Appendix C

Correspondence between POGO and CDRH officials

April-May 2008

ectExposing Corruption

Government OversightExploring Solutions www.POGO.orgAnni versary

Celebrat ion

April 30, 2008By fax to 240-276-3943

and by mail

6E Eleventh Street, NWSuite 900Washington, DC

20001-4542Phone: 202-347-1122Fax: 202-34-7-1116

www.POGO.orgpogo©pogo.org

Daniel G. Schultz, M.D.DirectorCenter for Devices and Radiological HealthU.S. Food and Drug Administration9200 Corporate Boulevard, Room 100Rockville, MD 20850

Dear Dr. Schultz:

We are writing about the apparent decision by the Center for Devices and RadiologicalHealth not to enforce 21 CFR Part 58, the Good Laboratory Practice (GLP) regulations.This is a matter of concern to our organization, Project On Government Oversight, whichhas been looking into GLP enforcement by CDRH. We are planning to publish a reporton our findings and to provide this report to interested parties. POGO is an independentnonprofit organization that examines government operations with the goal of improvingtheir effectiveness and achieving a more accountable government.

We ask that you provide us with answers to the questions below.

The apparent decision by CDRH to abandon enforcement of the GLP regulations wasdescribed last year on the "What's New" page of the website for Immel Resources LLCat http://immelresources.com. (See http://immelresources.com/OldWhats New.html.)

In a short article entitled, "FDA No Longer Enforcing GLPs for Devices," ImmelResources stated that the FDA "announced the policy change in May 2007 at the AnnualMeeting for the Society for Quality Assurance. An agency representative said that FDAdoes not intend to take enforcement action if a nonclinical laboratory is not followingGLPs." The article quoted other comments made by the agency representative, including:"Historically, CDRH review divisions have not required animal safety studies to followGLP" and "Many marketed devices did not follow GLP."

We have spoken with attendees at the SQA meeting who have confirmed this descriptionof events and have told us about their great surprise when the change in enforcementstrategy was announced on May 3, 2007. The announced change — from a requirement byCDRH for obligatory compliance with the GLP regulations to optional compliance(including noncompliance) — raises several questions.

Legal issues

Question 1. What is the legal basis for CDRH's abolition or marked weakening, withinCDRH, of the FDA's enforcement of the GLP regulations?

There appears to be a solid legal basis for the principle that sponsors' compliance withthe GLP regulations is required, i.e., that compliance is not optional. In 1978, before theissuance of the final rule, the FDA had received comments on the draft rule from personswho favored the exemption of medical devices: "More than 20 comments sought theaddition of specific language exempting various classes of FDA-regulated products, suchas medical devices, from coverage by the regulations." (This quotation comes from thepreamble to the final rule, General Provisions, Scope, item 12, dated December 4, 1978,by Donald Kennedy, the FDA Commissioner of Food and Drugs, and published in theFederal Register, vol. 43, no. 247, December 22, 1978.)

But the FDA, in the passage immediately following the sentence quoted above, rejectedthe requests for such exceptions. Commissioner Kennedy dealt with the issue clearly andexplicitly: "The Commissioner has generally elected not to permit exemptions based onbroad categories of regulated products because no compelling reasons have beenpresented that would support the contention that assurance of safety is less desirable forone class of regulated products than for another. Proper safety decisions are important forall these products; accordingly, the processes by which such safety data are collectedshould be subjected to identical standards of quality and integrity." (Emphasis added.)

We have sought but not found any legal opinion published on the FDA website thatinvalidates or reverses Dr. Kennedy's conclusion that the required standard fornonclinical testing of medical devices is the GLP regulation.

We are aware of published announcements on related subjects, for example, on FDA'suse of a risk-based approach and "enforcement discretion" during the auditing of systemsfor compliance with 21 CFR Part 11 (related to electronic records). We are also aware ofCDRH's statement that, because of its limited resources, it is using a risk-based strategyfor field inspections in the post-marketing period. However, we are not aware of anypublished CDRH statements corresponding to the statements by CDRH's representativeat the SQA meeting on May 3, 2007 to the effect that

o CDRH has not required animal safety studies to follow GLPo Many marketed devices did not follow GLPo It is not feasible to require manufacturers to follow GLP

Question 2. Have any statements been published by CDRH on the FDA website about thechange in CDRH policy, such as the three bulleted statements just above? If there aresuch statements overriding the previous GLP policy, we ask that you identify them.

