ACTIVE POSTMARKET RISK IDENTIFICATION AND ANALYSIS.

SEC. 905. ACTIVE POSTMARKET RISK IDENTIFICATION AND ANALYSIS.(a) In General.—Subsection (k) of section 505 of the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 355) is amended by adding at the end the following:“(3) Active postmarket risk identification.—“(A) Definition.—In this paragraph, the term ‘data’ refers to information with respect to a drug approved under this section or under section 351 of the Public Health Service Act, including claims data, patient survey data, standardized analytic files that allow for the pooling and analysis of data from disparate data environments, and any other data deemed appropriate by the Secretary.“(B) Development of postmarket risk identification and analysis methods.—The Secretary shall, not later than 2 years after the date of the enactment of the Food and Drug Administration Amendments Act of 2007, in collaboration with public, academic, and private entities—“(i) develop methods to obtain access to disparate data sources including the data sources specified in subparagraph (C);“(ii) develop validated methods for the establishment of a postmarket risk identification and analysis system to link and analyze safety data from multiple sources, with the goals of including, in aggregate—“(I) at least 25,000,000 patients by July 1, 2010; and“(II) at least 100,000,000 patients by July 1, 2012; and“(iii) convene a committee of experts, including individuals who are recognized in the field of protecting data privacy and security, to make recommendations to the Secretary on the development of tools and methods for the ethical and scientific uses for, and communication of, postmarketing data specified under subparagraph (C), including recommendations on the development of effective research methods for the study of drug safety questions.“(C) Establishment of the postmarket risk identification and analysis system.—“(i) In general.—The Secretary shall, not later than 1 year after the development of the risk identification and analysis methods under subparagraph (B), establish and maintain procedures—121 STAT. 945 “(I) for risk identification and analysis based on electronic health data, in compliance with the regulations promulgated under section 264(c) of the Health Insurance Portability and Accountability Act of 1996, and in a manner that does not disclose individually identifiable health information in violation of paragraph (4)(B);“(II) for the reporting (in a standardized form) of data on all serious adverse drug experiences (as defined in section 505–1(b)) submitted to the Secretary under paragraph (1), and those adverse events submitted by patients, providers, and drug sponsors, when appropriate;“(III) to provide for active adverse event surveillance using the following data sources, as available:“(aa) Federal health-related electronic data (such as data from the Medicare program and the health systems of the Department of Veterans Affairs);“(bb) private sector health-related electronic data (such as pharmaceutical purchase data and health insurance claims data); and“(cc) other data as the Secretary deems necessary to create a robust system to identify adverse events and potential drug safety signals;“(IV) to identify certain trends and patterns with respect to data accessed by the system;“(V) to provide regular reports to the Secretary concerning adverse event trends, adverse event patterns, incidence and prevalence of adverse events, and other information the Secretary determines appropriate, which may include data on comparative national adverse event trends; and“(VI) to enable the program to export data in a form appropriate for further aggregation, statistical analysis, and reporting.“(ii) Timeliness of reporting.—The procedures established under clause (i) shall ensure that such data are accessed, analyzed, and reported in a timely, routine, and systematic manner, taking into consideration the need for data completeness, coding, cleansing, and standardized analysis and transmission.“(iii) Private sector resources.—To ensure the establishment of the active postmarket risk identification and analysis system under this subsection not later than 1 year after the development of the risk identification and analysis methods under subparagraph (B), as required under clause (i), the Secretary may, on a temporary or permanent basis, implement systems or products developed by private entities.“(iv) Complementary approaches.—To the extent the active postmarket risk identification and analysis system under this subsection is not sufficient to gather data and information relevant to a priority drug safety question, the Secretary shall develop, support, and 121 STAT. 946 participate in complementary approaches to gather and analyze such data and information, including—“(I) approaches that are complementary with respect to assessing the safety of use of a drug in domestic populations not included, or underrepresented, in the trials used to approve the drug (such as older people, people with comorbidities, pregnant women, or children); and“(II) existing approaches such as the Vaccine Adverse Event Reporting System and the Vaccine Safety Datalink or successor databases.