Two years ago, a consortium of major pharmaceutical firms began developing an electronic signature standard called SAFE (Secure Access for Everyone). The standard, maintained by the non-profit SAFE-Biopharma Association, consists of operating procedures and technical specifications for distributing identity credentials among collaborators and with regulatory agencies.
This week, Mollie Shields Uehling, president and CEO of SAFE-BioPharma, chaired a session on digital signatures and identity management at the Drug Information Association's annual meeting in Philadelphia. BioInform caught up with Shields Uehling by phone to get caught up on the status of the SAFE initiative and the standard.
I spoke to Guy Tallent about SAFE last year [BioInform 06-27-05]. Can you provide a general overview of the initiative's progress over the last year?
There's been a great deal accomplished over the last year. Right before DIA last year, SAFE was still a standard in early development, and since that time, we've further refined the standard and made some very pragmatic changes to it; we have created a legal entity of the SAFE-Biopharma Association; we have hired staff; we have done an FDA auditor-familiarization and -training program jointly with the FDA in which we jointly developed a manual — an inspection manual — and then a training program; [and] we've done a [standard operating procedure] for members so they know what to do.
At that time I believe we had almost completed a technical pilot with the National Cancer Institute. Well, that was completed, and we are now initiating an operational pilot, which will credential up to a couple hundred of NCI's principal investigators. The initial application is the [Food and Drug Administration's] 1572 [form], which is the investigator statement. It includes the clinical trial protocol, the CV of the investigator, the IRB, all of the key sub-investigators, and the financial statement of the investigator. It is the most redundant and most frequently submitted form to the FDA every year. Some 200,000 to 240,000 of these are submitted every year to the FDA. And this will be the first instance in which industry and the NCI are collaborating so the investigators will create this form in a secure, shared environment, they'll make all changes online, they'll sign it, and they'll submit it to NCI sponsor firms, which in turn will submit it electronically to the FDA, and it will be reviewed by the FDA digitally. So it will be a paperless transaction for the SAFE pilot.
So it's very collaborative and a real example of the direction we're all headed in, in terms of collaborative R&D.
With the European Medicines Evaluation Agency, we are now running a pilot, which is a technical pilot to show how it works and that it works, and it involves EMEA, Organon, Pfizer, GlaxoSmikthKline. The European Commission has already found that the SAFE digital signature meets the EU digital signature directive, and it's looking at affirming as to whether there are any legal issues within the member states. We do not believe there are, but it will be an official communication from the commission in that regard.
Also the EMEA is looking at the auditability of the SAFE digital signature. So, much of the work that we developed for the FDA will be reconfigured and applied in a way that's appropriate for the European environment.
In the last year the FDA has accepted SAFE-signed 1572s, and it has indicated to a couple of members that it would accept INDs and NDAs that are SAFE-signed. So we have a couple members who are working on those submissions, but they have not been submitted yet.
We have a number of member companies that are doing proofs of concept and pilots in various areas. One area is e-sampling, where doctors are getting the SAFE identity credential, and will order online and sign for samples using the SAFE identity and digital signature. Other companies are doing pilots in clinical as well as in [the US Securities and Exchange Commission's] Sarbanes-Oxley [financial-reporting] requirements, particularly where signatures are required, to replace the wet signatures with digital signatures.
In these pilot projects, are you finding that this technology is replacing piles of paper, or are the early adopters still using it in parallel with paper submissions?
They're still doing them both in parallel. One of the reasons for SAFE in the first place is because of the unique nature of the industry, in that there is the regulatory environment, the need to meet regulatory standards, and the need for legal enforceability, and certainly the risk management. So when you change from paper-based processes, which are regulatory, you have to align everyone in the organization. So you need legal, you need IT, you need clinical, you need regulatory. If it's marketing, you need marketing, and a whole host of others. So you have to align the whole organization around it, develop new SOPs, show that it works, and then sort of build confidence within the organization that this works. So, initially it's an investment, and your savings aren't right in the offing. They're a year or two away from the companies who right now have these back-up paper-based processes.
What about on the regulatory side? How much openness are you seeing from the FDA in terms of adopting this?