-2-

The change in policy — from obligatory compliance to optional compliance ornoncompliance with the GLP regulations — is a radical one. Question 3. If this change hasbeen made without public notice and without the opportunity for public comment, what procedure was followed within CDRH in order to make the change, and what is the legal justification for such a procedure conducted without public notice in the Federal Registeror elsewhere?

Ethical issues related to patient protection

The next question is based not on any legal requirement for GLP compliance, but solelyon well-established ethical principles for patient protection requiring that devices shouldbe as safe as is reasonably possible when they are implanted in patients.

Question 4. What is the evidence showing that the CDRH's current policy for the monitoring of safety for devices is at least as effective as strict enforcement by CDRH ofthe 21 CFR Part 58 regulations requiring GLP compliance?

If, as seems very likely, CDRH's current monitoring and enforcement practice is lesseffective than the past practice of enforcing GLP compliance, then patients are being putat increased risk due to the discontinuation of GLP enforcement. It is clearly unethical toincrease the risk to patients in this fashion without their informed consent. We areunaware of any effort to inform patients or their physicians about the lowered standardsfor nonclinical laboratory testing. We ask that you let us know if CDRH is planning suchan effort. If no such effort is planned, we ask that you explain the justification for thefailure to obtain informed consent.

Years ago, when it was still customary for CDRH to enforce GLP, there were instancesof GLP noncompliance discovered at the time of an inspection. These inspections had asalutory effect not only on the companies discovered to be GLP noncompliant, butpresumably on all companies, since all were aware that inspections would continue.Indeed this was one of the main reasons that Congress enacted the GLP regulation: allcompanies would be motivated to comply with the GLP regulation by the FDA'sinspection and occasional disciplining of a few companies.

But now there are far fewer inspections, and inspectors of nonclinical laboratories are notauthorized by CDRH to look routinely for evidence of GLP noncompliance. Thus greaterreliance is being placed on the judgment of CDRH personnel in deciding, in the absenceof standards set by the GLP regulations, that devices are safe enough for human testingand subsequent widespread use. CDRH personnel are now responsible for making thesedifficult judgments — not only in the absence of standards set by the GLP regulations, butusually (and perhaps almost always) without any inspections whatsoever.

-3-

Question 5. Is there any evidence that manufacturers and their contract laboratories are voluntarily (i.e., without a requirement for GLP compliance and in the absence ofinspections) imposing sufficiently high standards on themselves, namely, standards thatare at least as high as those required by the GLP regulations?

Finally, we ask that you provide us with a very brief preliminary response to this letter.Please let us know promptly by email or fax if you are planning to reply more fully and ifso, the estimated date of your full reply. If you decide to send us a reply, you should planto do so within three weeks if possible and within 30 days at the latest.

The readers of our report will undoubtedly want to know whether there is or is not asound legal and ethical basis for CDRH's policy on enforcement of the GLP regulations.

Thank you for looking into the matters discussed here. All of us — those inside CDRH,elsewhere in the FDA, and in nonprofit organizations such as Project On GovernmentOversight — are seeking the same goal: the best use of limited resources in a time of risingFDA responsibility for safe and effective medical devices,

Sincerely,

Danielle BrianExecutive DirectorProject On Government Oversight

Ned Feder, M.D.Staff ScientistProject On Government Oversight666 11th Street, NW, Suite 900Washington, DC 20001Phone: 202-347-1122Fax: 202-347-1116nfeder@pogo.org

Copies:Andrew von EschenbachGerald MasoudiNancy C. Brogdon, Betty W. Collins, Janet H. Cooper, Carl T. DeMarco, Malvina

