DarshanTalks Podcast

Darshan: So we've all seen a situation where people are talking about GDPR, people are talking about HIPAA. Everyone understands what this means, yet there's a second set of laws that people are ignoring. People don't realize what's at stake. People don't understand where we're going. What's a common example of this, is the state laws. CCPA is the most common one of them. CCPA stands for the California Consumer Privacy Act. It's generally broader than HIPAA, and in terms of what constitutes a private data. It was passed in June 2018. It has some very, very onerous requirements and that some might say actually exceeds what HIPAA actually requires.

Narrator: This is the DarshanTalks Podcast. Regulatory guy, irregular podcast, with host Darshan Kulkarni. You can find the show on Twitter @darshantalks, or the show's website at darshantalks.com

Darshan: Let's start with what's actually covered. Under CCPA, the real name, your alias, postal address, unique personal identifier, online identifier, IP address, email address, account name, social security number, driver's license, passport or other similar identifiers are all covered as personal information. Commercial information, including records of property, products or services purchased, obtained or considered would all be considered personal information under CCPA.

Darshan: If you went online and I'm looking at hopefully trying to buy something and looking up reviews of a house, I'm actually trying to buy a house, and I want to look at who's owned the house previously. The concern with that is if I land up in this situation, I may not be able to get that access, and that's appropriate for the privacy of the people before me. Geolocation data would be considered to be private. Audio, electronic, thermal data, olfactory data would be covered. This is really like next generation stuff when you say olfactory data or visual data would be considered to be personal information. I'm not even sure how you... how someone quantifies my olfactory data.

Darshan: Professional employment related information would be considered to be personal information. Education information would be considered to be personal information. So obviously there are going to be some serious ramifications in how employment occurs in California because of this law. And inferences drawn from any of the information that's previously been listed, I just listed out for you, and the impact on the consumer's preferences, characteristics, psychological trends, preference, dispositions, behavior, attitudes, intelligence and aptitudes would all be considered to be personal information. Interestingly enough, employee data is exempted so we've got to figure out what that actually means, how does this play out.

Darshan: So what are the implications? So businesses must disclose data collection sharing practices to consumers. Consumers have the right to request that that data be deleted. So again, if you think about GDPR, this is reminiscent of the right to be forgotten.

Darshan: Consumers have the right to opt out of the sale or sharing of their personal information. Makes sense. Businesses are prohibited from selling personal information of consumers under the age of 16 without explicit consent. Makes sense. So that's a opt-out, sorry, opt-in sort of knocked out. Companies must allow consumers to choose not to have their data shared with third parties. So if you are, say Google who's coming up with a new system, you need to basically say, "Would you like to opt-in to these services?" And chances are, you could just put a geo fence around California and say anyone who's up here is subject to it. But theoretically, do you really want to start restricting it? Maybe you do, maybe you don't.

Darshan: Today's talk is going to be about GDPR and how that applies to pharma companies, to health tech companies. If you are a owner of a pharma company, how does it apply to you? If you are a general counsel for a pharma company, how does it apply to you?

Narrator: This is the DarshanTalks Podcast, regulatory guy, irregular podcast with host Darshan Kulkarni. You can find the show on Twitter @darshantalks or the show's website at darshantalks.com.

Darshan: So, GDPR, it's sort of, you've probably heard about it because we all got a bunch of different emails from Google and from Yahoo and from whatever else you use because a lot of those companies make their money by keeping information. GDPR is the mutually agreed General Data Protection Regulation. Came into effect on May 25th, 2018, and the idea was they would modernize laws that protect personal information of individuals. The goal was to harmonize data protection laws across Europe and give greater protection and rights to individuals.

Darshan: That's all well and good, and that's great. Actually, I'm a huge advocate of privacy, but there are problems. The problem is that they haven't clarified what this means, or the penalties have started coming in. If the penalties are already coming in and you don't know what it means, that seems unfair. Let's talk a little bit more about what GDPR is and how that applies to you.

