An In-Depth Look at the Consumer Protection Act

Reviewing what companies need to know in order to report serious adverse events according to FDA’s new guidance.

By Todd Harrison
Partner
Venable, LP
Washington, D.C.

Dietary supplement companies continue to struggle with implementing The Consumer Protection Act. This Act amended the Federal Food Drug and Cosmetic Act by adding safety reporting requirements for “serious adverse events” associated with dietary supplements and nonprescription drug products. These requirements officially take effect on December 22nd.

Generally, these requirements apply only to companies whose name appears on the product label, unless: (1) the manufacturer enters into an agreement with the distributor that authorizes the manufacturer to submit the required reports to the FDA; and (2) the distributor directs all adverse events (both serious and non-serious) to the manufacturer that are reported to the distributor. It is likely that some contract manufacturers will be willing to take on these additional duties for its private label distributors. However, other manufacturers will not. Regardless of who will have the responsibility for reporting serious adverse events, both the manufacturer and the private label distributor will need to develop internal procedures for handling and investigating serious adverse events. The failure to have proper procedures in place could lead to not only regulatory compliance issues, but also the unintended public release of private information.

This online exclusive summarizes the requirements under the Act that relate to the reporting of serious adverse events. This article also reflects a review of both the statute and the October 2007 draft guidance documents published by FDA pursuant to its authority under the Consumer Protection Act. Because we have seen an increase in natural OTC drugs, such as topical analgesics that have menthol and capsaicin, this article will address both requirements.

The Consumer Protection Act

The Consumer Protection Act generally requires all nonprescription drug and dietary supplement labels to include a domestic address or domestic phone number of the manufacturer or distributor. The person who receives a report of a “serious adverse event” through this address or phone number must submit a report to FDA within 15 business days of its receipt.

The term “serious adverse event” is defined differently for nonprescription drugs and dietary supplements. For nonprescription drugs, it means an event, occurring from an overdose, abuse, withdrawal, or pharmacological failure, that either results in death, a life-threatening experience, inpatient hospitalization, a persistent or significant disability or incapacity, or a congenital anomaly or birth defect; or requires, based on reasonable medical judgment, a medical or surgical intervention to prevent an outcome described above.

For dietary supplements, a “serious adverse event” means any health-related event associated with the use of a dietary supplement that leads to any of the aforementioned outcomes (or requires, based on reasonable medical judgment, a medical or surgical intervention to prevent such an outcome).

The report should be recorded using FDA’s MedWatch form (Form 3500A). In addition, during the course of the investigation, any new medical information related to a submitted serious adverse event that is received within one year of the initial report must be reported to FDA within 15 business days. ALL records related to each report must be maintained for six years.

The report may also be accompanied by a statement denying that the report or the records constitute an admission that the product caused or contributed to the adverse event. However, it is important that a company be very careful as to what it submits to the agency, because it could eventually find its way into the hands of a plaintiff attorney. While a simple statement such as “We deny that the product caused the harm complained of by the customer” seems innocuous enough, subsequent information related to the report could cast serious doubt on the veracity of that statement. The issue then becomes whether there is an obligation to retract that statement if the company knows it is not accurate. Accordingly, while it may feel good to submit a denial with the report, the more prudent course may be to simply fill out Form 3500A and skip the commentary. If a company truly desires to file a denial statement, discuss the potential ramifications with counsel before doing so because the last thing a company wants to be accused of is filing a false statement with the federal government.

FDA Draft Guidance Documents

The FDA published draft guidance documents in early October, providing more specific information relative to this new reporting requirement. One relates to dietary supplements and the other relates to nonprescription drug products, although they appear to be very similar. This section is not intended to be a comprehensive summary of the draft guidance documents. Rather, it highlights points that may be important for the purpose of drafting the form agreements.

When is a report of a serious adverse event “received”?

The 15-business day clock for reporting a serious event does not necessarily begin to run when the first piece of information is received. It begins when the following four basic elements are received: an identifiable patient, an identifiable reporter; a suspect product; and a serious adverse event or fatal outcome.

Identifiable Patient

An “identifiable patient” would seem at first glance rather easy to identify. In short, it simply means that enough information has been provided to the company to identify that someone was injured. Thus, the term “elderly lady” would be sufficient to identify a person. On the other hand, “some consumers” would not be sufficient to identify a particular person. In this latter case, FDA appears to expect that the company follow up on this generalized complaint to determine how many individuals were actually injured and submit a separate 3500A for each identifiable individual. This may cause companies to expend resources attempting to chase down these individuals that may have been injured and the company may have to make a decision whether the report is true or is merely a false report. Regardless, the company will need to be careful in its investigation. If it cannot independently verify that a group of individuals have been potentially injured, it should make a sound decision as to whether to report it to the FDA.