“(v) Authority for contracts.—The Secretary may enter into contracts with public and private entities to fulfill the requirements of this subparagraph.“(4) Advanced analysis of drug safety data.—“(A) Purpose.—The Secretary shall establish collaborations with public, academic, and private entities, which may include the Centers for Education and Research on Therapeutics under section 912 of the Public Health Service Act, to provide for advanced analysis of drug safety data described in paragraph (3)(C) and other information that is publicly available or is provided by the Secretary, in order to—“(i) improve the quality and efficiency of postmarket drug safety risk-benefit analysis;“(ii) provide the Secretary with routine access to outside expertise to study advanced drug safety questions; and“(iii) enhance the ability of the Secretary to make timely assessments based on drug safety data.“(B) Privacy.—Such analysis shall not disclose individually identifiable health information when presenting such drug safety signals and trends or when responding to inquiries regarding such drug safety signals and trends.“(C) Public process for priority questions.—At least biannually, the Secretary shall seek recommendations from the Drug Safety and Risk Management Advisory Committee (or any successor committee) and from other advisory committees, as appropriate, to the Food and Drug Administration on—“(i) priority drug safety questions; and“(ii) mechanisms for answering such questions, including through—“(I) active risk identification under paragraph (3); and“(II) when such risk identification is not sufficient, postapproval studies and clinical trials under subsection (o)(3).“(D) Procedures for the development of drug safety collaborations.—“(i) In general.—Not later than 180 days after the date of the establishment of the active postmarket risk identification and analysis system under this subsection, the Secretary shall establish and implement procedures under which the Secretary may routinely contract with one or more qualified entities to—121 STAT. 947 “(I) classify, analyze, or aggregate data described in paragraph (3)(C) and information that is publicly available or is provided by the Secretary;“(II) allow for prompt investigation of priority drug safety questions, including—“(aa) unresolved safety questions for drugs or classes of drugs; and“(bb) for a newly-approved drugs, safety signals from clinical trials used to approve the drug and other preapproval trials; rare, serious drug side effects; and the safety of use in domestic populations not included, or underrepresented, in the trials used to approve the drug (such as older people, people with comorbidities, pregnant women, or children);“(III) perform advanced research and analysis on identified drug safety risks;“(IV) focus postapproval studies and clinical trials under subsection (o)(3) more effectively on cases for which reports under paragraph (1) and other safety signal detection is not sufficient to resolve whether there is an elevated risk of a serious adverse event associated with the use of a drug; and“(V) carry out other activities as the Secretary deems necessary to carry out the purposes of this paragraph.“(ii) Request for specific methodology.—The procedures described in clause (i) shall permit the Secretary to request that a specific methodology be used by the qualified entity. The qualified entity shall work with the Secretary to finalize the methodology to be used.“(E) Use of analyses.—The Secretary shall provide the analyses described in this paragraph, including the methods and results of such analyses, about a drug to the sponsor or sponsors of such drug.“(F) Qualified entities.—“(i) In general.—The Secretary shall enter into contracts with a sufficient number of qualified entities to develop and provide information to the Secretary in a timely manner.“(ii) Qualification.—The Secretary shall enter into a contract with an entity under clause (i) only if the Secretary determines that the entity has a significant presence in the United States and has one or more of the following qualifications:“(I) The research, statistical, epidemiologic, or clinical capability and expertise to conduct and complete the activities under this paragraph, including the capability and expertise to provide the Secretary de-identified data consistent with the requirements of this subsection.“(II) An information technology infrastructure in place to support electronic data and operational standards to provide security for such data.121 STAT. 948“(III) Experience with, and expertise on, the development of drug safety and effectiveness research using electronic population data.“(IV) An understanding of drug development or risk/benefit balancing in a clinical setting.