Darshan: So, the goal of GDPR again was to protect consumer data and how it actually impacts businesses. The question is, are U.S. companies exempt from GDPR because of what's called the Data Shield or not necessarily because there are some rights around transferability of information? The consumer does also get the right to transfer personal data from one company to the other. So, that becomes a new right under GDPR. The consumer also gets the right to access their information so that they know what you know, and you have a certain amount of time as a business to produce that information.

Darshan: If you are a consumer, you get the right to correct the information that the company has. So, you can just, as a company, be like, "I'm going to ignore you." One of the most famous things that came out of GDPR was the "right to be forgotten." The right to be forgotten was the idea that at a certain amount of time, it goes from becoming information about me, which would be in the cloud, is detrimental to me, and I have the right to be forgotten by these systems.

Darshan: Then, there's the right to consent. Essentially, you, as a company, need to get my consent to be able to obtain, process my information. Part of it may all ... This is a huge undertaking, and you may need a data privacy officer to make all of this happen. So, one of the big overarching questions is, do patients own their own data under GDPR? No. The question is actually sidestepped. Patients may be able to control their data. There's no answer about whether they own their data, but meaningfully, what do you get different? The answer might be you might be able to get paid in exchange for that type of control. We aren't there yet, but CCPA is making some steps in that direction.

Darshan: So, why should I care? Does GDPR matter as a pharma company CEO? The final framework suggest that penalties could be up to $20 million, up to 4% of the total global turnover of the preceding year, whichever one is higher. So, if you are a large company, those penalties could be hugely problematic. So, yes, you should probably care about GDPR.

Darshan: So, the next question is, "Well, I'm a U.S. company. How is this that different from HIPAA?" First of all, wrong country. GDPR primarily applies to Europe. Number two, GDPR does this whole controller versus processor thing. In clinical trials,

Darshan: Today's recording is based on the idea that we should be discussing privacy more and we should be talking about what privacy means, and we should be talking about what the legal requirements are versus what is a good thing to do and what is smart to do.

Narrator: This is the DarshanTalks Podcast, regulatory guy, irregular podcast, with host, Darshan Kulkarni. You can find the show on Twitter, @DarshanTalks, or the shows website at darshantalks.com.

Darshan: When we think about it, again, we'll go back to our four major pillars of patient centricity. The four major pillars of patient centricity are transparency, number two is the congress of that, which is privacy. The third one is innovation, and the last one is access, i.e., patients want information. They want to make sure their information is private and controlled, and in a way that's not just being spread, that they have access to innovations and access to new and updated technologies. Finally, the most important part, which is being able to actually access those innovations in a transparent and private way. So, we're only talking about one aspect of it, which is the privacy aspect of it. When we start discussing that privacy aspect, the most common topic to come up is HIPA. It's important to recognize that when you're talking about HIPA, it's not just the only game in town. There are state laws that also have coverage for health information and privacy associated with that health information.

Darshan: It's also important to recognize that it's only relating to health, so there are non-HIPA laws that control the privacy associated with that information, the most famous of which right now is GDPR. There's also CCP and Like as well. The converse of that, which is just because something has health information, doesn't necessarily make it subject to HIPA, and that's actually really surprising to a lot of people. This was sort of interesting to me, because I started looking up some information around HIPA and I was surprised that IRB's and privacy boards can potentially waive the need for HIPA authorizations on cases. So, just because it is a health-based scenario and just because it may be even done in the context of a physician relationship, doesn't necessarily mean that HIPA is always applicable. A privacy board or an IRB may be be able to waive that requirement. The next thing to look at is the idea that the information is always unavailable. You have to recognize that if you're doing a study, the information should be the information that is being protected.

Darshan: If you're collecting that information, it has to be focused and it has to be responsive to the study itself. So, you can't just go willy-nilly collecting everything you wanted to collect, just because it would be interesting. So, let's take a step back and let's talk about why this came about. So, I had a discussion on Twitter a little bit ago around HIPA and how health tech companies manage HIPA versus what is actually required. I'm not going to name names or anything, quite honestly, because I don't even remember the names. It was just an interesting conversation and I thought that it's a valid conversation to have. So, HIPA, again, stands for the Health Insurance Portability and Accountability Act, off 1996. So, it's one of the first privacy laws that we think of and people therefor think that it's all encompassing, it's the broadest, it's the mother of all privacy laws. Just because it's the mother, doesn't mean it's the most encompassing. What HIPA was set up to do was provide the ability to transfer and continue health insurance coverage for millions of people.

