[Federal Register Volume 60, Number 63 (Monday, April 3, 1995)]
[Rules and Regulations]
[Pages 16962-16968]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 95-8066]




[[Page 16961]]

_______________________________________________________________________

Part III





Department of Health and Human Services





_______________________________________________________________________



Food and Drug Administration



_______________________________________________________________________



21 CFR Part 20



Protecting the Identities of Reporters of Adverse Events and Patients; 
Preemption of Disclosure Rules; Final Rule

Federal Register / Vol. 60, No. 63 / Monday, April 3, 1995 / Rules 
and Regulations 
[[Page 16962]] 

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Food and Drug Administration

21 CFR Part 20

[Docket No. 93N-0334]


Protecting the Identities of Reporters of Adverse Events and 
Patients; Preemption of Disclosure Rules

AGENCY: Food and Drug Administration, HHS.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: The Food and Drug Administration (FDA) is amending its public 
information regulations to help ensure that the identities of those who 
report adverse events associated with human drugs, biologics, and 
medical devices, and the identities of patients are held in confidence 
and not disclosed by FDA or by manufacturers that possess these 
reports. This final rule preempts the establishment or continuation in 
effect of any State or local law, rule, regulation, or other 
requirement that requires or permits disclosure of such identities. 
This action is being taken to maintain the agency's ability to collect 
information about safety risks of FDA-regulated products and is vital 
to the protection of the public health.

DATES: This final rule will become effective on July 3, 1995.

FOR FURTHER INFORMATION CONTACT: Philip L. Chao, Office of Policy (HF-
23), Food and Drug Administration, 5600 Fishers Lane, Rockville, MD 
20857, 301-443-2831.

SUPPLEMENTARY INFORMATION: 

I. Background

    In the Federal Register of June 3, 1993 (58 FR 31596), FDA 
announced the availability of a new form for reporting adverse events 
and product problems associated with human drug products, biological 
products, medical devices, and other FDA-regulated products. The new 
form was part of MedWatch, FDA's new Medical Products Reporting 
Program, which is intended to facilitate the reporting of adverse 
events and product problems for all FDA-regulated products by the 
entire health care community (manufacturers, distributors, user 
facilities, and health care professionals).
    The MedWatch program features two versions of the form for 
reporting adverse events and product problems. One version, FDA Form 
3500A, is used by manufacturers, distributors, and user facilities to 
report adverse events as required under Federal statutes or FDA 
regulations. The other version, FDA Form 3500, is available for use by 
health professionals, such as physicians, physician assistants, 
pharmacists, and nurses, for voluntary reporting.
    FDA uses adverse event reports from health professionals and 
industry to identify possible problems in marketed products. Based on 
the reports, the agency evaluates the seriousness of the health hazard, 
takes corrective action if necessary, and communicates that action to 
the health professional community. Corrective action can be in the form 
of labeling changes, such as the addition of new precautions, boxed 
warnings for serious hazards, and product recalls or withdrawals. FDA 
may also elect to notify health professionals, industry, and others of 
important information through Medical Alerts, Safety Alerts (for 
medical devices), the FDA Medical Bulletin, and ``Dear Doctor'' or 
``Dear Health Professional'' letters.
    The success of the MedWatch program depends in large part on 
voluntary reporting of adverse events from health professionals, either 
directly to the agency or to other entities who report to the agency. 
As stated in the preamble to the proposed rule of January 27, 1994 (59 
FR 3944) (the January 1994 proposal), voluntary reporting has revealed 
significant adverse events and drug interactions associated with 
products that could not be identified during preapproval testing. For 
example, voluntary reporting contributed to the removal of the 
antibiotic temafloxacin (Omniflox) from the market and to the 
development of warning labeling for latex products. Voluntary reporting 
also led to research concerning the danger of concurrent use of the 
antihistamine terfenadine (Seldane) when taken with either the 
antifungal ketoconazole or the antibiotic erythromycin.
    To ensure meaningful reporting under the MedWatch program, the 
agency proposed to enhance safeguards for protecting the identities of 
persons who voluntarily submit adverse event reports, as well as the 
identities of the patients experiencing those adverse events, to FDA 
and to manufacturers (59 FR 3944 at 3946 to 3947). The January 1994 
proposal would also protect the voluntary reporting system through a 
regulation that preempts the establishment or continuation in effect of 
any State or local law, rule, regulation, or other requirement that 
requires or permits disclosure of such identities.
    This document makes final the requirements published in the January 
1994 proposal.

II. Comments on the Proposed Rule

    FDA received 31 comments on the January 1994 proposal. In general, 
the comments supported the proposed rule, although some comments 
suggested expanding the rule to include mandatory adverse event 
reports, and other comments sought additional protection from 
disclosure.

