Research · 11 min read
What FDA Will and Will Not Release About a Company
The agency's own disclosure rules say the default is release, name four categories that stay back, and give the company that submitted a record a chance to object first. Knowing which category a document falls into explains most of what you can and cannot get.
Key takeaways
- The stated policy is fullest possible disclosure, and withholding requires either a foreseeable harm to an exemption-protected interest or a legal prohibition.
- No justification or need has to be shown to get a nonexempt record.
- A record released to one member of the public is available to all, except for trade secret, confidential commercial and personal privacy material.
- A redacted record must indicate how much was deleted, where feasible mark it at the deletion site, and note the exemption used.
- Business and product names cannot be redacted on privacy grounds, though another exemption may still apply to them.
- The identity of a voluntary adverse event reporter is protected against a request, demand or order, binds manufacturers as well as the agency, and preempts contrary state requirements.
- A submitter's confidentiality designation must be in writing and expires 10 years after the records were submitted.
- A submitter gets 10 working days to object, and a five-working-day window after a disclosure notice before release.
- Enforcement records open once consideration of enforcement action is closed, with closure defined separately for administrative and court action.
- Voluntarily submitted safety, effectiveness and functionality data for a marketed product is disclosable unless extraordinary circumstances are shown; manufacturing methods and formulas are not.
Answer first: the default is disclosure
The policy sentence sits at the front of the part and it points one way.
The agency will make the fullest possible disclosure of records to the public, consistent with four named interests. Individual privacy rights. The property rights of persons in trade secrets and confidential commercial or financial information. And the need to promote frank internal policy deliberations and to pursue regulatory activities without disruption.
Then the operative rule. Except where specifically exempt, all agency records are made available for public disclosure.
Withholding has two triggers and only two. The agency will withhold requested information only if it reasonably foresees that disclosure would harm an interest protected by an exemption described in the part, or if disclosure is prohibited by law.
One more line removes a common obstacle. All nonexempt records are made available upon request regardless of whether any justification or need for them has been shown.
Released to one person means released to everyone
A single rule here does more work than any other in the part.
Any record of the agency that is disclosed in an authorized manner to any member of the public is available for disclosure to all members of the public.
Two carve-outs follow. Material exempt as trade secrets and confidential commercial or financial information, and material exempt for personal privacy, is disclosed only to the persons for whose protection those exemptions exist.
A record about an individual retrieved by name from a privacy record system is also treated separately, and giving that record to the person it is about does not open it to everyone else.
The practical reading is short. If a document has been released once under this part, it is not a special favor when somebody else gets it. A claim of exclusive access to such a record does not match the rule.
A redaction has to show its work
Partial release is the normal outcome, and the regulation says what a redacted page must look like.
If a record contains both disclosable and nondisclosable information, the nondisclosable part is deleted and the rest is disclosed. Two exceptions apply: where the two are so inextricably intertwined that separating them is not feasible, or where releasing the disclosable part would compromise or impinge on the rest.
Then three requirements about the markings. The amount of information deleted must be indicated on the portion made available, unless indicating it would itself harm a protected interest.
When technically feasible, the amount deleted is indicated at the place in the record where the deletion is made.
And the exemption under which information was deleted is noted at the site of the deletion.
So a properly produced redacted document tells you roughly how much was removed and under which category. A page of black with no markings is not what the rule describes.
The four categories that keep a document back
Most withholding in this area falls into four buckets, and each has its own definition.
The first is trade secrets. A trade secret may consist of any commercially valuable plan, formula, process or device used for making, preparing, compounding or processing trade commodities. It has to be something that can be said to be the end product of either innovation or substantial effort. There must be a direct relationship between the trade secret and the productive process.
The second is confidential commercial or financial information. It is defined as valuable data used in one's business, of a type customarily held in strict confidence or regarded as privileged. It must also not be disclosed to any member of the public by the person to whom it belongs.
The third is internal deliberation. Interagency or intra-agency memoranda or letters that would not be available by law to a litigation opponent may be withheld, except that reasonably segregable factual information is available. The deliberative process privilege does not apply to records created 25 years or more before the request.
The fourth is personal privacy, and it is the one that reaches patients. Names or other information that would identify patients or research subjects in any medical or similar report, test, study or research project are deleted before a record is made public.
The privacy exemption does not cover a brand name
One paragraph closes a door companies sometimes try.
Requests to delete business or product names before disclosure are not granted on the ground of privacy. That deletion may still be justified under a different exemption, such as the trade secret and confidential information one.
