In an unprecedented time amid the global COVID-19 pandemic, an increasing number of pharmaceutical manufacturers and developers of active pharmaceutical ingredients are involved in the potentially life-saving development of medications and medical devices. It is more critical than ever that these companies operate under the highest production standards in compliance with Current Good Manufacturing Practice (“CGMP”) regulations. Despite last month’s Food and Drug Administration (“FDA”) announcements to postpone most foreign facility inspections[1] and all domestic routine surveillance facility inspections,[2] the global pharmaceutical manufacturing industry should be prepared for heightened government scrutiny and an onslaught of FDA CGMP inspections as this crisis develops.

CGMP Regulations Generally

The Food, Drug, and Cosmetic Act (“FDCA”)[3] prohibits adulterated and misbranded products from being manufactured, sold, or transported via interstate commerce.[4] A drug or medical device is adulterated if “the methods used in, or the facilities or controls used for, its manufacture, processing, or holding do not conform to … current good manufacturing practice[.]”[5] The applicable CGMP regulations are codified in Parts 210, 211, and 212 of Title 21 of the Code of Federal Regulations and are further defined by the FDA in applicable guidance documents. The FDA ensures the quality of drug products by carefully monitoring manufacturers’ compliance with CGMP.

The main CGMP components require manufacturers to ensure quality and reliability of their finished products. Quality control, sanitation and hygiene, environmental monitoring, facility management, equipment, raw materials, personnel, and accurate record-keeping are key factors in maintaining CGMP compliance.

FDA’s Potential Focus During Inspections

During the COVID-19 pandemic, the FDA will likely focus during an inspection on a facility’s sanitary conditions and the health and hygiene of the facility’s employees. Pharmaceutical manufacturers, therefore, should thoroughly review policies regarding symptomatic presentations, potential COVID-19 infections, sterilization, and associated reporting. For example, CGMP regulations detail personnel hygiene responsibilities such as:

• Wearing clean clothing and protective apparel;[6]
• Practicing good sanitation and health habits;[7]
• Establishing limited-access rules for certain facility areas;[8]
• Excluding any employee with an apparent illness that may adversely affect the safety or quality of drug products from direct contact with components, drug product containers, in-process materials, and drug products until the employee regains full health;[9] and
• Reporting of all health conditions that may have an adverse effect on drug products.[10]

The FDA will also focus on data integrity during CGMP inspections, which ensures all data regarding the “safety, efficacy, and quality of drugs” is “reliable and accurate.”[11] In the context of COVID-19, the FDA will be interested in reviewing the records surrounding the development of possible treatments and other drugs that are globally in short supply. CGMP data integrity requirements include:

• Computer output to “be checked for accuracy” and “backup data are exact and complete and … secure from alteration, inadvertent erasures, or loss”;[12]
• Documenting certain activities “at the time of performance”;[13] and
• Data to be “stored to prevent deterioration or loss.”[14]

Consequences for Non-Compliance

At the conclusion of an inspection, if an inspector observes a violation, then the FDA may issue a warning letter or an FDA Form 483. A Form 483 sets forth the inspector’s observations of potential regulatory violations and could lead to expensive disruption and remediation efforts for a company. A company must respond to a Form 483 in writing within 15 days with a corrective action plan and implement its plan promptly. Failure to remedy violations observed in a Form 483 could result in subsequent enforcement actions against the company.

Additionally, warning letters are formal FDA notifications that identify serious violations. They signal that the FDA is prepared to begin a court proceeding unless the company quickly and extensively remediates its violations. Most warning letters demand that the recipient take specific measures to correct the violations and provide a plan to prevent future violations.

The FDA also has other types of enforcement actions at its disposal. It could commence product seizures, taking an action against an adulterated product to remove specific violative goods from commerce. The FDA could also consider withholding or withdrawal of product approvals, civil injunction proceedings, civil monetary penalties, and debarment of individuals from future employment by FDA-regulated companies. Tangentially, public companies can also face inquiries and enforcement penalties from the Securities and Exchange Commission for insufficient disclosures of adulterated products and related FDA inspections.