A. General Comments

    1. Three comments suggested that FDA revise the rule to prevent 
persons who receive adverse event reports from disclosing those reports 
to other parties. The comments noted that the proposed rule was silent 
on such disclosures.
    FDA declines to accept the comments' suggestion. The agency notes 
that, under the rule, persons receiving adverse event reports would be 
those who have obtained consent to disclosure under Sec. 20.63(f)(1)(i) 
(21 CFR 20.63(f)(1)(i)), are engaged in medical malpractice litigation 
involving the voluntary reporter (Sec. 20.63(f)(1)(ii)), or have 
requested disclosure under Sec. 20.63(f)(1)(iii). Consequently, a 
person receiving the adverse event report under this rule would either 
have obtained consent for the disclosure from both the voluntary 
reporter and subject, or, in the case of medical malpractice 
litigation, already would have disclosed, through court documents, 
information surrounding the adverse event.
    FDA has amended the rule, however, to state that voluntary reports 
that are made available to the subject of an adverse event under 
Sec. 20.63(f)(1)(iii) will not include the names of any other 
individuals, including that of the voluntary reporter. This change 
provides further protection against disclosure in the small number of 
circumstances where the voluntary reporter is not a physician or health 
care professional known to the patient. FDA believes this clarification 
will encourage adverse event reporting and does not deny critical 
information to the subject of the report because the subject will 
ordinarily know the name of the physician who has performed the 
procedure or prescribed medication.
    2. One comment would revise the rule by adding a new paragraph to 
declare that the production of adverse event reports containing 
identifying information, during the discovery phase in litigation, does 
not constitute ``disclosure'' under the rule if all parties to the 
litigation agree that the party receiving the adverse event report will 
not record the identifying information, will not attempt to contact the 
persons identified in the report, and will remove identifying 
information from any [[Page 16963]] adverse event report that the party 
copies.
    FDA declines to amend the rule as suggested by the comment. The 
mechanism described by the comment would be inappropriate due to wide 
variations among state court procedures, and the resulting 
inconsistencies in applying such a mechanism would discourage, rather 
than encourage, health care professionals from reporting adverse 
events. The intent of the rule is to ensure that individuals who are 
not the reporters or other persons identified in the reports do not 
have access in any way to the identifying information, except in 
specifically described circumstances. Allowing such individuals to view 
the identifying information in the context of discovery would not 
achieve this purpose and would discourage voluntary reporting.
    3. One comment said FDA should seek statutory changes to prevent 
the release of information in addition to issuing a rule.
    The agency disagrees that statutory changes are necessary. As 
stated in the preamble to the January 1994 proposal and elsewhere in 
this document, FDA believes it has sufficient legal authority to 
preempt State and local laws, rules, regulations, and other 
requirements that would permit or require the disclosure of the 
identities of health care professionals who voluntarily report adverse 
events and the patients or other individuals named in those reports. 
Although Congress did not expressly preempt State law in this area, the 
agency finds Federal preemption to be appropriate because such State or 
local laws, rules, regulations, or other requirements would impede 
FDA's ability to monitor product safety after approval to ensure that 
human drug products, biologics, and medical devices are safe and 
effective for their intended uses. (See 59 FR 3944 at 3948 to 3949). 
Thus, under principles of preemption law, congressional intent to 
preempt State law can be inferred.
    4. One comment focused on nuclear medicine and said that FDA should 
not disclose adverse event reports to the Nuclear Regulatory Commission 
(NRC) because NRC publishes reports of ``misadventure,'' and such 
reports often include the physician's and patient's names. The comment 
said that FDA should assume sole jurisdiction over nuclear medicine.
    FDA declines to accept the comment. The agency notes that current 
regulations (21 CFR 20.85) already establish conditions on disclosures 
to other Federal government departments and agencies and that ``[a]ny 
disclosure * * * shall be pursuant to a written agreement that the 
record shall not be further disclosed by the other department or agency 
except with the written permission of the Food and Drug 
Administration.'' As for assuming sole jurisdiction over nuclear 
medicine, the issue of NRC and FDA jurisdiction goes beyond the scope 
of this rulemaking.
    5. One comment asserted that the rule would actually make more 
information available to the public because it would make an entire 
adverse event report available. The comment claimed that such 
disclosure would be contrary to the goal of protecting confidentiality 
and recommended that FDA instead expand Sec. 20.111 (21 CFR 20.111), 
pertaining to data and information submitted voluntarily to FDA, to 
protect adverse event reports held by manufacturers from disclosure and 
to preempt State and local laws and regulations.
    FDA believes the comment misinterprets the rule. Section 20.111 
describes the types of data and information submitted voluntarily to 
FDA that are available for public disclosure. In general, under 
Sec. 20.111(c)(3), adverse reaction reports, product experience 
reports, consumer complaints, and ``other similar data and 
information'' shall be disclosed except for certain identifying 
information. The identifying information that is deleted from the 
record varies, depending on whether the information was submitted by a 
consumer, the product's manufacturer, or a third party. For example, if 
a consumer submitted the record, the agency would not disclose the 
identity of the consumer. If a manufacturer submitted the record, the 
agency would not disclose the identity of the person using the product 
or any third party involved in the report or the manufacturer's 
identity. (See Sec. 20.111(c)(3)(i) through (c)(3)(iii)).
    In contrast, Sec. 20.63 establishes exemptions from disclosure 
requirements. These exemptions are to be read in conjunction with any 
conditions imposed under Sec. 20.111. Specifically, Sec. 20.63(f) would 
authorize the agency and manufacturers possessing adverse event reports 
to withhold the names of voluntary reporters and other persons 
identified in such reports, regardless of whether a consumer, 
manufacturer, or other party submitted a voluntary report.
    Furthermore, Sec. 20.63(f) permits identities to be disclosed under 
three limited exceptions: (1) The voluntary reporter and the person 
identified in the report (or the person's legal representative) 
consent, in writing, to disclosure; (2) a court orders disclosure 
during medical malpractice litigation involving the voluntary reporter 
and the person experiencing the adverse event; and (3) the individual 
who is the subject of the report requests the report. These exceptions 
are reasonable and practical because it would make little sense to 
withhold the identities of the parties named in an adverse event report 
if those same parties consent to disclosure or are engaged in 
litigation or, in cases where the party requesting the report was the 
subject of the report, must already be aware that he or she is 
identified in a report.
    Thus, while the final rule arguably discloses more information (in 
the form of identifying information) than Sec. 20.111, that additional 
information is disclosed to persons who either submitted the voluntary 
report, have consented to disclosure, or know that a report pertaining 
to their own adverse experience exists. Furthermore, while Sec. 20.111 
describes data and information that are available for disclosure, 
Sec. 20.63(f) establishes exemptions to disclosure. A preemption 
provision, which essentially establishes another exception to 
disclosure, would be more appropriate in Sec. 20.63.
    6. The January 1994 proposal referred to voluntary reporters 
submitting adverse event reports. Proposed Sec. 20.63(f) also stated 
that it did not affect disclosure of the identities of reporters 
required by statute or regulation to make adverse event reports and 
that disclosure of identities of such reporters would be ``governed by 
the applicable statutes and regulations.'' Seven comments asked FDA to 
expand the rule to include mandatory adverse event reports required by 
the Safe Medical Devices Act or other statutes. The comments said that 
persons who are required to submit adverse event reports should enjoy 
the same protection offered by the rule to those who voluntarily submit 
reports. One comment even claimed that, under the rule, voluntary 
reports enjoyed greater protection than mandatory reports, and this 
difference could deter compliance with mandatory adverse event 
reporting requirements.
    The agency does not believe it can or should expand the rule as 
requested by these comments. The policy and final rule are intended to 
protect voluntary reporting. FDA assumes that those subject to 
mandatory reporting requirements established by Congress or by Federal 
regulation comply with those requirements and will continue to do so. 
The agency also notes that different standards for treatment of 
disclosure of required and voluntary information is an established part 
of disclosure law. [[Page 16964]] (See Critical Mass Energy Project v. 
NRC, 644 F.Supp. 344 (D.D.C. 1986), vacated and remanded, 830 F.2d 278 
(D.C. Cir. 1987), summary judgment granted, 731 F.Supp. 554 (D.D.C. 
1990), rev'd & remanded, 931 F.2d 939 (D.C. Cir. 1991), vacated & reh'g 
en banc granted, 942 F.2d 799 (D.C. Cir. 1991), vacated, 975 F.2d 871 
(D.C. Cir. 1992) (en banc), cert. denied, 113 S.Ct. 1579 (1993).)