Darshan: Surprisingly, it also was supposed to help control health fraud and help with managing industry wide standards of health ...

Darshan: So the talk today is about, what should employers do about employees who use cannabis?

Narrator: This is the DarshanTalks podcast. Regulatory guy, irregular podcast, with host Darshan Kulkarni. You can find the show on Twitter @DarshanTalks or the show's website at darshantalks.com.

Darshan: Let's first take a step back and talk about the fact that, what are the laws around cannabis? So to do that appropriately, what you really have to start thinking about is, what level are you talking about? There is the federal level, there's the state level, and then there's the local level. At the federal level you've got the DEA, USDA, and FDA, who basically take the position that there are ... For the most part, the DEA asserts that it's a schedule one substance, cannabis is a schedule one. And when I say cannabis I really mean THC, or tetrahydrocannabinol. It's a schedule one, and in those specific instances there's no good reason to use it. Having said that, it does have exceptions. For example, there are products like Marinol that are actually FDA approved, and therefore the DEA takes the position that that specific one is okay and appropriate, assuming certain other conditions are met. The FDA, like I said, has done an evaluation, and for very specific reasons and very specific positions, they have approved THC and CBD-containing products.

Darshan: And again, they've been synthetic versus naturally produced, etc., etc., etc. And we don't need to get into the details of this. It's really more about, what is the federal level versus the state level kind of issues. And then the USDA, which actually has a slightly different version on all of this. And it basically says that, it ties itself basically to the states, and we'll talk about that in a second. So for the most part it's illegal at the federal level unless you've actually gone through the FDA approval process. On the other hand, at the state level they take a slightly different position. And individual states have actually said that depending on whether it's for ... Some states basically still do the blanket, "It's illegal." There are some states who say that you can use it, but it has to be for medicinal uses.

Darshan: And there's another piece, another group of states that come out and say, "We'll allow it not only for medical but also for recreational use. And for medical reasons you have to meet certain conditions, and that it has to be one of 22 or 23 different indications. And again, each state chooses which ones they want. It may be more than 23, it may be less than 23. But that's really where it stands. And then you've got the recreational, which, it's not tied to a specific disease at all. And then you've got the local, which basically is, some cities like ... Well, before I go to the local, we spoke about state, we talked about medicinal uses versus recreational uses. And the USDA takes the position that if you're going to do state level cannabis, the labs that measure this need to be DEA approved.

Darshan: And that's become a source of issues. And the DEA is now taking a step back from that position, the USDA is taking a step back from that position, but that's really where that world plays. And again, we can get into details if you need to reach out to me.

Darshan: At the local level, you have cities taking the position that, "Yes, we recognize that at the federal level it's generally illegal to use cannabis. However, we're not going to prosecute," which basically means that they're "decriminalizing." So at no point is it legalized, it is just decriminalized. And that's the distinction between the two. On the other hand, when you actually start looking at the different states, they do have, from an employee/employer standpoint,

Darshan: So let's ask a question. Is it legal for a pharmaceutical company to provide financial assistance for travel, lodging and other expenses to certain patients prescribed the manufacturer's drug?

Narrator: This is the Darshan Talks Podcast. Regulatory guy, irregular podcast, with host Darshan Kulkarni. You can find the show on Twitter @darshantalks or the show's website @darshantalks.com.

Darshan: This was an OIG opinion from January 2020. And I thought it would make sense to explore exactly what the OIG gave an opinion on, what the implications are, and why it matters.

Darshan: So the drug in question is a personalized medicine made from the patient's own cells in a one time potentially curative treatment. The drug is approved for one of two indications, it's either refractory or recurrent. Generally affects children or young adults, or it's affecting adults. So what is the drug itself? It's a drug that has what's called a REMS on it and only REMS certified physicians can ... treat the disease using the drug.