Eydelman, Susan N. Gardner, Alberto Gutierrez, Steven I. Gutman, Chiu S. Lin,Michael E. Marcarelli, Mark Melkerson, Karen L. Moss, Gladys Rodriguez,Heather Rosencrans, David S. Shindell, Matthew J. Tarosky, Donna B. Tillman,Timothy A. Ulatowski, James L. Woods, Bram D. Zuckerman

Thinh Nguyen

-4-

Dear Dr. Schultz:

I am writing to confirm some comments made to me on the phone last week byMs. Adrienne Burns, your Executive Assistant. On May 7 she said you and yourassociates were planning to respond to the letter of April 30 by Ms. Danielle Brian(Executive Director of POGO) and me. The subject of this letter is CDRH's apparentdecision not to enforce 21 CFR Part 58, the Good Laboratory Practice (GLP) regulations.

I wish to confirm Ms. Burns's statement that you and your associates are preparing areply that will probably be sent out late this week (around May 16) or, if not, then earlynext week.

In addition, further information that may help in the preparation of your reply is includedbelow. The quoted passages confirm similar material in the POGO letter of April 30.

All the passages that follow are quoted from the preamble to the final rule, datedDecember 4, 1978, by Donald Kennedy, the FDA Commissioner of Food and Drugs, andpublished in the Federal Register, vol. 43, no. 247, December 22, 1978. The preambleindicates that before the GLP regulations were finalized, proposed regulations werepublished in the Federal Register of November 19, 1976. Interested persons were given120 days to submit comments, and public hearings were held.

The long preamble to the final rule (a total of 253 numbered items) contains discussionsby Commissioner Kennedy of the many comments received, about half of which camefrom manufacturers and private laboratories. Each published discussion first summarizesthe comments by interested persons and then presents Commissioner Kennedy'sdecisions. In most cases the final regulations (final rule) are unchanged from theproposed regulations published previously (November 19, 1976). In a few cases, inresponse to the comments received, the final regulations differ from the proposedregulations.

Project On"(posing Corruption

Government OversightExploring Solutions www.POGO.org

Daniel G. Schultz, M.D.DirectorCenter for Devices and Radiological HealthU.S. Food and Drug Administration9200 Corporate Boulevard, Room 100Rockville, MD 20850

66 Eleventh Street, NWSuite 900

Washington,DC

20001-4542Phone: 202-347-1122 - Fax: 202-347-1116

/1\ 1111 I ‘--,r_1Celeb ration

May 13, 2008By fax to 240-276-3943

and by mail

www.POGO.orgpogo@pogo.org

The item numbers below follow the numbering of items in the preamble. The passagesfollowing each item number are quoted verbatim from the preamble. Ellipsis marksindicate passages that have been omitted. A few comments of mine are included inbrackets.

Item 5A number of comments challenged the general legal authority

of FDA to issue good laboratory practice regulations. Othercomments challenged the legal authority to require record retentionor quality assurance units, or to specify the content of requiredrecords or location of storage.

The Commissioner finds that the authority cited in thepreamble to the proposal (41 FR 51219; Nov. 19, 1976) provides asound legal basis for the regulations. . . . [The legal basis for theregulations is then discussed at length, with citations of decisions bycircuit courts and the Supreme Court.]

Item 8A number of comments said the cost of implementing the

proposed regulations would be prohibitive to smaller testinglaboratories and would, at the least, result in a substantial increase inthe cost of product testing.

The Commissioner agrees that implementation of theseregulations will increase the cost of nonclinical laboratory testing.The Commissioner finds, however, that such costs are justified onthe basis of the resultant increase in the assurance of the quality andintegrity of the safety data submitted to the agency. . . .

Item 10Products regulated by the agency, for which safety data may be

required, cover a wide range of diverse items that pose quitedifferent types of risk. Examples include implantable medicaldevices; . . .

Item 12 [This item is the one quoted in POGO's letter of April 30.]More than 20 comments sought the addition of specific

language exempting various classes of FDA-regulated products, suchas medical devices, fiom coverage by the regulations.