B. Comments on Specific Provisions in the Proposal

    7. Proposed Sec. 20.63(f) would prohibit disclosure of the names 
and any identifying information, including the reporter's address or 
the name or address of the reporter's institution, that would lead to 
the identification of the reporter or the persons named in a voluntary 
adverse event report, by FDA or by a manufacturer possessing such 
reports in response to any request.
    Four comments would amend Sec. 20.63(f) to prohibit adverse event 
reports from being admissible into evidence unless the facility, 
individual, or physician who made the report knew that the report 
contained false information. The comments said such a prohibition would 
be consistent with section 519(b)(3) of the Federal Food, Drug, and 
Cosmetic Act (the act) (21 U.S.C. 360i(b)(3)) regarding mandatory 
reports from device user facilities.
    The agency declines to accept the comments' suggestion. In general, 
Sec. 20.63(f) is intended to protect against the disclosure of 
information that would identify a voluntary reporter or a person who 
may have experienced an adverse event. This policy is designed to 
encourage voluntary adverse event reporting by health care 
professionals and others. The agency's policy regarding disclosure of 
voluntarily submitted adverse event reports has been, and continues to 
be, that such reports are publicly available after deletion of 
identifying information. (See Sec. 20.111(c); see also 39 FR 44602 at 
44628 to 44629, December 24, 1974 (rejecting comments seeking to limit 
dissemination of adverse reaction reports and consumer complaints).) 
This is consistent with the agency's obligations under the Freedom of 
Information Act, and the agency, therefore, declines to revise the rule 
to limit disclosure of adverse event reports.
    8. Two comments would expand Sec. 20.63(f) to include demands and 
orders to disclose adverse event reports. The comments explained that a 
person seeking an adverse event report could do so by request to the 
agency or manufacturer or, in other contexts, demand or seek a judicial 
order requiring the agency or manufacturer to provide the reports.
    FDA agrees and has modified the rule accordingly.
    9. As noted earlier, proposed Sec. 20.63(f) would not affect 
disclosure of the identities of reporters required by statute or 
regulation to make adverse event reports and expressly stated that 
disclosure of the identities of such reporters ``is governed by the 
applicable statutes and regulations.'' Three comments suggested that 
FDA modify Sec. 20.63(f) to refer to ``federal statutes and 
regulations'' because, as written, the rule could arguably be 
interpreted as being inapplicable to disclosures required by State law 
or regulation.
    FDA agrees and has modified the rule accordingly.
    10. One comment asked FDA to clarify the rule's relationship to 
existing FDA regulations governing information exchanges between the 
agency and manufacturers.
    The rule does not affect information exchanges between FDA and 
manufacturers. Nor does the rule alter or diminish any regulatory 
requirements for manufacturers regarding submission of adverse event 
reports. The rule is directed to requests by third parties for adverse 
event reports.
    11. The proposed rule created three exceptions to the policy 
against disclosing the identities of the voluntary reporter and the 
person who experienced the adverse event. Proposed Sec. 20.63(f)(1)(i) 
contained the first exception and would allow the identities to be 
disclosed if both the voluntary reporter and the person identified in 
the report (or that person's legal representative) consented, in 
writing, to disclosure.
    Two comments requested that FDA modify or delete the provision. The 
comments asserted that the provision could prompt third parties to 
request or demand that FDA or a manufacturer seek consent from the 
voluntary reporter or the person identified in the report because the 
agency and the manufacturer would know their identities. The comments 
would either delete the provision or modify the rule to contain a 
specific prohibition against courts and State agencies seeking to have 
FDA or manufacturers obtain consent from the voluntary reporter or 
patient.
    In response to these comments, FDA has amended Sec. 20.63(f)(1)(i) 
to state that the agency and manufacturers shall not be required to 
seek consent on behalf of requesters. As stated in Sec. 20.63(f) and 
also in Sec. 20.111, the identities of the voluntary reporter and any 
other person named in an adverse event report shall not be disclosed by 
FDA or by manufacturers except in limited situations. If third parties 
could request or demand that FDA or manufacturers seek consent from the 
voluntary reporter and/or person named in the report, the practical 
effect would be to eliminate the protection given by FDA's regulations. 
In addition, the administrative burden of such procedures, in response 
to third party requests, would detract from agency resources devoted to 
investigation and assessment of adverse event reports. Consequently, 
FDA has not in the past and will not entertain such requests, and the 
burden of seeking consent from the voluntary reporter and the person 
identified in the adverse event report will continue to rest on the 
party requesting the adverse event report and identifying information.
    12. Proposed Sec. 20.63(f)(1)(ii) would permit disclosure of the 
identities of the voluntary reporter and a person named in an adverse 
event report ``pursuant to a court order in the course of medical 
malpractice litigation involving both the person who experienced the 
reported adverse event and the voluntary reporter.''
    Three comments would delete Sec. 20.63(f)(1)(ii). According to the 
comments, the provision would encourage plaintiffs to name multiple 