Darshan: The physicians who are allowed to do this, they accept the responsibility for implementing the necessary safety protocols and may prescribe and administer the drugs. Consistent with the REMS, the requestors enter into arrangements with certain inpatient/outpatient facilities, which we're calling the centers, to infuse the drug.

Darshan: These facilities also additionally perform leukapheresis and collect, process, package, and ship the patient's white blood cells to the requestor, so that requestor may use the patient's cells. The requestor being the pharmaceutical company in this specific instance, I expect ... May use the patient's cells to individually manufacturer the drug.

Darshan: So what does the center need to be able to do? The facility, the center must meet applicable regulatory requirements for third party cell collection, processing and other requirements, including having onsite immediate access to the drug itself, which is used to treat severe instances of therapy related syndrome.

Darshan: Essentially they need to be able to manage results that can come out ... the adverse events of this drug and of disease itself. They must ensure that physicians who prescribe, dispense or otherwise administer the drug, are trained in the management of the syndrome and potential neurological toxicities.

Darshan: And the pharmaceutical manufacturer in this specific instance certifies that it does not require either the physicians or the centers to prescribe the drug exclusively. And that any facility that meets all the REMS with the ETASU requirements and the requestor's criteria may become a center. So the key piece here is, why is the proximity necessary?

Darshan: The proximity of the center is necessary because, A, number one to handle the fact that these patients may be required to stay there for a little bit, and only certain facilities can handle it and handle the training that's required. Under the arrangement, the pharmaceutical company proposes treating eligible Disease A patients, being the older patients, and disease B patients as well.

Darshan: And depending on whether you have Disease A or Disease B, they give up to two caregivers for lodging, travel, meals and certain out of pocket expenses. So if you're a child, you'd get two caregivers. I expect it might be the parents ... up to two caregivers.

Darshan: For Disease B, patients who are 26 and older, they provide the same level of support for a patient and one caregiver. The requestor does not provide assistance with patient travel or expenses associated with the initial patient consultations with the leukapheresis, or following up visits beyond the post infusion monitoring required by the drugs prescrib...

Darshan: This is breaking news and we should probably talk about this a little bit further. We've spoken before about the idea of transparency, especially in the context of clinical trials.

Narrator: This is the DarshanTalks Podcast. Regulatory guy, irregular podcast, with host Darshan Kulkarni. You can find the show on Twitter @darshantalks or the show's website, at darshantalks.com.

Darshan: What's really important to recognize is that transparency matters. And why does it matter? It matters because it's coming from the perspective of patient centricity. The first question to ask is, well, how has patient centricity connected to transparency? Transparency is one of the hallmarks of building trust. And if you're going to engage with patients, if patients believe that you're engaging with them in an honest, trustworthy way, they're going to expect transparency from you. Transparency actually holds companies responsible. It holds patients as true stakeholders in the process, so transparency matters.

Darshan: So, what is the current state of transparency globally? There are primarily three or four major buckets in terms of global transparency. The countries that really come into play for the most part are the, and I'm going to also call the countries or country blocks, so the EMA being a huge portion of it. There's Japan that has some portions of it. You've got the UK, which is connected to the EMA now, but with Brexit coming on it has slightly different requirements. You've got Canada, which is trying to follow the EMA in many ways but not quite. You've got India, which talks about transparency and anonymization and balancing those two requirements.

Darshan: Then all of this comes together in the context of six major buckets of information. The first being studied registration, the second being result reporting, the third being those reports that came out of your study. They need to be published and available in a way that's understandable to the scientific populous so that they can read them, evaluate if your results are accurate, CSR disclosures, clinical study report disclosure, which is actually going in one step further and saying, "Show me the CSR, take out the pieces that are confidential and let me see the rest of it." The actual data itself being disclosed so that people can actually play with the data, see what actually makes sense. And the last one, which is, we spoke about the scientific publication, but having lay versions of that, lay summaries if you will.

Darshan: We've spoken about what these six buckets are. What are the expectations in the US? There've been three major expectations in the US, the first being the fact that under clinicaltrials.gov, under specifically FDAAA, you're required to register your study and you're required to report the results and the CSR disclosure. There was a recent CSR disclosure pilot that started maybe 2018. I believe it was January, 2018, and the pilot itself was discontinued in 2019. Around June of 2019 the FDA came out and said, "Thank you, that was a great pilot. Feel free to comment on it. We're looking at some other options as well." And then the basically put our $10,000 per day penalty that could apply if the results weren't appropriately reported.

