Meeting the information demands of business executives,
regulators and counsel in the pharmaceutical industry.
Kenneth N.
Rashbaum
It was, as the song goes, oh so simple then. Manufacturing and sales data, safe and comfortable in their databases, were taken out a few times each year when the financial people and lawyers needed to process and input them for SEC submissions. Then came e-mail, but that was a relatively tame beast in the beginning, simple communications of a few paragraphs, at most, between employees sitting at desktops. Yes, the CIO says wistfully, removing her glasses and nodding, those truly were the days.
She clicks on a blinking icon to find emergency requests from outside counsel for a collection of e-mails from company facilities in four countries in a products liability matter; from the audit committee for e-mails and text messages for an internal investigation into controls on information assets; from the marketing department requiring responses for the Web 2.0 application in response to a tidal wave of requests about a product recall; and from the Massachusetts Attorney General demanding to examine the information security policies for an investigation into the loss of a box of backup tapes containing patient-identifiable clinical trial data.
As pharmaceutical and other life sciences companies expand their global reach, their internal information-sharing and retention demands multiply faster than bacteria in a Petri dish. Add to this the requirements of federal, state and international laws governing disclosure of patient-identifiable information, penalties and sanctions for failures to produce requested information and the need to interact with customers and patients through social media, and it is little wonder that the CIO in the preceding paragraphs may be counting down her days to retirement.
But someone will replace her, and that person will need guidance on how to juggle all these information requests and responses while keeping the company's IT wheels turning. The solution will be found in an information-management initiative facilitated by an interdisciplinary team comprising records management, IT, compliance, business owners, marketing and counsel. In this way, the needs of the business owners, compliance, corporate governance and legal can be met according to a defined process, thereby reducing the need for information-demand “fire drills.”
A good place to start is the data map. The information universe of most pharmaceutical companies can be broken down into three categories: business data (manufacturing, sales, clinical trials, product promotion, HR and corporate governance); business communications and interactive media (Web sites and social media). Demands for production of digital information may touch any or all of these areas. The data map is an initiative that will document the types of information requests the company faces (mapping the issues); the categories of information in the three divisions indicated above (e.g., databases, reports from a variety of sources, communications); and repositories for those data (desktops, servers, cloud repositories, backup media and portable media such as laptops, USB drives and mobile devices). In this way, the company can have a clear perspective on where its data is located so that it can be accessed and produced in a timely fashion, whether for the business units, corporate governance, regulators or courts.
Next, the information retention protocols, many of which may not have been updated for the digital era, should be reviewed and reassessed. The retention protocols should include a process for issuance and implementation of a legal hold. The hold, which became a U.S. national standard in the wake of the five opinions in the U.S. District Court case of Zubulake v. UBS Warburg, LLC, requires that, when a company is involved with or reasonably anticipates litigation, it suspend, by written notice and follow-up, deletion of potentially relevant data.
Finally, the company would be well advised to form an interdisciplinary disclosure-response team that will direct the compliance with (or objection to) external demands for company information, as well as data required for social media sites and customer interaction.
These initiatives, with their teams that keep current on business, legal and industry practices, can help provide maps for information uses and disclosures to keep the company on the straight path even as the guideposts of regulations and technology shift.
Kenneth N. Rashbaum, Esq., is
principal of Rashbaum Associates,
LLC in New York.
For more information on
Rashbaum Associates, LLC:
www.rsleads.com/104ht-202