defendants in medical malpractice cases in order to obtain the 
identities of persons in an adverse event report.
    FDA declines to delete the provision as requested. The agency does 
not share the comments' underlying assumption that the possible 
existence of a voluntary adverse event report will prompt plaintiffs to 
bring a malpractice suit against every person who might have submitted 
a voluntary adverse event report, especially when the only information 
that the plaintiff would gain, under Sec. 20.63(f)(1)(ii), would be his 
or her own name and the name of the voluntary reporter. If a plaintiff 
did engage in such tactics, some jurisdictions might consider it to 
constitute an abuse of process and impose sanctions against the 
plaintiff or the plaintiff's attorneys.
    FDA also notes that if a plaintiff knew that a report specific to 
his or her adverse event existed, the plaintiff would obtain more 
substantive information regarding the adverse event under 
Sec. 20.63(f)(1)(iii).
    13. One comment would delete Sec. 20.63(f)(1)(ii). The comment 
stated that Sec. 20.63(f)(1)(ii) was unnecessary because a person who 
experienced an adverse event could obtain a copy of the 
[[Page 16965]] adverse event report under Sec. 20.63(f)(1)(iii).
    The agency disagrees with the comment. The two provisions serve 
different purposes. Many adverse event reports contain little or no 
identifying information about the person who experienced the reported 
adverse event, and the person who experienced the adverse event may be 
unaware that he or she had been the subject of an adverse event report. 
Thus, under Sec. 20.63(f)(1)(ii), if a person who experienced an 
adverse event were engaged in medical malpractice litigation, he or she 
could seek a court order to obtain identifying information, and thus 
determine whether he or she had been the subject of an adverse event 
report. In contrast, Sec. 20.63(f)(1)(iii) presumes that the individual 
requesting a report already knows that a report exists and that the 
individual is ``the subject of the report.''
    14. Two comments sought clarification of Sec. 20.63(f)(1)(ii), 
particularly the ``identities'' that would be disclosed. The comments 
indicated that Sec. 20.63(f)(1)(ii) could be interpreted as permitting 
disclosure of the identities of all persons experiencing an adverse 
event who were named in a report by the voluntary reporter. The 
comments suggested revising the provision to limit disclosure to the 
identities of the voluntary reporter and the person experiencing the 
adverse report provided that both were parties in the malpractice 
litigation.
    FDA agrees that the identities of persons who experienced an 
adverse event but are not parties to the medical malpractice litigation 
should not be disclosed and has revised the rule accordingly.
    15. Proposed Sec. 20.63(f)(1)(iii) would permit disclosure of a 
voluntarily-submitted adverse event report to an individual who is the 
subject of the report.
    One comment would modify the provision to require notice to the 
voluntary reporter.
    FDA believes that an individual who is the subject of an adverse 
event report should be entitled to the report without prior notice to 
the voluntary reporter. Additionally, providing notice to the voluntary 
reporter would confer little benefit because there is no mechanism to 
allow the voluntary reporter to withdraw or amend a voluntarily 
submitted adverse event report once it has been submitted. Furthermore, 
as stated above, the suggested change is unnecessary in light of the 
agency's revision to the rule, which clarifies that the report will be 
disclosed to the subject of the report without inclusion of any other 
names, including that of the voluntary reporter.
    16. One comment would make reports inadmissible as evidence unless 
the facility or reporter knew that the information contained in the 
report was false. Another comment would revise Sec. 20.63(f)(1)(iii) to 
state that, ``The report shall be disclosed to the individual who is 
the subject of the report upon request in any litigation regarding the 
adverse event referred to in the report and in which the individual is 
a party.'' The comment asserted that manufacturers should not have to 
assume the burden of responding to a potentially large number of 
requests from patients for adverse event reports.
    FDA disagrees with the comments. As stated above, the agency 
believes that an individual who is the subject of an adverse event 
report should be entitled to the report itself. Such access to the 
report should not be conditioned on the existence of false information 
in the report or on litigation.
    17. One comment would revise Sec. 20.63(f)(1)(iii) to state that, 
``The report, but not the identity of the voluntary reporter or of any 
other person named in the report, shall be disclosed to the individual 
who is the subject of the report upon request.'' The comment claimed 
that this change would be consistent with the protection of identities 
under Sec. 20.63(f)(1)(i) and (f)(1)(ii).
    The agency agrees with the comment and has amended the rule to 
state that the report will exclude the identities of other persons. As 
mentioned earlier, this additional protection for the voluntary 
reporter is unlikely to limit the information available to most 
subjects of adverse event reports because they are likely to know 
already the identity of the voluntary reporter. FDA agrees that the 
identities of any other persons named in the report should also be 
protected in order to maintain their privacy or preserve the 
confidentiality of any relationships between the voluntary reporter and 
other persons. Therefore, the agency has revised Sec. 20.63(f)(1)(iii) 
to exclude the identities of any other person, aside from the person 
requesting the report, named in an adverse event report.