“(V) Other expertise which the Secretary deems necessary to fulfill the activities under this paragraph.“(G) Contract requirements.—Each contract with a qualified entity under subparagraph (F)(i) shall contain the following requirements:“(i) Ensuring privacy.—The qualified entity shall ensure that the entity will not use data under this subsection in a manner that—“(I) violates the regulations promulgated under section 264(c) of the Health Insurance Portability and Accountability Act of 1996;“(II) violates sections 552 or 552a of title 5, United States Code, with regard to the privacy of individually-identifiable beneficiary health information; or“(III) discloses individually identifiable health information when presenting drug safety signals and trends or when responding to inquiries regarding drug safety signals and trends.Nothing in this clause prohibits lawful disclosure for other purposes.“(ii) Component of another organization.—If a qualified entity is a component of another organization—“(I) the qualified entity shall establish appropriate security measures to maintain the confidentiality and privacy of such data; and“(II) the entity shall not make an unauthorized disclosure of such data to the other components of the organization in breach of such confidentiality and privacy requirement.“(iii) Termination or nonrenewal.—If a contract with a qualified entity under this subparagraph is terminated or not renewed, the following requirements shall apply:“(I) Confidentiality and privacy protections.—The entity shall continue to comply with the confidentiality and privacy requirements under this paragraph with respect to all data disclosed to the entity.“(II) Disposition of data.—The entity shall return any data disclosed to such entity under this subsection to which it would not otherwise have access or, if returning the data is not practicable, destroy the data.“(H) Competitive procedures.—The Secretary shall use competitive procedures (as defined in section 4(5) of the Federal Procurement Policy Act) to enter into contracts under subparagraph (G).“(I) Review of contract in the event of a merger or acquisition.—The Secretary shall review the contract 121 STAT. 949 with a qualified entity under this paragraph in the event of a merger or acquisition of the entity in order to ensure that the requirements under this paragraph will continue to be met.“(J) Coordination.—In carrying out this paragraph, the Secretary shall provide for appropriate communications to the public, scientific, public health, and medical communities, and other key stakeholders, and to the extent practicable shall coordinate with the activities of private entities, professional associations, or other entities that may have sources of drug safety data.”.(b) Rule of Construction.—Nothing in this section or the amendment made by this section shall be construed to prohibit the lawful disclosure or use of data or information by an entity other than as described in paragraph (4)(B) or (4)(G) of section 505(k) of the Federal Food, Drug, and Cosmetic Act, as added by subsection (a).(c) Report to Congress.—Not later than 4 years after the date of the enactment of this Act, the Secretary shall report to the Congress on the ways in which the Secretary has used the active postmarket risk identification and analysis system described in paragraphs (3) and (4) of section 505(k) of the Federal Food, Drug, and Cosmetic Act, as added by subsection (a), to identify specific drug safety signals and to better understand the outcomes associated with drugs marketed in the United States.(d) Authorization of Appropriations.—To carry out activities under the amendment made by this section for which funds are made available under section 736 of the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 379h), there are authorized to be appropriated to carry out the amendment made by this section, in addition to such funds, $25,000,000 for each of fiscal years 2008 through 2012.(e) GAO Report.—Not later than 18 months after the date of the enactment of this Act, the Comptroller General of the United States shall evaluate data privacy, confidentiality, and security issues relating to accessing, transmitting, and maintaining data for the active postmarket risk identification and analysis system described in paragraphs (3) and (4) of section 505(k) of the Federal Food, Drug, and Cosmetic Act, as added by subsection (a), and make recommendations to the Committee on Energy and Commerce of the House of Representatives and the Committee on Health, Education, Labor and Pensions of the Senate, and any other congressional committees of relevant jurisdiction, regarding the need for any additional legislative or regulatory actions to ensure privacy, confidentiality, and security of this data or otherwise address privacy, confidentiality, and security issues to ensure the effective operation of such active postmarket identification and analysis system.