Names of individuals conducting investigations, studies or tests on products or ingredients are not deleted before disclosure unless extraordinary circumstances are shown.
There is a limit running the other way. A request for all records relating to a specific individual is denied as a clearly unwarranted invasion of personal privacy unless it comes with that individual's written consent.
The person who reported a side effect is protected by name
This provision is unusually strong and it binds more than the agency.
Names and any information that would identify the voluntary reporter are not disclosed in response to a request, demand or order. The same is true of any other person associated with an adverse event involving a human drug, biologic or medical device, and the bar reaches a manufacturer holding such reports as well as the agency.
The regulation spells out what counts as identifying. Name, address, institution, or any other information that would lead to the identities of the reporter or persons identified in a report.
Three exceptions exist. Written consent from both the voluntary reporter and the person identified. A court order in the course of medical malpractice litigation involving both parties. Or disclosure of the report, excluding other individuals' identities, to the person who is its subject on request.
And then a preemption clause, which is rare in a disclosure rule. No state or local governing entity may establish or continue any requirement that permits or requires disclosure of those identities except as provided in the section.
One boundary on all of that. The provision does not affect disclosure of the identities of reporters who are required by federal statute or regulation to make adverse event reports.
The company gets told before its document goes out
This is the step that explains why a records request can take a long time.
A person who submits records may designate part or all of the information as exempt under the confidential-information exemption, either at submission or within a reasonable time afterward. The designation has to be in writing.
That designation expires. Any such designation will expire 10 years after the records were submitted to the government.
When a request arrives for designated records and the agency determines disclosure may be required, it makes reasonable efforts to notify the submitter. The notice includes a copy of the request and the procedures and time limits for objecting.
The submitter has 10 working days from the date of the notice to object and to state all bases for the objection, and that period can be extended as appropriate and necessary.
If the agency decides to disclose anyway, it notifies the submitter in writing and briefly explains why the objections were not sustained. It includes a copy of the records as it proposes to disclose them. And it states that it intends to release them five working days after the submitter receives the notice, unless a court orders otherwise.
The requester is kept in the loop as well, and is told both that the submitter is being given a chance to object and, later, that the disclosure notice has gone out.
Enforcement records open when the matter closes
Timing, not category, is what usually keeps an enforcement file back.
Records compiled for law enforcement purposes may be withheld on several grounds. To the extent disclosure could reasonably be expected to interfere with enforcement proceedings, or deprive a person of a right to a fair trial or impartial adjudication. Or to constitute an unwarranted invasion of personal privacy, or reveal a confidential source.
Two more grounds cover technique and safety. Disclosure of investigative or prosecutorial techniques and guidelines where that could risk circumvention of the law, and anything that could reasonably be expected to endanger the life or physical safety of any individual.
The clock rule is the important part. No such record is available before consideration of regulatory enforcement action based on it is closed, and after it is closed the records are made available except where another exemption applies.
Closed is defined. For administrative action, when a final decision has been made not to act or the action has been taken and the matter concluded. For court action, when it has been finally declined, or instituted and concluded through all related appeals, or the statute of limitations runs.
Two more rules sit alongside. No statements of witnesses obtained through promises of confidentiality are available. And before releasing a record reflecting consideration of possible criminal prosecution, names identifying someone considered but not prosecuted are deleted unless there is a compelling public interest.
Two doors that open an otherwise exempt record
Exempt is not the same as sealed, and the part names two ways through.
The first is prior public disclosure. An otherwise exempt record is available to the extent it contains data that have previously been disclosed in a lawful manner to any member of the public.
That has careful limits. Several kinds of disclosure do not count as public. Disclosure to an employee. Disclosure to a consultant where it was necessary to perform that specific service and limited to the number reasonably needed. And disclosure under licenses, contracts and similar arrangements with safeguards for secrecy. Nor does disclosure to clinical investigators or review committee members with appropriate secrecy safeguards.
The second door is discretion. The Commissioner may disclose part or all of an otherwise exempt record where that is in the public interest and consistent with the interests the policy section names.
That discretion has hard edges. It may not be used for four kinds of record. Those exempt as trade secrets or confidential commercial information, those exempt for personal privacy, those prohibited from disclosure by statute, and privacy-system records where release would be a clearly unwarranted invasion.
And a discretionary release is not a precedent. It triggers the rule that the record goes to anyone who asks, but does not oblige the Commissioner to release any similar or related record.
What voluntary submissions are treated as
A separate section governs material handed over without being required, and it is more open than most people expect.