III. Descriptiom of the Final Rule

    The final rule creates a new Sec. 20.63(f) to prevent FDA and 
manufacturers of human drug products, biologics, or medical devices 
from disclosing the names and any information that would identify the 
voluntary reporter or any other person named in a voluntarily-submitted 
adverse event report. The rule interprets ``information'' as including 
``the name, address, institution, or any other information that would 
lead to the identities of the reporter or person identified in the 
report.'' The rule does not apply to the identities of reporters 
required by statutes (such as the Safe Medical Devices Act or the 
National Childhood Vaccine Injury Act) to submit reports to FDA and 
does not alter any disclosure requirements under those statutes.
    The final rule also creates three exceptions to the prohibition 
against disclosure. Under Sec. 20.63(f)(1)(i), the identities may be 
disclosed to a third party if both the voluntary reporter and the 
person who is identified in the report consent, in writing, to 
disclosure. As stated above, persons who seek disclosure of such 
identities have the burden of obtaining consent; the agency will not 
seek such consent itself. Under Sec. 20.63(f)(1)(ii), identities may be 
disclosed pursuant to a court order in the course of medical 
malpractice litigation involving both the person who experienced the 
adverse event and the voluntary reporter. Section 20.63(f)(1)(iii) 
would make the report, except for the identities of any other persons 
identified in the report, available to the individual who is the 
subject of the report, upon request.
    Section 20.63(f)(2) preempts the establishment or continuation in 
effect of any State or local law, rule, regulation, or other 
requirement that permits or requires disclosure of the identities of 
the voluntary reporter or other person identified in an adverse event 
report, except as otherwise provided by Sec. 20.63(f)(1).

IV. Legal Authority

A. Principles of Preemption Law

    Under the Supremacy Clause of the Constitution (U.S. Constitution, 
Art. VI, clause 2), State laws that interfere with or are contrary to 
Federal law are invalid. (See Gibbons v. Ogden, 22 U.S. (9 Wheat.) 1, 
211 (1824).) Federal preemption can be express (stated by Congress in 
the statute) or implied.
    Implied preemption can occur in several ways. Preemption may be 
found ``where the scheme of federal regulation is sufficiently 
comprehensive to make reasonable the inference that Congress `left no 
room' for supplementary state regulation'' (Hillsborough County v. 
Automated Medical Laboratories, Inc., 471 U.S. 707, 713 (1985), quoting 
Rice v. Santa Fe Elevator Corp., 331 U.S. 218, 230 (1947)), or where 
``the federal interest is so dominant that the federal system will be 
assumed to preclude enforcement of state laws on the same subject'' 
(Rice v. Santa Fe Elevator [[Page 16966]] Corp., 331 U.S. 218, 230 
(1947); see Hines v. Davidowitz, 312 U.S. 52 (1941)).
    Federal preemption may also be found where Federal law conflicts 
with State law. Such conflict may be demonstrated either when 
``compliance with both federal and state [law] is a physical 
impossibility'' (Florida Lime and Avocado Growers, Inc. v. Paul, 373 
U.S. 132, 142-143 (1963)), or when State law ``stands as an obstacle to 
the accomplishment and execution of the full purposes and objectives of 
Congress'' (Hines v. Davidowitz, 312 U.S. at 67). State law is also 
preempted if it interferes with the methods by which a Federal law is 
designed to reach its goals. (See International Paper Co. v. Ouellette, 
479 U.S. 481, 494 (1987); Michigan Canners & Freezers Ass'n v. 
Agricultural Marketing & Bargaining Bd., 467 U.S. 461, 477-478 (1984).)
    Additionally, ```a federal agency acting within the scope of its 
congressionally delegated authority may preempt state regulation' and 
hence render unenforceable state or local laws that are otherwise not 
inconsistent with federal law'' (City of New York v. FCC, 486 U.S. 57, 
63-64 (1988) (quoting Louisiana Public Service Comm'n v. FCC, 476 U.S. 
355, 368 (1986)). ``Federal regulations have no less preemptive effect 
than federal statutes'' (Fidelity Federal Savings and Loan Ass'n v. de 
la Cuesta, 458 U.S. 141, 153 (1982)).
    When an agency's intent to preempt is clearly and unambiguously 
stated, a court's inquiry will be whether the preemptive action is 
within the scope of that agency's delegated authority (Capital Cities 
Cable, Inc. v. Crisp, 467 U.S. 691, 700 (1984); Fidelity Federal 
Savings, 458 U.S. at 154). If the agency's choice to preempt 
``represents a reasonable accommodation of conflicting policies that 
were committed to the agency's care by the statute [the regulation will 
stand] unless it appears from the statute or its legislative history 
that the accommodation is not one that Congress would have sanctioned 
(``United States v. Shimer, 367 U.S. 374, 383 (1961)). In Hillsborough 
County, the Supreme Court stated that FDA possessed the authority to 
promulgate regulations preempting local laws that compromise the supply 
of plasma and could do so (Hillsborough County, 471 U.S. at 721). FDA 
believes it has similar authority to preempt State and local laws, 
rules, regulations, and other requirements that compromise the adverse 
reporting systems that are essential to postmarketing surveillance and 
protection of the public health.