The Commissioner has generally elected not to permitexemptions based on broad categories of regulated products becauseno compelling reasons have been presented that would support thecontention that assurance of safety is less desirable for one class ofregulated products than for another. Proper safety decisions areimportant for all these products; accordingly, the processes by whichsuch safety data are collected should be subjected to identicalstandards of quality and integrity.

-2-

Item 26Several comments objected to the inclusion of medical devices

in § 58.3(e) (16), 17, and (18), stating that medical devices were not"test substances," that medical devices should not be includedbecause the rules for data submission for such devices were as yetundefined, and that inclusion of medical devices would be undulyrestrictive. These comments suggested either total or partialexclusion from coverage under the good laboratory practiceregulations.

For reasons stated previously, the Commissioner does notagree that medical devices, as a category, should be excluded.Implantable devices may be composed of polymeric materials thatcontain components capable of leaching from the device into thebody of the recipient or may themselves be adversely affected bybody constituents. In either case, safety studies would be necessaryto demonstrate that components of the device did not cause harm orthat the body constituents did not promote breakdown or malfunctionof the device.

Item 75 [under the subheading "Quality Assurance Unit"]More than 100 comments objected to part or all of § 58.35 as

proposed. Many comments questioned the need for a qualityassurance unit as proposed. Some comments stated that theestablishment of such a unit would increase the administrativeburden and costs of performing nonclinical studies to the point offorcing small facilities out of business. Others stated that theprovisions would interfere with management's prerogatives toorganize the facility or with the informed scientific judgment ofprincipal investigators or study directors.

The Commissioner has retained the requirement that eachtesting facility have a quality assurance unit (QAU) to monitor theconduct and reporting of nonclinical laboratory studies. In view ofthe potential gain to management, to sponsors, and to FDA, throughthe added assurance of well-conducted studies, increased costs, ifany are justified....

-3-

Item 130 [under the subheadings "Testing Facilities Operation:Standard Operating Procedures"]

Two comments suggested deleting § 58.81 in whole or in part.Several others said the requirements for standard operatingprocedures were unnecessary and burdensome.

The Commissioner does not agree. The use of standardoperating procedures is necessary to ensure that all personnelassociated with a nonclinical laboratory study will be familiar withand use the same procedures. These requirements will prevent theintroduction of systematic error in the generation, collection, andreporting of data, and they will ensure the quality and integrity oftest data that are submitted to FDA to become the basis for decisionsmade by the agency. The Commissioner recognizes that therequirements for standard operating procedures may place anadditional burden on testing facilities, but finds that the resultingbenefits should outweigh the burden. The requirements will benefitthe public by producing better quality data and will benefit thetesting facility by reducing the need to repeat nonclinical laboratorystudies because of errors in the data.

This concludes the excerpts from the preamble to the final rule. Ms. Brian and I lookforward to receiving your comments on the important subject of CDRH's enforcement ofthe GLP regulation.

Sincerely,

Ned Feder. M.D.Staff ScientistProject On Government Oversight666 11th Street, NW, Suite 900Washington, DC 20001Phone: 202-347-1122Fax: 202-347-1116nfeder@pogo.org

Copies:Adrienne Burns, Executive Assistant, Office of the Director, CDRH (by email)Danielle Brian, Executive Director, Project On Government Oversight

-4-

DEPARTMENT OF HEALTH & HUMAN SERVICES Public Health Service

Food and Drug Administration9200 Corporate BoulevardRockville, Maryland 20850

May 27, 2008

Ned Feder, M.D.Project on Government Oversight666 1 1 th Street, NW, Suite 900Washington, DC 20001

Dear Dr. Feder:

This is in response to the letter from you of May 13, 2008, and to the letter from you andDanielle Brian of April 30, 2008, concerning Good Laboratory Practice (GLP)requirements (21 CFR Part 58) and the Center for Devices and Radiological Health's(CDRH) regulation of medical devices intended for human use. CDRH's medical deviceprogram incorporates the use of GLPs to provide a level of assurance of the quality andthe safety data used to support a premarket submission. GLPs are incorporated byreference in the premarket submission requirements under section 520(g) of the FederalFood, Drug, and Cosmetic Act (the act) [21 U.S.C. 360j(g)]; section 515 [21 U.S.C.360e]; and section 510(k) [21 U.S.C. 360(k)].