Darshan: But for the most part, the industry has seen ct.gov to be a bit of a toothless tiger. Unfortunately that has not played well. It goes to the whole principle of, well if you're trying to be transparent, if you're trying to be forthcoming is the fact that you aren't disclosing everything that was required to be disclosed appropriate? The Yale Media Freedom Information Access, MFIA, and the New York University Technology Law and Policy Clinics on behalf of Charles [Sifey 00:04:07] and Dr. Peter Lurie,

Darshan: I wanted to talk today about the coronavirus and what is the role of the general counsel and what are some considerations for the general counsel/chief compliance officer.

Narrator: This is the DarshanTalks podcast. Regulatory guy, irregular podcast with host Darshan Kulkarni. You can find the show on Twitter @darshantalks or the show's website at darshantalks.com.

Darshan: This can have differing roles depending on the size of your organizations. This can have differing roles depending on the maturity of your organization. Some of the things you want to start thinking about is, well is the general counsel even supposed to be involved? So I did a little bit of research and again, obviously depends on how your organization sees it, but the general counsel is responsible for maintaining knowledge of the organization's operations and legal documents and promulgating and creating directives of corporate acts and decisions. So I would argue that, yeah, the general counsel, the chief compliance officer has a role in making sure that for the companies involved in this process and what is that role supposed to look like.

Darshan: So let's take a step back. Let's talk about the coronavirus. So the coronavirus is actually a type, it's a family of viruses and we had MERS and we had SARS a few years ago. Those all fall within that same virus family, if you will. And what we have now is something called C-O-V-I-D 19 or COVID 19 and that's just another one of them. Obviously it's spread significantly and it's caused global panics in many ways. But that's really what we're talking about. So the real question then comes out, what is the role of the general counsel in these situations? And I think that what you have to after take away is the fact that there's an inside role and there's an outside role.

Darshan: And when you're talking about the inside role, you're really talking about what are the connections to the employees, what are the connections to the board of directors, and what do you need to do in those scenarios. So from that perspective, you want to think about the OSHA general duty clause, which basically requires that employers provide employment and a place of employment which is free from recognized hazards that are causing or are likely to cause the death or serious harm to employees.

Darshan: So an employer, has an affirmative duty to protect employees from things like a pandemic virus. And I'm not sure we necessarily are in the world of pandemics right now, but there's an argument out there. So the Federal Protecting America's Workers Act, or I guess it could be considered power expanded coverage to the public sector in general. So, that's one consideration, just pure OSHA requires it that you, it requires that you make sure that you are protecting your employees in the best way possible. So let's consider that one step further. If you have global operations, which is true for a lot of pharmaceutic companies and for some healthcare companies, you need to start looking at the state department website, looking the CDC, looking at what the FDA is doing.

Darshan: For example, China and Italy have restrictions on travel. China, they actually go out one step further and they recommend against traveling to China. Italy actually they have a level three, I believe, essentially saying that we'd recommend against traveling to Italy. So keep an eye out to see what you really need to get into and if your employees really need to be there. If an employee has been in a real coronavirus hotspot, maybe consider making them stay a full 14-day incubation period at home. It doesn't really matter in this world if they work remotely, maybe they can work remotely this time. And you want to start thinking about, well,

Darshan: Welcome to another episode of Darshan Talks. This one's really exciting, because I get to talk about something I'm really passionate about, this idea of patient centricity. And what I really think is interesting is, 2019, in many ways, has been the year of the patient. And the reason I don't like saying things like, "The year of the patient," is that implies that, well, it's done, we can move on now. And that's not really it. I guess a better way to phrase that would be, starting the year of the patient. People have been talking about it for decades at this point, but you could see some real solid measures starting to come into place, and I don't necessarily mean this at a conceptual level, but at a regulatory level. At a level of people actually taking steps.

