EFPIA: All Roads Lead to Consent

By Veronique Monjardet

The European Pharmaceutical Industry Association (EFPIA) has preempted government sunshine regulations in Europe by providing a holistic approach to disclosing transfers of value between healthcare professionals (HCPs) and organizations (HCOs) for its 40+ members in 33+ countries.

In 2016, EFPIA members will have to publicly disclose any transfer of value captured in 2015 on a per country basis. As a part of this process, EFPIA country member associations will have to ensure that standard EFPIA requirements conform to state or local data privacy regulations.

Data privacy concerns are a major challenge to the European sunshine reporting process because reports capture personal information. Reports require the disclosure of full names, addresses, and specialties. In addition, some regulations require unique, country-specific identifiers.

In Europe, the capture of personal information at a granular level as a part of sunshine reporting requirements must operate in harmony with the 1998 European Data Protection Directive 95/46/EC. The Directive stipulates that individuals must provide consent before their personal information may be collected, recorded, transferred, and/or disclosed.

EFPIA disclosure language encourages each member to proactively gather HCP consent prior to public disclosure. Most pharmaceutical companies obtain consent in the fee-for-service contracts they sign with HCPs. With HCP consent, EFPIA transfer of value reports will list each HCP individually, providing their name, the expense amount, and the expense type. Without HCP consent, their expenses will be reported at an aggregate level.

Consent requirements are widespread across Europe and different countries have different rules. About 14 countries have a law or code, five countries do not require consent (France, the Netherlands, Portugal, Denmark, and Romania), four countries “recommend” entities obtain consent, and eight countries do not mention consent at all.   In addition, in five countries (Austria, Greece, Hungary, Luxembourg, and Switzerland), pharmaceutical companies must obtain consent from the HCO as well.

The applicability of consent requirements typically depends on (1) the intended use of the personal information and (2) the country wherein the entity “using” the information is operating. Further, consent needs to be collected both for spend data intended for public publication and for spend data intended for internal reporting and analysis.

The following examples illustrate how some countries and country pharmaceutical associations are approaching the issue of consent:

1. The ABPI (Association of the British Pharmaceutical Industry) has provided a model clause and guidance note to be included in an agreement between a company and an HCP, which companies may incorporate when seeking to obtain HCP consent for disclosure. The model language is only a suggestion, not a requirement.

2. The AIFP (Association of Innovative Pharmaceutical Industry) in the Czech Republic took a different approach. In the Czech Republic, it is possible to make use of a legal dispensation from the obligation to obtain consent from an HCP, provided there is an agreement between the HCP and AIFP member containing a provision outlining that the processing of personal data is necessary for the purposes of the agreement. If such agreement is obtained (in writing), the HCP’s consent is not needed and cannot, therefore, be revoked.

3. In Spain, a unique number, the “Datos identificativos,” identifies the HCP with the DNI (Documento Nacional de Identidad) for individuals and CIF (Certificado de Identificion Fiscal) for companies. To maintain privacy when the report is published, the number is anonymized using the same encryption procedure used by tax authorities to partially mask the number (e.g. xxxx123xxxx).

4. In Australia, the authorities have placed the onus on the pharmaceutical industry to establish a process for obtaining consent. Reporting payments and transfers of value must be consistent with the Commonwealth Privacy Act 1988. Section 41.3.2 requires companies to establish a mechanism to obtain informed consent from HCPs before the company can publish transfer of value information. This requirement is effective for all payments and transfers of value made on or after 1 October 2015.

For Europe, as a general rule, if a HCP does not consent to his or her personal information being disclosed at an individual level, then their expenses will be reported in the aggregate. If a HCP withdraws their consent after the report has been published, the company is not required to remove the data from the published report. However, for subsequent reports, the HCP’s personal data must be anonymized and moved to the aggregate section.

The challenge in Europe will be convincing HCPs to consent to the publication of their expenses at an individual level. Krzysztof Kaluzny, the Project Manager of INFARMA (Poland), has stated “[w]e cannot anticipate the level of consent per countries.”  Krzysztof continues by pointing out that some companies have been more effective in raising levels of HCP consent.  Potential evidence of this came during the Global Compliance Congress on November 19th in Munich, where Mr. Kaluzny stated that, based on a local association survey in Poland, “on average the consent level across companies for the country is around 23% ….” The Polish survey concluded that obtaining consent is “different from company to company, while some companies reach 90% others have a low number resulting in an average consent is 23%.” In Germany, where protection of data privacy is very strong, Holger Diener, Managing Director, Association of Voluntary Self-Regulation for the Pharmaceutical Industry, stated their survey puts consent levels at 40-44%.  He believes that future consent levels are expected to go down.

Brendan Shaw, the Assistant Director General of IFPMA, asserted at the Munich conference that consent for HCPs should be based upon communication and “HCP[s] should be engaged from the beginning of the process.” To improve levels of HCP consent, Shaw recommended greater investment in “explaining consent and [the] process.”

Next June, when the EFPIA reports are published, we will be able to see what percentage of HCPs consented. The pharmaceutical industry must remember the ultimate goal of sunshine reporting requirements: to provide transparency into the relationships between pharmaceutical companies and HCPs. The industry needs these relationships and so do the HCPs.  They support the development of new drugs and treatments benefiting patients.

EFPIA is a self-regulating body trying to achieve consistency and efficiency in reporting across many different countries, pre-empting the laws and subsequent differences in reporting requirements in France and the US. The pharmaceutical industry has an incentive to make transparency work and to convince HCPs to be transparent about payments before the government steps in and takes over.