B. Conflicts Between State Disclosure Laws and Federal Law

    Conflicts between State and local disclosure laws and Federal laws 
and regulations on adverse event reporting justify FDA's preemption of 
State and local law. Although Congress did not expressly preempt State 
law in this area, FDA finds preemption is appropriate because such 
State and local laws significantly interfere with the methods by which 
the Federal laws and regulations achieve their goals.
    FDA is the Federal agency charged with protecting citizens by 
helping ensure that human drug products, biologics, and medical devices 
are safe and effective for their intended uses. To further this 
purpose, Congress established elaborate mechanisms for the Federal 
government to permit the marketing of new drugs, biologics, and medical 
devices and to monitor the safety of these products after their 
approval. (See 21 U.S.C. 355 and 360; 42 U.S.C. 262.) Pursuant to these 
statutory provisions, FDA has established an extensive regulatory 
scheme to monitor the safety and effectiveness of human drug products, 
biologics, and medical devices. (See 21 CFR 310.305, 314.80, 600.80, 
and 803.1 through 803.36.)
    State and local rules of civil procedure, rules of evidence, and 
other laws and regulations that permit discovery or require disclosure 
of a voluntary reporter's or patient's identity hinder FDA's monitoring 
scheme. While other FDA regulations may preserve the confidentiality of 
some voluntary reporters and the patients identified in an adverse 
event report, the same report, when in a manufacturer's possession, may 
be subject to State and local disclosure laws. Such possible disclosure 
will deter voluntary reporting by health professionals directly to 
manufacturers. In addition, the threat of disclosure may chill the 
willingness of reporters to provide information to FDA because the 
agency may share details about a report with a manufacturer in order to 
investigate the report further. Thus, this final rule preempts State 
and local disclosure laws, rules, regulations, and other requirements 
in order to eliminate obstacles to increased and enhanced voluntary 
adverse event reporting by health professionals. FDA has determined 
that the public health value of such reporting outweighs the individual 
needs of plaintiffs to discover the identities of a voluntary reporter 
or a patient, other than the plaintiff, who is the subject of the 
report.
    The final rule focuses solely on protecting the identities of the 
voluntary reporter, the patient, and any other person identified in the 
report. The final rule does not preempt State or local laws that 
require disclosure of the substance of adverse event reports. FDA does 
not believe that disclosure of the substance of adverse event reports 
will impede its ability to collect such information. Indeed, FDA 
routinely releases the full substance of all voluntary adverse event 
reports upon request after deleting identifying information. (See 
Sec. 20.111(c)(3)(iii).) The final rule also does not affect an 
individual's ability to obtain specific information about reports 
concerning his or her own reaction to a product, particularly when the 
individual is a plaintiff in a medical malpractice lawsuit and a court 
grants discovery of the plaintiff's records.