It applies only to data submitted voluntarily, whether during a factory inspection or at any other time, and not as part of a petition, application, master file or other required submission. Anything that could have been required but was volunteered instead is handled as if it had been required.
Several categories are available for public disclosure unless extraordinary circumstances are shown. All safety, effectiveness and functionality data for a marketed ingredient or product. A protocol for a test or study, unless it falls within the confidential-information exemption. An assay or other analytical method, unless it serves no regulatory or compliance purpose and is confidential.
Ingredient lists are on the open side too, including a list of all active ingredients and any previously disclosed inactive ingredients in a drug.
The closed side is where the manufacturing lives. Safety data for a developmental product not previously disclosed, manufacturing methods or processes including quality control procedures, production and sales and distribution data, and quantitative or semiquantitative formulas.
Adverse reaction reports have their own handling that depends on who filed them, with different deletions for a consumer, a manufacturer and a third party such as a physician or hospital.
One list that is worth knowing exists
The part also names specific things kept available rather than requested.
Computer printouts are available for public inspection in the agency's freedom of information reading room. One is a numerical listing of all new drug applications and abbreviated applications approved since 1938. It shows the application number, trade name, applicant and approval date, and where applicable the withdrawal date and the date the agency was notified that marketing was discontinued.
A second listing covers those still approved. A third covers marketed prescription drug products. It includes the active ingredient, dosage form, route of administration, trade name, application holder and strength. It also carries a therapeutic equivalence evaluation where more than one application covers the same active ingredient and dosage form.
The part also cross-references dozens of other regulations that set the disclosure status of specific record types. Drug establishment registrations and drug listings, investigational new drug notices, new drug application files, and public advisory committee minutes each have their own section elsewhere.
What this page does not tell you
Two boundaries, stated where you can see them.
Everything above describes the agency's own public information regulations. It does not report what has been released about any company, and no records request was made.
The rules for a drug application file itself sit in a different regulation with its own approval-day switch, and that regulation is not re-explained here. The part described above is the general machinery underneath it.
Sources
- 21 CFR Part 20 — Public InformationSection 20.20(a) for the fullest-possible-disclosure policy and the four interests it is balanced against; 20.20(b) for all records being available except where specifically exempt and for the two withholding triggers — reasonably foreseeable harm to an interest protected by an exemption, or disclosure prohibited by law; 20.20(c) for nonexempt records being available regardless of whether any justification or need has been shown; 20.20(d) for the narrow purpose-and-certification exception tied to a Privacy Act Record System. Section 20.21 for any record disclosed in an authorized manner to any member of the public being available to all members of the public, and for the carve-outs covering 20.61 and 20.63 material and privacy-system records. Section 20.22(a) for partial disclosure and the inextricably-intertwined limit; 20.22(b)(1) through (3) for indicating the amount of information deleted, marking it at the deletion site where technically feasible, and noting the exemption at the site of the deletion. Section 20.61(a) for the trade secret definition including the requirement of a direct relationship between the trade secret and the productive process; 20.61(b) for confidential commercial or financial information; 20.61(d) for a written designation made at submission or within a reasonable time and expiring 10 years after submission; 20.61(e)(1) for reasonable efforts to notify the submitter with a copy of the request and the objection procedures; 20.61(e)(2) for the 10 working days to object and state all bases, extendable as appropriate and necessary; 20.61(e)(3) for the written notice briefly explaining why objections were not sustained, the enclosed records as proposed for disclosure, and the intent to disclose 5 working days after receipt unless a U.S. District Court orders otherwise; 20.61(e)(5) for notifying the requester at both stages. Section 20.62 for interagency and intra-agency memoranda, the segregable factual information rule, and the deliberative process privilege not applying to records created 25 years or more before the request. Section 20.63(a) for deleting names or other identifying information for patients or research subjects; 20.63(c) for business and product name deletions not being granted on privacy grounds though another exemption may justify them; 20.63(d) for names of individuals conducting investigations, studies or tests not being deleted absent extraordinary circumstances; 20.63(e) for denial of a request for all records relating to a specific individual without that individual's written consent; 20.63(f) for non-disclosure of the voluntary reporter's identity and identities of persons associated with an adverse event by FDA or by a manufacturer in possession of the reports, in response to a request, demand or order, the definition of identifying information, and the carve-out for reporters required by federal statute or regulation to report; 20.63(f)(1) for the three exceptions and 20.63(f)(2) for the preemption of state or local requirements. Section 20.64(a) for the six grounds for withholding law enforcement records; 20.64(d)(1) and (d)(2) for records being unavailable before consideration of enforcement action is closed and available afterward except where another exemption applies, and for statements