How To Take Full Advantage Of RWD Without Jeopardizing Privacy Laws

By Enno Behrendt and Liisa M. Eisenlohr, Guidehouse

While randomized clinical trials (RCTs) remain the gold standard for evaluating the safety and efficacy of new therapeutic agents, innovators and regulators alike envision a future in which the full scope of real-world data (RWD) can be used to generate real-world evidence (RWE) to bolster research and development efforts globally. The sheer volume of data related to patient health status and the delivery of healthcare, available from electronic health records, health insurance claims, product and disease registries, and similar sources throughout the world, offers innovators the potential to uncover insights more quickly and efficiently.

Together with clinical trial data, RWE offers a unique method to form a holistic view of a condition and a medical product’s impact on the life of patients. RWE allows the capture and reporting of data from a far more diverse and inclusive patient population than clinical trial data, and it enables a more comprehensive understanding of safe and effective use of therapeutic innovations. RWE can also be used to find patterns and correlations in patient characteristics to inform product development, clinical decision-making, and population health initiatives. Furthermore, as a practical example of applying RWD in the clinical trial setting, rather than recruiting a group of participants for the control arm – who would be receiving standard of care while another group is treated with the in-development product – researchers could harvest RWD to create a synthetic control arm, thereby ensuring all participants have the opportunity to receive the product being studied.

The more applicable and practical the real-world data, the better the insights and options for informed decision-making and rapid advancement. However, therein lies a dilemma: innovators need personally identifiable information to most accurately aggregate and analyze data as well as to match patients in a synthetic control arm as closely as possible to the trial inclusion and exclusion criteria and study endpoints. Yet in many countries and regions, these details are strongly protected by data privacy laws. To solve this dilemma, innovators generally collect data with patient consent from participants in product or disease registries and other “opt-in” means, or they purchase anonymized data from other parties. Both means present hurdles, including:

• Consent usually does not cover uses for secondary research purposes, so, in effect, innovators usually must re-collect consent for each additional use of the data.
• Anonymized data does not include personally identifiable health information – e.g., location, sex, race, ethnicity, other physical or mental health conditions, etc. – so data points cannot be matched.
• Aggregated data points may include unknowable duplications, which undermines the integrity of the data and research findings.

This article explains how regulatory trends are shifting toward finding a beneficial balance between data privacy and the use of RWD in clinical research and provides perspective on what still needs to happen to spur innovation.

This article offers perspective on: 1) current regulatory allowances that make it possible for researchers and product developers to compliantly leverage more detailed RWD, and 2) newly proposed regulation in the EU that may broaden their access to it even further.

Data Privacy And Protection

Today, the majority of countries have data protection and privacy legislation in place (71%) or in draft (9%). While these laws vary from country to country, they generally prohibit or at least limit the collection, use, and sharing of personal information without an individual’s notice or consent and provide protections against data/identity theft.

The established right to privacy largely unfolded after the end of World War II in Europe, whereby western European nations collectively aimed to protect individuals from government surveillance. As technological advances changed how information could be gathered and leveraged, European nations worked together to keep pace by extending the rights to privacy and protection, with most other nations following suit to varying degrees. With the enactment of the General Data Protection Regulation (GDPR) on May 25, 2018, the EU has been leading with the world’s strictest privacy and security law to regulate how personal data can be collected, stored, shared, and accessed. Essentially, the GDPR gives individuals more control over their personal data and easier access to it than previously. The law holds any organization that targets or collects data related to people in the EU accountable for compliance, levying heavy fines – up to 4% of their global annual turnover – for breaches.

However, progress-oriented defined pathways exist that allow the use of personal data for research and innovation – and generally have since the early inceptions of data privacy and protection laws. In the EU and other markets, including the United States and Japan, personally identifiable RWD can be used to advance healthcare, medicines, or medical technology with or without consent for clinical research. Even the GDPR’s “right to be forgotten” provision requiring companies to delete an individual’s data upon a person’s request provides the caveat that “freedom of expression, as well as historical and scientific research, are safeguarded.”