FDA expects the responsible company to make a reasonable attempt to obtain complete information for cases assessment during initial contacts and subsequent follow-up. In this vein, FDA is urging companies to use trained healthcare practitioners to query reporting individuals. However, it may not be economically feasible for a company to have a healthcare practitioner handle these calls and there is no requirement in the Act to do so. With proper training, there is no reason companies can’t handle these complaints in-house. If companies choose this route, it would alleviate the need to have sufficient procedures in place to ensure that the outside company is performing its duties in accordance with the Act, especially with regard to handling private and confidential information correctly.

To make privacy issues even more complicated, FDA is urging company’s to attempt to contact the healthcare practitioner familiar with the patient’s adverse event, with the patient/consumer’s permission, to obtain further medical information and to retrieve relevant medical records, if appropriate. This raises serious privacy issues and the company before undertaking such an endeavor must make sure that it has the proper procedures in place to ensure the confidentiality of the information provided. Failing to do so could lead to a lawsuit against the company. Moreover, it will be very important that the company be careful in what says to the healthcare practitioner because that information could become discoverable if a lawsuit results from the adverse event. In this case, the company should simply request the facts and avoid direct discussions about the product’s overall safety.

Finally, although the report should be submitted within 15 days of receiving this basic information, the company will be expected to seek follow-up information for completing all the applicable elements of the case report (reflected on the MedWatch form).

Identifiable Reporter

The person that reports the adverse event may be the actual patient, a family member, a close family friend, or another third-party such as physician. The contact information of the reporter must be provided, including an e-mail address, unless the reporter requests otherwise. In that situation, the company is expected to keep the information on file to help facilitate any further follow up.

Of course, all laws are ambiguous and reporters could range from being a “real” reporters to a disgruntle employee. The point is, companies must attempt to get sufficient information from the initial reporter to identify someone that has personal knowledge of the adverse event. This may require the company to make a judgment call on whether or not this is a real report, particularly if the initial reporter refuses to provide any additional information. Should this be the case, the safeguard here is that the company will not have sufficient information to fill out Form 3500A and, thus, should not be in violation of the Act. That said, the company should keep sufficient information on file to show that it made a good faith attempt to determine whether this was a serious adverse event or not.

Suspect Product

The report must provide the name of the product and sufficient information in order to identify it (i.e., information regarding its strength, dosage form, flavor and packaging form and size). If it involves one or more products, only one serious adverse event should be filled out with sufficient information regarding each product involved. If it involves both an OTC drug and dietary supplement from the same responsible company, one serious adverse event should be supplied to both CDER (Center for Drug Evaluation and Research) and CFSAN (Center for Food Safety and Applied Nutrition).

A unique situation that might occur is when a customer calls up and reports that an identifiable person suffered a serious adverse event from a combination of supplements, some of which were manufactured or distributed by a different party. In this situation, the FDA has indicated that the company that receives the report should file a 3500A that identifies its product and the other company’s product, and then send a copy of the 3500A to the other company. The other company is not obligated to file an additional report unless it has information that is not contained in the original report.

When is new medical information required to be reported?

A company will be expected to submit a “follow-up report” when new medical information related to a submitted serious adverse event report surfaces. The report should reflect a current, comprehensive understanding of the serious adverse event, rather than a mere update to the initial report. Information later found to be inaccurate should not be repeated in the follow-up report, and new information (including corrected information) should be highlighted. As mentioned earlier, if the company files a denial when it submits the 3500A, it will be expected to retract that denial if it has reason to believe it is no longer accurate.

What labeling should be submitted with the report?

Each report must be accompanied by a copy of the current label on or within the retail package of the drug. The report should include the full outer carton/container label and immediate container label. Paper copies are acceptable, as long as they are no smaller than actual size.

Conclusion

Hopefully, most companies have already developed procedures and have been testing them for the past few months to ensure they are ready for the new law. If your company has not addressed AERs yet, it should immediately start implementing procedures in order to be able to safeguard personal information and carry out an effective investigation should serious adverse events arise with your products. With proper training, implementing proper procedures can be achieved in-house. If some companies don’t want to take care of AERs in-house, there are plenty of good companies to which they can outsource reporting responsibilities. However, keep in mind that outsourcing does not mean you simply leave AERs to the reporting company. Rather, you still have the obligation to ensure that it is being done correctly—that’s why it’s important to monitor the reporting company on a frequent basis.