C. Legal Authority for the Final Rule

    As discussed in the preamble to the proposed rule, there are 
various statutory provisions that authorize FDA to collect information 
about regulated products after the products are being legally marketed. 
These statutory authorities establish FDA's mandate to obtain 
information about the safety and effectiveness of drugs, devices, and 
biological products in order to determine whether continued use of 
these products presents an unreasonable risk to consumers. Through 
preemption of conflicting State and local rules that permit or require 
disclosure of voluntary reporter and patient identities, this rule 
removes an obstacle to full and accurate reporting of adverse events, 
and enhances the agency's ability to implement the surveillance 
authorities assigned to FDA.
    Under section 505(k) of the act (21 U.S.C. 355(k)), an applicant 
who has an approved new drug application (NDA) or abbreviated new drug 
application (ANDA) ``shall establish and maintain such records, and 
make such reports * * * of data relating to clinical experience and 
other data or information, received or otherwise obtained by such 
applicant with respect to such drug'' as required by regulations or 
order. Under section 505(e) of the act, failure to establish a system 
for adverse event reports or to make reports required by regulation or 
order constitutes grounds for withdrawing approval of the NDA or ANDA. 
Under these provisions of the act as well as others, such as the 
misbranding and adulteration provisions, FDA promulgated regulations 
requiring specified drug adverse event reporting (21 CFR 314.80, 
310.305). (See 50 FR 11478, March 21, 1985). As stated in the proposed 
rule, the voluntary system of [[Page 16967]] adverse event reporting 
that generates and supplements these required submissions is critical 
to the agency's post-market monitoring capabilities.
    For medical devices, section 519 of the act requires manufacturers, 
distributors, and device user facilities to submit certain adverse 
event reports to FDA and authorizes the agency to require, by 
regulation, reports to assure that a medical device is not adulterated 
or misbranded and ``to otherwise assure its safety and effectiveness.'' 
As stated in the preamble to the proposed rule, in addition to reports 
required by the Safe Medical Devices Act, FDA maintains a voluntary 
device problem reporting program. (See 59 FR 3944 at 3945.) Voluntary 
medical device reports have been an important part of FDA's 
postmarketing surveillance system for medical devices and have prompted 
the agency to take action on several occasions. For example, in 1991, 
voluntary reports to FDA resulted in an alert to health professionals 
to potentially fatal hypersensitivity to latex products. A voluntary 
report from a physician about two patients who experienced blindness 
after the use of an ophthalmic device during eye surgery resulted in an 
FDA investigation and the recall and removal of the device from the 
market. This final rule is intended to ensure that such voluntary 
medical device reporting continues.
    Furthermore, sections 505(k) and 519 of the act provide that 
regulations and orders issued with respect to postmarketing reporting 
requirements for drugs and devices ``shall have due regard for the 
professional ethics of the medical profession and the interests of 
patients * * * '' (21 U.S.C. 355(k) and 360i). The confidentiality of 
the physician-patient relationship is a basic tenet of medical ethics. 
The final rule, which protects both patient and reporter identities, is 
in furtherance of and consistent with these requirements of the act.
    Additional authority to regulate adverse event reporting for 
biologics can be found in section 351 of the Public Health Service Act 
(the PHS act). Section 351 of the PHS act provides regulatory authority 
over biologics, and, pursuant to this section and other statutory 
authorities, the agency promulgated general adverse experience 
reporting requirements for licensed biological products, as well as 
requirements for manufacturers or collection facilities to report 
deaths related to complications in blood collection or transfusion. 
(See Secs. 600.80 and 606.170(b) (21 CFR 600.80 and 606.170(b)); 59 FR 
54034, October 27, 1994).)
    The number and the quality of required reports that FDA receives 
from manufacturers and distributors ultimately depend upon voluntary 
reporting by health professionals. As FDA explained in the proposed 
rule, manufacturers and distributors cannot report adverse events if 
they do not find out about them from the health professionals who 
observed or were advised of the events. Disclosure of patient or 
reporter identities serves as a significant disincentive for voluntary 
reporting by health professionals; preemption of State and local 
disclosure rules that permit or require such disclosure eliminates an 
impediment to agency oversight of the postmarketing safety of products 
under its jurisdiction. The final rule, therefore, which is necessary 
to implement postmarketing surveillance statutory authorities, is also 
authorized under the general rulemaking authority set forth in section 
701(a) of the act (21 U.S.C. 371(a)).

V. Environmental Impact

    The agency has determined under 21 CFR 25.24(a)(8) that this action 
is of a type that does not individually or cumulatively have a 
significant effect on the human environment. Therefore, neither an 
environmental assessment nor an environmental impact statement is 
required.

VI. Executive Order 12612: Federalism

    FDA has examined the effects of this final rule on the relationship 
between the Federal government and the States, as required by Executive 
Order 12612 on ``Federalism.'' The agency concludes that preemption of 
State or local rules that permit disclosure of the identities of the 
voluntary reporter or persons identified in an adverse event report for 
human drug products, biologics, and medical devices is consistent with 
this Executive Order.
    Executive Order 12612 recognizes that Federal action limiting the 
discretion of State and local governments is appropriate ``where 
constitutional authority for the action is clear and certain and the 
national activity is necessitated by the presence of a problem of 
national scope'' (section 3(b)). The constitutional basis for FDA's 
authority to regulate the safety and efficacy of human drug products, 
biologics, and medical devices is the statutes created by Congress to 
regulate products affecting the public health. Congress's decision to 
vest FDA with the authority to establish a regulatory scheme to monitor 
the safety of these products demonstrates Congress' view that the 
safety of human drug products, biologics, and medical devices is a 
problem of national scope (21 U.S.C. 355(k) and 42 U.S.C. 262)).
    Executive Order 12612 expressly contemplates preemption where there 
is a conflict of State and Federal authority under a Federal statute. 
(See section 4(a).) State and local rules of civil procedure, rules of 
evidence, and other rules and regulations that permit or require 
disclosure of the identities of those who report adverse events 
associated with human drug products, biologics, and medical devices 
impede FDA's ability to monitor the safety and efficacy of these 
products. The guarantee of confidentiality of the reporters' and 
patients' names is necessary to assure meaningful reporting of adverse 
events. Additionally, Congress specified that Federal regulations 
issued to monitor the safety of drug products ``shall have due regard 
for the professional ethics of the medical profession and the interests 
of patients.'' (See 21 U.S.C. 355(k) and 360i.) State and local rules 
and regulations that permit or require disclosure of the identities 
conflict with this requirement by jeopardizing confidentiality and the 
physician-patient relationship.
    Executive Order 12612 also requires that any Federal preemption be 
restricted to the minimum level necessary to achieve the objectives of 
the statute pursuant to which the regulations are promulgated (section 
4(c)). The final rule is narrowly drawn and focuses solely on 
protecting the identities of the reporter and patient and other 
individuals named in the report. The final rule does not preempt State 
and local laws that require disclosure of the substance of the adverse 
event reports.
    As required by sections 3(a) and 4(e) of Executive Order 12612, FDA 
consulted the appropriate State officials and organizations and gave 
States an opportunity to participate in the proceedings to preempt 
State and local laws. This opportunity came through publication of the 
January 1994 proposal and through notice sent to each State's Attorney 
General. The agency received no comments from any State regarding the 
contents or the concepts expressed in the January 1994 proposal.
    Thus, FDA concludes that the policy expressed in this final rule 
has been assessed in light of the principles, criteria, and 
requirements in Executive Order 12612; that this policy is not 
inconsistent with that Order; that this policy will not impose 
additional costs or burdens on the States; and that this policy will 
not affect the States' ability [[Page 16968]] to discharge traditional 
State governmental functions.