They are accepting digital signatures, electronic signatures, right now. It's here. Certainly with the joint inspection manual and the training program, we're ramping that up and doing a more intensive set of training with the FDA in July.
So it's moving. Is it here? Is it normal practice? No. But SAFE is not sexy, new technology. It's not a silver bullet. What's neat about SAFE is the high standard of identity assurance, the digital signature that you can validate at the time of signing, and 10 years later, it's sort of all of these elements, and all of these have the potential to be transformational in the industry. But it's step by step by step, and we're still in the early phases. Although we're in the "do" phase rather than the "create" phase right now.
Also, one of the things our member companies want is off-the-shelf applications. So we have been working with a number of vendors to SAFE-enable their applications. So, for example, Adobe, Cybertrust, Arcot — a number of companies are SAFE-enabling applications.
In addition, one of our member companies, Pfizer, created something called the Universal SAFE Signing Interface, and this is like a server you can put out there and people from within your company or elsewhere can put a document out there, you can sign it, and then you're notified when it's signed and you can take it down off the server.
They've made that open source, so we have a number of vendors who are using that to SAFE-enable their applications, and we have companies who are creating their own internal servers to find documents.
Is that available through the SAFE-Biopharma website?
It has just gone open source. If it's not on the website now, it will be.
It's unusual for pharmaceutical companies to be willing to share technology like that.
That's what's been so unique about SAFE. SAFE-Biopharma consists of a bunch of companies that are really early adopters and have this vision of a paperless industry. So they're motivated. A rising tide lifts all boats. So it's been very interesting, because member companies, as they do pilots and implementations, are inviting other companies over to learn from them. Not across the boards, but certainly in clinical, some of the regulatory. It's been very interesting and very, very collaborative.
Are you seeing any use of this technology in early discovery, or is it really still in the regulatory and clinical trials phase of the pipeline?
It's not in the discovery phase yet, but certainly there are potential applications for it — toxicology, lab work, that kind of thing. It has the potential. It's not being used there and we don't have pilots that we know of in that area yet.
I guess the same kind of pressure isn't there.
Yet. But the pressure is on the industry to become more efficient, more productive. That's one of the funny things about the industry, in that it's one of the biggest users of informatics in the world, except in its business practices. And there, it's got one of the lowest penetration rates of any sector. So Wall Street and others have been saying, 'Hey, you've got to fix the infrastructure cost as well as the efficiency.' The industry is just a million collaborators — deals, alliances, joint ventures, co-marketing, outsourcing — and all of that requires the ability to know with high assurance that the other person at the end of the Internet is who he or she says he is, and secondly, that they can sign a document that will have the same force in law as a notarized wet signature. So it's coming. It just doesn't happen overnight.
What are your short-and long-term goals going forward? Have you passed the most difficult hurdles now that you're in the 'do' phase? Now that people have started to adopt this, do you see it building critical mass in the next year or so?
Yes, I think over the next year or so that we'll see a critical mass, particularly in the clinical area, because that is where many companies are focused. What we have out there are a whole host of investigators who do clinical research or clinical trials for a variety of sponsors, and so that is one of the first areas that we're focused on.
What we have now are lots and lots of operational pilots, and I think what we'll be seeing over the next year is more and more project implementation. For example, with e-sampling — you'll see that rolled out with hundreds of doctors. Then you'll see the NCI, after we finish the operational pilot of a couple hundred investigators, over the next few years, we'll be issuing credentials to 13,500 principal investigators. And others. [At] one of our member companies we have issued credentials to a couple hundred clinical investigators. So I think you'll see more and more operational-level [projects], and then it's going to take a couple of years before you see really widespread adoption.
Again, change doesn't take place overnight.
The NCI application is really interesting because NCI has a memo of understanding with SAFE and a memo of understanding with the FDA to allow all of this to transpire. So as we move through the operational pilot and into full production, I think that is going to be an example for the industry of a collaborative digital environment in which investigators, companies, the research arm of the government, and the regulatory arm of the government, can operate efficiently and in a collaborative manner that works for the benefit of all the enterprises involved.
What's the timeline for the NCI project?
The operational pilot will be completed this fall, and then we'll start rolling out the full project. So by the end of this year.