Solutions in pharma: Prescription for compliance

Compliance in the life sciences industry is challenging, and the pharmaceutical segment faces even greater demands, for obvious reasons: Lives are at stake. And the penalties for non-compliance can be severe. Not only do pharmaceutical company executives have to worry about disclosures, records management (RM) and financial reporting under Sarbanes-Oxley, but also much more stringent requirements related to product research, manufacturing and privacy requirements in contact with consumers. Recently, Eli Lilly was sued for revealing patient names and e-mail addresses on a broadcast e-mail to Prozac patients.

Included in the demanding content management requirements are not only privacy guidelines, but also research, testing and manufacturing data, and voluminous and sometimes viral e-mail messages. But compliance with regulations like the U.S. Food & Drug Administration's (FDA, fda.gov) 21 CFR Part 11, where predicate rules dictate which records must be verified, kept, tracked and signed, are more than just IT implementations--they include procedural and administrative controls in addition to the technical controls that vendors may offer.

Industry conundrum

In fact, if a vendor claims to offer turnkey 21 CFR Part 11 compliance, it must include assistance in all the other elements of compliance like generating standard operating procedures (SOPs), adequate training, notification and other administrative requirements. Further, the FDA has released "Good Practices" rulings that require strict controls, such as Good Laboratory Practice (GLP) and Good Manufacturing Practice (GMP).

"More specifically, 21 CFR Part 11 requires 'procedures and controls designed to ensure authenticity, integrity and, when appropriate, the confidentiality of electronic records.' These types of regulations are driving pharmaceutical firms to support their RM policies related to e-mail and other content," says Mike Gundling, senior VP product management at iLumin Software.

Naomi Fine, president and CEO of Pro-Tec Data, works with high-profile pharmaceutical clients like Johnson & Johnson to establish management and protection policies for intellectual property. She characterizes the industry's conundrum this way: "This is an industry that is particularly collaborative by nature. So there's a pronounced tension between sharing knowledge and protecting it. With increased regulatory measures such as those regulating the use of personal information like HIPAA (Health Information Portability and Accountability Act) and CA Senate Bill 1386, pharmaceutical companies additionally have to look at the classifications of their data when handling personally identifiable information of consumers.

Culture of compliance

"Then there's Sarbanes-Oxley and newly amended Federal Sentencing Guidelines, such as the Computer Fraud and Abuse Act, which went into effect last November, that establish the standard for compliance. So what companies must do is put in place the training and procedures to establish a culture of compliance throughout the company's operations. And that means much more than just deploying technology."

The clear leader in enterprise content management (ECM) system implementations for the pharmaceutical industry is EMC/Documentum, which focused efforts early on selecting specific niche applications and exploiting marketing efforts across the industry. The vast majority of all pharmaceutical companies use EMC/Documentum's ECM platform.

"The hot thing right now in pharma--as in most industries--is records management," says Lubor Ptacek, director of product marketing at EMC/Documentum. "The good news for our customers is that we've been embedding RM capabilities in our products for some time now."

Any data type in the Documentum 5.3 repository can be declared a record and managed according to a file plan, even XML and Web pages and those rare cases when audio or video files are used. The new release also includes federated search capability across repositories, support for MS Outlook clients (allowing users to perform all the content management tasks without exiting Outlook) and Content Transformation Services (CTS), which provide the ability to transform common desktop documents and rich-media formats. The result is more efficient and standardized content transformation and analysis for all content across the entire organization.

CTS includes:

• Document Transformation Services (DTS)—render HTML and PDF content from standard desktop documents like Microsoft Word;

• Advanced Document Transformation Services (ADTS)--add advanced rendering features to DTS like PDF bookmarks, XMP round-tripping, thumbnails and storyboard support;

• Media Transformation Services (MTS)--support rich media such as photographs, presentations and graphics with content attribution, thumbnails, storyboard support and renditions management;

• Audio/Video Transformation Services (AVTS)--add enhanced support to MTS for audio and video such as streaming support, advanced video details; and

• Medical Imaging Transformation Services (MITS)--add support for the DICOM medical image format to MTS.

