> Riverside Center Suite 3-120 • 275 Grove Street • Auburndale MA 02466\
> Tel 617 244 1200 • Fax 617 244 9669 • AlecWalker@Epidemiology.com
> [www.ingenix.com](http://www.ingenix.com/)

Dockets Management Branch (HFA-305)

Food and Drug Administration

5630 Fishers Lane, Rm 1061

Rockville, MD 20852

RE: Docket Number 02N-0528

Comments on Lines 243-246 of: Concept Paper: Risk Assessment of
Observational Data: Good Pharmacovigilance Practices and
Pharmacoepidemiologic Assessment, CDER/FDA, March 3, 2003

Dear FDA Colleagues:

We at Ingenix Epidemiology applaud FDA's current initiatives in
promoting public discussion of pharmacoepidemiologic practice. We have
long been dedicated to scientific investigation in the service of drug
safety, and we share many of FDA's concerns for scientific quality and
patient protection. However, as practitioners of epidemiology, we wish
to comment on elements of the above-cited concept paper that might have
unintended consequences if published unchanged in a guidance document.

Comments on Lines 243-246 of: Concept Paper: Risk Assessment of
Observational Data: Good Pharmacovigilance Practices and
Pharmacoepidemiologic Assessment, CDER/FDA, March 3, 2003

# Executive Summary

-   Lines 243-246 appear to require informed consent for all
    pharmacoepidemiologic studies.

-   This requirement is more restrictive than DHHS regulations now
    mandated under HIPAA.

-   If applied, this requirement would require FDA, rather than IRBs and
    Privacy Boards, to grant any waivers of authorization for
    pharmacoepidemiology studies required by FDA.

-   We urge that FDA not to impose restrictions or mechanisms for
    privacy beyond those specified in the HIPAA-mandated DHHS Privacy
    Rule.

# Discussion

After this concept paper was written, the April 14, 2003 deadline for
compliance with the Department of Health and Human Services' Privacy
Rule occurred. The Privacy Rule is a set of standards to protect
individually identifiable health information - Personal Health
Information (PHI). This final regulation is embodied in the in 45 CFR
Part 160 and 45 CFR Part 164, subparts A and E, and was issued as
mandated by the Health Insurance Portability and Accountability Act of
1996 (HIPAA) (Public Law 104-191).

The final regulation specifies in detail the mechanisms for assuring
privacy of PHI used for research purposes. There are three:

1.  Use of de-identified data exclusively (no PHI)

2.  Use of PHI solely to prepare a research protocol

3.  Use of PHI under a waiver from an IRB or Privacy Board

The conditions for waivers and the protocol exception are clearly set
forth in the regulation.[^1]

In pharmacoepidemiologic studies based on automated claims databases,
validation through review of a sample of medical records is essential.
(See lines 182-184 of this concept paper). Such validation necessarily
involves access to medical records with PHI. Therefore, in order to
comply with the HIPAA-mandated Privacy Rule, validation of claims data
can be accomplished using a waiver of authorization from an IRB or
Privacy Board.

An FDA requirement for authorization in all cases is more stringent than
the HIPAA requirement. It would compromise the feasibility and validity
of claims-based studies for the following reasons:

1.  Relatively short periods of enrollment may sever the relationship
    through which consent is obtained. This is a particular problem for
    retrospective studies.

2.  Obtaining individual consent could create a selection bias of
    unknown direction and magnitude

3.  Physicians and other stakeholders might eventually refuse repeated
    requests to seek consent for patients in the same claims database

4.  The power of studies might be reduced below acceptable levels,
    particularly in the case of rare adverse events.

Other pharmacoepidemiologic activities, such as simple counts of the
number of dispensings of a particular drug, could be performed with
de-identified data. These studies would then not require a waiver.

We therefore urge the FDA to alter the language of lines 239-246 so as
to:

1.  Separate issues of human subjects protection from those of privacy

2.  Specify compliance with both the Privacy Rule and the Rule for
    Protection of Human Subjects, citing both regulations explicitly.

3.  Remove the specific FDA requirement for informed consent, which goes
    beyond the requirements of HIPAA and would put FDA itself in the
    position of adjudicating waivers

We thank you for the opportunity to comment on this concept paper, and
welcome the public dialog that it has engendered. Should you have any
questions about our comments, we would be happy to discuss them.

Sincerely,

Alexander M. Walker MD, DrPH

Senior Vice President for Epidemiology

Kay Patterson MD, MS, MPH

Epidemiologist

[^1]: <http://aspe.hhs.gov/admnsimp/final/pvcguide1.htm>