VII. Analysis of Impacts

     FDA has examined the impacts of this final rule under Executive 
Order 12866 and the Regulatory Flexibility Act (Pub. L. 96-354). 
Executive Order 12866 directs agencies to assess all costs and benefits 
of available regulatory alternatives and, when regulation is necessary, 
to select regulatory approaches that maximize net benefits (including 
potential economic, environmental, public health and safety, and other 
advantages; distributive impacts; and equity). The agency believes that 
this final rule is consistent with the regulatory philosophy and 
principles identified in the Executive Order. In addition, the final 
rule is not a significant regulatory action as defined by the Executive 
Order and so is not subject to review under the Executive Order.
    The Regulatory Flexibility Act requires agencies to analyze 
regulatory options that would minimize any significant impact of a rule 
on small entities. The final rule would preempt the establishment or 
continuation in effect of any State or local law, rule, regulation, or 
other requirement requiring or permitting disclosure of the identities 
of persons reporting adverse events associated with the use of human 
drugs, biological drug products, and medical devices and patients' 
identities. Thus, the agency certifies that this rule will not have a 
significant economic impact on a substantial number of small entities. 
Therefore, under the Regulatory Flexibility Act, no further analysis is 
required.

List of Subjects in 21 CFR Part 20

    Confidential business information, Courts, Freedom of information, 
Government employees.
    Therefore, under the Federal Food, Drug, and Cosmetic Act, the 
Public Health Service Act, and under authority delegated to the 
Commissioner of Food and Drugs, 21 CFR part 20 is amended as follows:

PART 20--PUBLIC INFORMATION

    1. The authority citation for 21 CFR part 20 continues to read as 
follows:
    Authority: Secs. 201-903 of the Federal Food, Drug, and Cosmetic 
Act (21 U.S.C. 321-393); secs. 301, 302, 303, 307, 310, 311, 351, 
352, 354-360F, 361, 362, 1701-1706, 2101 of the Public Health 
Service Act (42 U.S.C. 241, 242, 242a, 242l, 242n, 243, 262, 263, 
263b-263n, 264, 265, 300u-300u-5, 300aa-1); 5 U.S.C. 552; 18 U.S.C. 
1905.
    2. Section 20.63 is amended by adding new paragraph (f) to read as 
follows:

Sec. 20.63  Personnel, medical, and similar files, disclosure of which 
constitutes a clearly unwarranted invasion of personal privacy.

* * * * *
    (f) The names and any information that would identify the voluntary 
reporter or any other person associated with an adverse event involving 
a human drug, biologic, or medical device product shall not be 
disclosed by the Food and Drug Administration or by a manufacturer in 
possession of such reports in response to a request, demand, or order. 
Information that would identify the voluntary reporter or persons 
identified in the report includes, but is not limited to, the name, 
address, institution, or any other information that would lead to the 
identities of the reporter or persons identified in a report. This 
provision does not affect disclosure of the identities of reporters 
required by a Federal statute or regulation to make adverse event 
reports. Disclosure of the identities of such reporters is governed by 
the applicable Federal statutes and regulations.
    (1) Exceptions. (i) Identities may be disclosed if both the 
voluntary reporter and the person identified in an adverse event report 
or that person's legal representative consent in writing to disclosure, 
but neither FDA nor any manufacturer in possession of such reports 
shall be required to seek consent for disclosure from the voluntary 
reporter or the person identified in the adverse event report or that 
person's legal representative; or
    (ii) Identities of the voluntary reporter and the person who 
experienced the reported adverse event may be disclosed pursuant to a 
court order in the course of medical malpractice litigation involving 
both parties; or (iii) The report, excluding the identities of any 
other individuals, shall be disclosed to the person who is the subject 
of the report upon request.
    (2) Preemption. No State or local governing entity shall establish 
or continue in effect any law, rule, regulation, or other requirement 
that permits or requires disclosure of the identities of the voluntary 
reporter or other person identified in an adverse event report except 
as provided in this section.

    Dated: March 24, 1995
William B. Schultz,
Deputy Commissioner for Policy.
[FR Doc. 95-8066 Filed 3-31-95; 8:45 am]
BILLING CODE 4160-01-F