These are very important distinctions, because they enable the two worlds of healthcare research and data privacy to work together.

Accordingly, in these jurisdictions, as long as an organization stays within the good clinical practice (GCP) guidelines, they do not need consent to repurpose data for new clinical research endeavors. This means, for example, an organization could leverage or share data and samples collected from past trials now archived or in storage to inform research and development initiatives. To be clear, the data cannot be sold, used for marketing purposes, or be leveraged for any other means outside of this very narrow clinical allowance.

Still, although already government-sponsored efforts are making more data available and a variety of third-party analysts have emerged to mine, curate, and analyze that growing data wealth, there is no centralized or concerted effort to gather, sort, and secure a comprehensive data repository. Furthermore, it is unclear who – i.e., the patient, researcher, or sponsor company – owns the data being generated.

Meanwhile, life sciences industry stakeholders must determine how to account for and address RWD discrepancies. While the majority of countries collect data, there is no globally agreed-upon routine, systematic way to collect, store, manage, and govern data. Even within the same nation, different entities may use different approaches, and single-source data may be incomplete, inconsistent, or, depending on the governing body, inaccessible.

The good news is a means to clarify these and other RWD-related hurdles may be coming soon in the EU.

Carving The Way Forward

With the aim to streamline access to RWD, reduce excess spending, and provide long-term benefits to clinicians and patients, the recently proposed draft “European Health Data Space” (EHDS) regulation would allow for more flexibility in RWD collection and use. Importantly, in compliance with the GDPR, the proposal aims to allow individuals to control their electronic data while enabling researchers, innovators, policymakers, and regulators to cost-effectively leverage quality data in a secure manner that preserves individuals’ data privacy. The ultimate goal will be to provide patients and healthcare providers with access to more innovative medical products and better decision-making.

The regulation calls for the creation of a domain-specific data space throughout Europe to establish unified national and cross-border standards and data portability. If approved, the regulation will enable the “full use of the potential offered by a safe and secure exchange, use, and reuse of health data.”

As currently proposed, the EHDS initiative signals that leading regulators are seeking to find a prudent way to concurrently protect privacy and propel innovation. And if successful, the implementation of the regulation will potentially offer interested entities globally a blueprint to follow. As they continue on this path, however, regulators in Europe and around the world still will need to clarify, articulate, and guarantee the extent of the clinical research framework, namely:

• What qualifies as “healthcare research”?
• How can RWD be used to augment healthcare research?
• Who or what will govern how RWD can be used, especially as more becomes available and linkable? 

Implementation of the EHDS regulation would enable healthcare research within the existing framework of GDPR’s data privacy rules, thus providing a road map to push medical innovation forward. As regulators open more pathways for innovators to access RWD, and innovators begin to take greater scientific advantage of the data, the global objective will become less about how to get identifiable data and more about how to qualify the data’s quality to further stimulate scientific discovery.

About The Authors:

Enno Behrendt is an associate director in life sciences at Guidehouse. His special expertise includes compliance and regulatory matters in collaborative research and clinical trials, international and inter-cultural training design, transparency laws (U.S. and European) and market-entry phase compliance. His particular focus is on behavioral economics and how to implement effective methods for organizational integrity and cultural change in complex organizations. In addition, he has more than 15 years of operational business experience as in-house counsel and as operational compliance officer. He also has significant international experience in medical device companies, focusing on the U.S., Europe, and China.

Liisa M. Eisenlohr is a senior associate in life sciences at Guidehouse. She provides strategic and tactical consulting support for global medical affairs functions, including compliant scientific/medical and pharmacoeconomic communications with healthcare professionals, payers, and patients; medical advisory board management; review of promotional and non-promotional material; educational grant management; publication planning; and clinical and non-interventional study oversight pre-and post-product launch. She has over 20 years of experience in the life sciences industry, including various global roles in medical affairs and clinical development at biopharmaceutical companies with bringing oncology drugs to market in the U.S., Europe, and Asia-Pacific regions.