A major consideration for pharmaceutical companies is the False Claims Act (“FCA”). The FCA has implications for CGMP violations because the United States is one of the largest purchasers of prescription medications. Per the FCA, individual whistleblowers can commence investigations under the Qui Tam provisions. Because the FCA imposes liability on any government contractor that knowingly submits false claims to the United States, a pharmaceutical manufacturer that was aware or should have been aware of a CGMP-compromised manufacturing process is likely liable under the FCA. Specifically considering the data integrity CGMP rules mentioned above, substantial CGMP violations that are not documented properly, are covered up or are otherwise misrepresented could trigger FCA liability.

The FDA can even seek criminal prosecution by referring a matter to the Department of Justice. In such instances where the appropriate crime is a misdemeanor violation of the FDCA, a conviction does not require proof of criminal intent. Under the Responsible Corporate Officer Doctrine, also known as the “Park Doctrine” after United States v. Park,[15] a company’s officer may be criminally liable for a violation without criminal intent or even awareness of the violation. As the United States Supreme Court explained in Park, a violation attaches “not only to those corporate agents who themselves committed the criminal act, but also to those who by virtue of their managerial positions or other similar relation to the actor could be deemed responsible for its commission.”[16]

Takeaways

In the face of such serious consequences for non-compliance with these FDA regulations, companies should be committed – and should have been committed even before COVID-19 – to bringing processes into compliance before an FDA inspection. Those companies that received a Form 483 should be considering stricter programs to remedy a potential violation. Moreover, if an inspection does reveal any CGMP issue or violation, it is crucial to execute a rapid and thorough response.

In the time of COVID-19, however, companies should make specific adjustments. This includes conducting internal audits of CGMP compliance and increased scrutiny in specific areas that may relate to COVID-19. For example, companies should consider training their employees on preventing the spread of disease and providing them regular updates on COVID-19 developments. It may also be necessary to institute stricter protocols for hygiene, employee health, equipment sanitation, and even employee quarantines.

[1] Coronavirus Disease 2019 (COVID-19) Update: Foreign Inspections, U.S. Food & Drug Administration (Mar. 10, 2020), https://www.fda.gov/news-events/press-announcements/coronavirus-disease-2019-covid-19-update-foreign-inspections.
[2] Coronavirus (COVID-19) Update: FDA Focuses on Safety of Regulated Products While Scaling Back Domestic Inspections, U.S. Food & Drug Administration (Mar. 18, 2020), https://www.fda.gov/news-events/press-announcements/coronavirus-covid-19-update-fda-focuses-safety-regulated-products-while-scaling-back-domestic.
[3] 21 U.S.C. § 301 et seq.
[4] See 21 U.S.C. § 351.
[5] 21 U.S.C. § 351(a)(2)(B).
[6] 21 C.F.R. § 211.28(a).
[7] 21 C.F.R. § 211.28(b).
[8] 21 C.F.R. § 211.28(c).
[9] 21 C.F.R. § 211.28(d).
[10] 21 C.F.R. § 211.28(d).
[11] Data Integrity and Compliance With Drug CGMP Questions and Answers Guidance for Industry, U.S. Food & Drug Administration (Dec. 13, 2018), https://www.fda.gov/regulatory-information/search-fda-guidance-documents/data-integrity-and-compliance-drug-cgmp-questions-and-answers-guidance-industry; Data Integrity and Compliance with Drug CGMP: Questions and Answers, U.S. Dep’t of Health and Human Services, Food and Drug Administration, Center for Drug Evaluation and Research, Center for Biologics Evaluation and Research, and Center for Veterinary Medicine (Dec. 2018), available at https://www.fda.gov/media/119267/download.
[12] 21 C.F.R. § 211.68(b).
[13] 21 C.F.R. § 211.100(b).
[14] 21 C.F.R. § 212.110(b).
[15] 421 U.S. 658 (1975).
[16] Id. at 670.