Narrator: This is the Darshan Talks Podcast. Regulatory guy, irregular podcast, with host Darshan Kulkarni. You can find the show on Twitter @DarshanTalks or the show's website at DarshanTalks.com.

Darshan: For those of you who don't follow a patient centricity space as much, it's kind of interesting to think about patient centricity consisting of four major arms. There's the privacy arm, there is the transparency arm, there is the innovation arm, and then there's the access arm. And if you can get these four major arms together, you are really engaging in true blue patient centricity.

Darshan: As we talk about patient centricity, it's important to recognize that, if you are a company that's taking steps in transparency, you need to look at these other three arms to understand how they all work together, otherwise what you really end up with is significant blind spots that may affect the other efforts you're making.

Darshan: Let's talk about the innovation arm. What's happened in 2019 that may change things? More specifically, as drug prices have been soaring, patient advocates and lawmakers, et cetera, have pushed the federal government. And what they're saying is, they want the right to suspend a drug maker's patent and license someone else to produce the drug.

Darshan: So an example of that is what's called the Bayh–Dole Act. And the question is, is this generally possible? Most IP experts disagree on exactly how applicable it is, and there are some shall we say, varying opinions on this. The Trump administration hopes to clarify this. But if I was a patient, I'm not sure killing innovation is necessarily the direction to want to go. Having said that, innovation at the price of access is not really what you want to do either. So those are two different pieces of the same pie.

Darshan: We can then talk about privacy and what happened in 2019. Everyone knows that GDPR came into effect in 2018. Companies have been dealing with it, but the ramifications really came into effect... 2018 was more of an awareness process. People are like, "Oh, okay, I have to follow GDPR."

Darshan: In 2019, companies are still dealing with, "What is GDPR and does it apply to me?" And it's primarily, and especially interesting, in the context of life sciences companies. I've heard rumors of CROs telling sponsor companies that they don't want to engage in clinical research in the European Union because it's simply unclear what people's requirements are. And even the US secretary of commerce says that GDPR creates serious and unclear legal obligations for both private and public sector entities, including the US government, and it's unclear what's required to comply. And this obviously has implications on medical research. And I'm paraphrasing what he said.

Darshan: And obviously, what adds to this whole process is GDPR obviously is pretty onerous and the penalties are significant. However, because of exactly this, the different states and the different countries... The member states and different countries can take the own version, if you will, of GDPR,

Darshan: Welcome to another episode of Darshan Talks. This one's really exciting, because I get to talk about something I'm really passionate about, this idea of patient centricity. And what I really think is interesting is, 2019, in many ways, has been the year of the patient. And the reason I don't like saying things like, "The year of the patient," is that implies that, well, it's done, we can move on now. And that's not really it. I guess a better way to phrase that would be, starting the year of the patient. People have been talking about it for decades at this point, but you could see some real solid measures starting to come into place, and I don't necessarily mean this at a conceptual level, but at a regulatory level. At a level of people actually taking steps.

Narrator: This is the Darshan Talks Podcast. Regulatory guy, irregular podcast, with host Darshan Kulkarni. You can find the show on Twitter @DarshanTalks or the show's website at DarshanTalks.com.

Darshan: For those of you who don't follow a patient centricity space as much, it's kind of interesting to think about patient centricity consisting of four major arms. There's the privacy arm, there is the transparency arm, there is the innovation arm, and then there's the access arm. And if you can get these four major arms together, you are really engaging in true blue patient centricity.

Darshan: As we talk about patient centricity, it's important to recognize that, if you are a company that's taking steps in transparency, you need to look at these other three arms to understand how they all work together, otherwise what you really end up with is significant blind spots that may affect the other efforts you're making.

Darshan: Let's talk about the innovation arm. What's happened in 2019 that may change things? More specifically, as drug prices have been soaring, patient advocates and lawmakers, et cetera, have pushed the federal government. And what they're saying is, they want the right to suspend a drug maker's patent and license someone else to produce the drug.

Darshan: So an example of that is what's called the Bayh–Dole Act. And the question is, is this generally possible? Most IP experts disagree on exactly how applicable it is, and there are some shall we say, varying opinions on this. The Trump administration hopes to clarify this. But if I was a patient, I'm not sure killing innovation is necessarily the direction to want to go. Having said that, innovation at the price of access is not really what you want to do either. So those are two different pieces of the same pie.