of witnesses obtained through promises of confidentiality; 20.64(d)(3) for the definition of closed for administrative and court action; 20.64(d)(4) for deleting names of those considered for criminal prosecution but not prosecuted absent a compelling public interest. Section 20.81(a) for previously disclosed data opening an otherwise exempt record, and (a)(1) through (a)(3) for the consultant, commercial arrangement and clinical investigator limits. Section 20.82(a) for the Commissioner's discretionary disclosure; 20.82(b) for the four records it may not reach; 20.82(c) for a discretionary disclosure invoking the uniform-access rule while setting no precedent. Section 20.85 for disclosure to other federal departments under a written agreement restricting further disclosure. Section 20.111(a) for the section applying only to voluntary submissions and for material that could have been required being handled as required; 20.111(c) for the categories disclosable unless extraordinary circumstances are shown, including safety, effectiveness and functionality data for a marketed product, a protocol unless confidential, ingredient lists, and an assay or analytical method unless it serves no regulatory or compliance purpose and is confidential; 20.111(c)(3) for the different deletions applied to adverse reaction reports depending on whether a consumer, a manufacturer or a third party submitted them; 20.111(d) for the categories not available, including developmental-product data not previously disclosed, manufacturing methods or processes including quality control procedures, production, sales and distribution data, and quantitative or semiquantitative formulas. Section 20.117(a) for the computer printouts available for public inspection in the freedom of information public room and the fields each listing carries. Section 20.100(c) for the cross-referenced regulations setting the disclosure status of specific record categories, including drug establishment registrations and drug listings, investigational new drug notices, new drug application files, and public advisory committee minutes.
Frequently asked questions
Is FDA's default to release or to withhold?
To release. The policy section says the agency will make the fullest possible disclosure of records to the public. That is stated as consistent with privacy rights, property rights in trade secrets and confidential commercial or financial information, and the need for frank internal deliberation and undisrupted regulatory work. Except where specifically exempt, all records are made available, and the agency withholds only if it reasonably foresees harm to an interest protected by an exemption, or if disclosure is prohibited by law.
Do I need a reason to ask for a record?
No. All nonexempt records are made available upon request regardless of whether any justification or need has been shown. A narrow exception applies to discretionary disclosure of a record held in a privacy record system about someone other than the requester, where a statement of purpose and a certification of use may be requested.
If a document was released to a reporter, can I get it too?
Generally yes. Any record disclosed in an authorized manner to any member of the public is available for disclosure to all members of the public. There are exceptions. Material protected as trade secrets or confidential commercial information, and material protected for personal privacy, go only to the persons for whose protection those exemptions exist. Records in a privacy system about a named individual are treated separately again.
Why does a records request take so long?
Often because the company that submitted the record gets a turn first. A submitter may designate information as exempt in writing, and where such records are requested the agency makes reasonable efforts to notify the submitter, who has 10 working days to object and state all bases. If the agency still decides to disclose, it explains why the objections were not sustained and waits five working days after the submitter receives that notice unless a court intervenes.
Can a company have its own name redacted for privacy?
No. Requests for deletion of business or product names before disclosure are not granted on the ground of privacy. Such a deletion can still be justified under a different exemption, such as the one for trade secrets and confidential commercial or financial information. The privacy category itself does not reach a company or brand name.
Is the person who reported a side effect identified?
Not by the agency and not by a manufacturer holding the report. Names and any information that would identify the voluntary reporter are not disclosed in response to a request, demand or order. Nor is anything identifying another person associated with an adverse event involving a drug, biologic or device. Identifying information includes name, address, institution or anything else that would lead to those identities. Written consent from both parties, a court order in malpractice litigation involving both, and disclosure to the subject of the report are the stated exceptions.
When do enforcement records become public?
When the matter closes. No law enforcement record is available before consideration of regulatory enforcement action based on it is closed; afterward it is released except where another exemption applies. For administrative matters, closed means a final decision not to act, or an action taken and concluded. For court action it means a final declination, or institution and conclusion of the case and all related appeals, or the running of the statute of limitations.
Does an exempt record ever come out?
Two ways. First, prior public disclosure. An exempt record is available to the extent it contains data previously disclosed in a lawful manner to a member of the public. That does not include disclosure to employees, to consultants within narrow limits, under commercial arrangements with secrecy safeguards, or to clinical investigators and review committee members with such safeguards. Second, the Commissioner's discretion, which cannot reach trade secrets, personal privacy material, statutorily prohibited records, or privacy-system records where release would be a clearly unwarranted invasion.