An emerging area is the use of digital rights management (DRM)/enterprise rights management (ERM) software to control access to data as it moves and is transformed throughout an enterprise. DRM/ERM functionality provides rights access that travels with the data, even if it starts in an Excel spreadsheet and is cut and pasted into an MS Word document. To provide that functionality, EMC/Documentum, as do other ECM providers, partners with leaders in the DRM/ERM market including Liquid Machines, Sealed Media and Authentica .

"Our software extends the notion of boundaries of what data can be managed and controlled," says Ed Gaudet, VP of product management & marketing at Liquid Machines. Acquisitions in the DRM/ERM sector by ECM providers wanting that functionality seem likely and logical in the near term.

Bristol-Myers Squibb took a digital asset management (DAM) approach when implementing in its marketing department. Helen Shareshian, IT director of projects at Bristol-Myers Squibb explains, "We found that branded rich media content—product documents, graphics, presentations, video—is core to business process and critical to marketing success. Yet like most companies, BMS was ill equipped to enforce controls around this high-value intellectual property. Often this content resided in departmental silos around the globe—making it nearly impossible to maximize its value. What's more, creation and distribution costs were high, and collaboration among geographically dispersed teams was a challenge."

BMS' system

BMS chose to implement a marketing content management (a.k.a. digital asset management) solution from ClearStory. "The system centralizes branded rich media content, which eliminates silos of content and provides a common hub for product launch activities," Shareshian says. "All documents and rich media files pertaining to a project including video, FDA documents, presentations and marketing graphics are managed, stored and distributed by the system. The system supports over 1,300 diverse users—including marketing team members, legal staff, global business units, creative agencies, joint venture partners and print houses. Day or night, users in more than 70 countries can work with a wide range of marketing materials."

A brand library acts as the central workspace for draft materials in the creative process, and it makes final-form materials available for consumption by sales and regional marketing teams. The solution manages the review and approval process, and current versioning is controlled for brand integrity and regulatory compliance. In addition, when a regulation requires a content change, a search returns all related content for fast updating—even if that content is a component of a compound document.

Managing e-mail

"Many of the pharma firms are Oracle shops, and they use Oracle Collaboration Suite (OCS). They use our products because we're the only leading e-mail archive vendor to handle OCS files," says iLumin's Gundling. "They implement our Assentor RM and Assentor Discovery modules to meet their needs."

iLumin's Assentor Enterprise product provides authenticity and integrity controls with features such as object signatures and an open storage API that integrates with leading WORM storage platforms from EMC (emc.com), Network Appliance, StorageTek and IBM. With Assentor, pharmaceutical companies can perform RM for messages that apply to clinical trials, manufacturing and adverse reaction reports. In addition, Assentor's content analysis identifies confidential data in e-mail before messages ever leave the firm, helping companies protect their proprietary information and comply with industry regulations.

iLumin customers in the pharmaceutical industry are also using Assentor to establish readiness for FDA audit and litigation support. For example, most pharmaceutical firms require that e-mail be searchable for regulatory, audit and legal purposes. The CFR Part 11 regulation specifies that reproduction of electronic records must be kept in "common and portable formats" and must preserve the original content and meaning of the records. Assentor provides a message signature and supports native message export, helping firms quickly locate and share stored messages with the FDA and/or appropriate legal parties.

AXS-One offers the AXS-One Compliance Platform to allow companies to meet ongoing regulatory demands, according to Peter Mojica, VP of product development. "What firms in this industry need to do is to sustain compliance through not only infrastructure standards, but also IT policies and practices," Mojica says. "What we offer is not a product to comply with specific regulations, but a platform going forward to allow for compliance as new regulations are promulgated."

---

Robert Smallwood is a partner specializing in the healthcare segment with IMERGE Consulting, e-mailrobert.smallwood@imergeconsult.com.