requirements needs individuals who become knowledgeable about the relevant guidance and supporting information, and the requirements themselves were thought not to lend themselves to a bullet-point summary. ¹⁷ Keeping up, in one practitioner's view, requires self-education: the European Medical Writers Association's journal, Medical Writing, publishes articles on regulatory public disclosure, and meetings and workshops such as the association's can give a good summary of the main and most relevant points. ^{33, 34}

Anonymisation projects at a contract research organisation

Writers prepare most of the clinical reports that have to be published under Policy 0070 and the Clinical Trials Regulation. ³⁵ Given their data-centricity, efficiency against deadlines, flexibility and commitment to quality, they have taken on the anonymisation of clinical reports, as agreed between sponsors as data controllers and contract research organisations as data processors. ³⁵ Writers need to understand the difference between personal and anonymised data and between working for a data controller and working for a data processor. ³⁶ Even though a multifunctional team is likely to be involved in a task under Policy 0070 or the Regulation, writers working as anonymisation specialists can add significant value. ³⁷

Anonymisation projects have three success factors. ³⁷ One is the writer's expertise: familiarity with the structure and content of the reports, a keen eye for analytical detail, technological agility including familiarity with AI tools, extensive experience of anonymisation techniques and data protection requirements, and an established working relationship with long-term clients. ³⁸ Another is clear communication, which sets clear expectations on scope, timelines, deliverables and specific considerations, supports end-to-end collaboration, lowers the risk of the redaction proposal being rejected, and reduces delays and rework. ³⁹ The third is AI tools, which process large numbers of documents, streamline data handling, shorten timelines and improve accuracy. ⁴⁰

An anonymisation project may start with a kick-off meeting with the client, to understand its requirements, foster trust, orient the stakeholders and set up project standardisation and quality management. ^{37, 41} Before any anonymisation begins, the project-level guidelines on what counts as protected personal data and commercially confidential information in the package should be agreed in writing. ⁴¹ The process runs through these steps:

• holding the kick-off meeting with the client to understand its requirements and expectations;
• defining the project's scope, objectives, timelines and deliverables;
• identifying the stakeholders and their roles;
• assessing the documents and data to be redacted;
• determining the applicable anonymisation guidelines and principles, with personal data and confidential information aligned;
• setting up a project team with assigned responsibilities;
• developing a detailed project plan and timeline;
• applying the anonymisation techniques to remove sensitive and confidential information, with appropriate tools and in line with data privacy regulation and the client's requirements;
• implementing quality control measures to review the anonymised documents;
• verifying the accuracy and completeness of the anonymised information through thorough quality control;
• validating that all sensitive and confidential data is removed or obscured;
• addressing any issues or discrepancies promptly;
• sharing the anonymised documents with the client and then with the health authority for review;
• addressing the client's and the health authority's feedback and incorporating the revisions;
• obtaining the client's approval or confirmation of the health authority's acceptance for the final anonymised documents;
• performing a final review of all the project deliverables;
• archiving the project documentation;
• holding a post-project review, at project closure, to identify lessons learned and areas of improvement. ^{42, 43, 41}

A writer's queries during anonymisation should first be worked through with internal and external anonymisation expertise, best practice and lessons learned, and reviewed internally, before they go to the client. ⁴¹ Clear and prompt communication is crucial. ⁴¹ Documents should be shared for client review through secure channels agreed with the client. ⁴¹ Writers also provide consultancy on the anonymisation process itself. ⁴¹ Quality control verifies the consistency and accuracy of the anonymised information, makes sure the final anonymised text is neither searchable nor editable, and checks metadata, file properties and the overlays marking personal data and confidential information for legibility and clarity. ⁴¹ Contract research organisations increasingly use AI tools to meet tight deadlines, such as responses to requests for information under the Regulation, but manual quality control remains vital for logical consistency and accurate identification of personal data and confidential information. ⁴¹ Every step needs to be documented in a repository, including approval emails, source documents and other relevant correspondence, for future reference and audit readiness. ⁴¹ The work depends on a well-established collaboration between data controller and data processor, with the writer leading the project, confident enough to influence decisions, well organised and thinking ahead. ⁴⁴