Section 520(g) of the act requires that an investigational device exemption (IDE) containadequate scientific data to support a premarket approval application. The implementingregulation requires a sponsor to confirm in writing that conduct nonclinical studiescomplies with GLP regulations. The regulation states,

General. The report of prior investigations shall include reports of all priorclinical, animal, and laboratory testing of the device and shall be comprehensiveand adequate to justify the proposed investigation. (21 CFR §812.27(a))

If information on nonclinical laboratory studies is provided, a statement that allsuch studies have been conducted in compliance with applicable requirements inthe good laboratory practice regulations in part 58, or if any such study was notconducted in compliance with such regulations, a brief statement of the reason forthe noncompliance. Failure or inability to comply with this requirement does notjustify failure to provide information on a relevant nonclinical test study. (21CFR §812.27(b)(3))

Page 2 — Project on Government Oversight

Section 515 of the act requires the approval of a premarket approval application (PMA)to obtain authorization to market a class III device. The implementing regulation for anapproved PMA requires, under 21 CFR 814.20(b)(6)), that the sponsor submit results ofnonclinical laboratory studies to support a determination by FDA that a device is safe andeffective for its intended use. The sponsor must also affirm in writing that each studywas conducted in compliance with 21 CFR Part 58. The regulation states,

The following technical sections which shall contain data and information insufficient detail to permit FDA to determine whether to approve or deny approvalof the application; (21 CFR 814.20(b)(6))

A section containing results of the nonclinical laboratory studies with the deviceincluding microbiological, toxicological, immunological, biocompatibility, stress,wear, shelf life, and other laboratory or animal tests as appropriate. Informationon nonclinical laboratory studies shall include a statement that each such studywas conducted in compliance with part 58, or, if the study was not conducted incompliance with such regulations, a brief statement of the reason for thenoncompliance. (21 CFR 814.20(b)(6)(i))

Section 510(k) of the act requires the submission of a premarket notification to obtainclearance to market a class II device based on a finding of substantial equivalence to apredicate device. The implementing regulations for a 510(k) require that the applicantsubmit summary information of nonclinical laboratory studies for which a determinationof substantial equivalence is based on an assessment of performance data. The regulationrequires,

A brief discussion of the nonclinical tests submitted, referenced, or relied on inthe premarket notification submission for a determination of substantialequivalence; (21 CFR 807.92(b)(1))

The conclusions drawn from the nonclinical and clinical tests that demonstratethat the device is as safe, as effective, and performs as well as or better than thelegally marketed device identified in paragraph (a)(3) of this section. (21 CFR807.92(b)(3))

GLPs are intended to assure the quality and integrity of data that support IDE, PMA, and510(k) premarket submissions. During the review of a premarket submission, CDRHmay request additional GLP information and inspect the facility, as appropriate,regarding studies conducted within the scope of part 58. GLPs serve to inform ourdetermination that a device meets the relevant statutory criteria for approval or clearance.

In most cases, where human testing is required, CDRH believes that focusing on theclinical trial phase of the device development process is the optimal strategy forprotecting human subjects. CDRH is generally not notified of ongoing animal deviceresearch because regulated industry is not required to report such activity until an IDE ormarketing application is submitted to CDRH.

Page 3 — Project on Government Oversight

If you know of any specific instances that indicate a link between GLP non-complianceand significant public health issues either in the premarket or postmarket area, you maysubmit such information to us for review. Based on our assessment of the informationsubmitted by you, we will make an appropriate follow up.

I hope this information clarifies our view on the regulatory role of GLPs and theapplicable statutory and regulatory requirements served by GLP requirements. Webelieve that adherence to the information requirements of IDE's, PMA's, and 510(k)'sprovide a sufficient basis to ensure compliance with the intent of GLPs.

Sincerely yours,

Casper E. UldriksAssociate DirectorRegulatory Guidance and

Government AffairsCenter for Devices and

Radiological Health

Cc: Danielle Brian