Darshan: We can then talk about privacy and what happened in 2019. Everyone knows that GDPR came into effect in 2018. Companies have been dealing with it, but the ramifications really came into effect... 2018 was more of an awareness process. People are like, "Oh, okay, I have to follow GDPR."

Darshan: In 2019, companies are still dealing with, "What is GDPR and does it apply to me?" And it's primarily, and especially interesting, in the context of life sciences companies. I've heard rumors of CROs telling sponsor companies that they don't want to engage in clinical research in the European Union because it's simply unclear what people's requirements are. And even the US secretary of commerce says that GDPR creates serious and unclear legal obligations for both private and public sector entities, including the US government, and it's unclear what's required to comply. And this obviously has implications on medical research. And I'm paraphrasing what he said.

Darshan: And obviously, what adds to this whole process is GDPR obviously is pretty onerous and the penalties are significant. However, because of exactly this, the different states and the different countries... The member states and different countries can take the own version, if you will, of GDPR,

Darshan: Welcome to another episode of Darshan Talks. This one's really exciting, because I get to talk about something I'm really passionate about, this idea of patient centricity. And what I really think is interesting is, 2019, in many ways, has been the year of the patient. And the reason I don't like saying things like, "The year of the patient," is that implies that, well, it's done, we can move on now. And that's not really it. I guess a better way to phrase that would be, starting the year of the patient. People have been talking about it for decades at this point, but you could see some real solid measures starting to come into place, and I don't necessarily mean this at a conceptual level, but at a regulatory level. At a level of people actually taking steps.

Narrator: This is the Darshan Talks Podcast. Regulatory guy, irregular podcast, with host Darshan Kulkarni. You can find the show on Twitter @DarshanTalks or the show's website at DarshanTalks.com.

Darshan: For those of you who don't follow a patient centricity space as much, it's kind of interesting to think about patient centricity consisting of four major arms. There's the privacy arm, there is the transparency arm, there is the innovation arm, and then there's the access arm. And if you can get these four major arms together, you are really engaging in true blue patient centricity.

Darshan: As we talk about patient centricity, it's important to recognize that, if you are a company that's taking steps in transparency, you need to look at these other three arms to understand how they all work together, otherwise what you really end up with is significant blind spots that may affect the other efforts you're making.

Darshan: Let's talk about the innovation arm. What's happened in 2019 that may change things? More specifically, as drug prices have been soaring, patient advocates and lawmakers, et cetera, have pushed the federal government. And what they're saying is, they want the right to suspend a drug maker's patent and license someone else to produce the drug.

Darshan: So an example of that is what's called the Bayh–Dole Act. And the question is, is this generally possible? Most IP experts disagree on exactly how applicable it is, and there are some shall we say, varying opinions on this. The Trump administration hopes to clarify this. But if I was a patient, I'm not sure killing innovation is necessarily the direction to want to go. Having said that, innovation at the price of access is not really what you want to do either. So those are two different pieces of the same pie.

Darshan: We can then talk about privacy and what happened in 2019. Everyone knows that GDPR came into effect in 2018. Companies have been dealing with it, but the ramifications really came into effect... 2018 was more of an awareness process. People are like, "Oh, okay, I have to follow GDPR."

Darshan: In 2019, companies are still dealing with, "What is GDPR and does it apply to me?" And it's primarily, and especially interesting, in the context of life sciences companies. I've heard rumors of CROs telling sponsor companies that they don't want to engage in clinical research in the European Union because it's simply unclear what people's requirements are. And even the US secretary of commerce says that GDPR creates serious and unclear legal obligations for both private and public sector entities, including the US government, and it's unclear what's required to comply. And this obviously has implications on medical research. And I'm paraphrasing what he said.

Darshan: And obviously, what adds to this whole process is GDPR obviously is pretty onerous and the penalties are significant. However, because of exactly this, the different states and the different countries... The member states and different countries can take the own version, if you will, of GDPR,