[00:00.000 --> 00:04.320] Hi, everybody. I am Muhammad Ali from Borenger Ingelheim. I lead the digital development [00:04.320 --> 00:09.780] group over there under ClinOps. And I'm here now today to have a fireside chat with Dr. [00:09.780 --> 00:14.220] Amy Abernathy, the Deputy Chief Commissioner for the FDA and the CIO. So looking forward [00:14.220 --> 00:19.160] to discussion with her. I'm sure she has wonderful insights, and we would love to get her perspective [00:19.160 --> 00:26.020] on many things here regarding biosecurity, medical devices, and the overall digital health [00:26.020 --> 00:27.760] space. Dr. Abernathy? [00:28.480 --> 00:32.980] Hi, it's great to meet you, and it's great to be here with you and talk about a pretty [00:32.980 --> 00:35.040] important topic from my perspective. [00:36.560 --> 00:41.820] Fantastic, fantastic. So now with the midst of this pandemic kind of ravaging within the [00:41.820 --> 00:48.260] United States and pretty much many parts of the world, there has been a huge bits of pressure [00:48.260 --> 00:53.300] on enhancing the digital tools and landscape of the ability of types of data that we're [00:53.300 --> 00:58.380] collecting on patients and population in real world. And with increased investments [00:58.380 --> 01:03.200] in digital health so far this year, so far hitting 9 billion just in the first half, [01:03.200 --> 01:08.680] which has been a record so far to date, where do we see the role of real-world evidence [01:08.680 --> 01:13.800] playing in really understanding what to learn about patients and the FDA's perspective around [01:13.800 --> 01:16.880] using real-world evidence for this reason? [01:17.510 --> 01:25.240] So first of all, as I think about the pandemic, if I imagine where we are right now and where [01:25.240 --> 01:32.320] we're going to need to be in managing this virus and the health of our population, we [01:32.320 --> 01:41.880] need to rapidly answer a huge swath of questions right now, which means that while the best [01:41.880 --> 01:48.460] way to answer critical questions is through thoughtful experimental designs like randomized [01:48.460 --> 01:54.860] control trials, we don't have enough clinical trial capacity or enough time to use clinical [01:54.860 --> 01:58.940] trials for every question sitting in front of us. And so we're going to need to leverage [01:58.940 --> 02:04.000] all the data sources currently available, including data sources that are classically [02:04.000 --> 02:09.080] called real-world data sources. These are electronic health records and claims data, [02:09.080 --> 02:17.660] but also include information from social media feeds or from a fitness watch. So many different [02:17.660 --> 02:25.340] data sources that describe a person's health, their activities, what they've experienced, [02:25.340 --> 02:29.980] potential adverse effects of interventions or treatments. We're going to not only need [02:29.980 --> 02:36.320] to learn how to use this information and put it to use for critical questions in COVID-19, [02:36.320 --> 02:41.340] we're going to need to understand when we can rely on it, when is it adequate and credible, [02:41.340 --> 02:46.540] and when do we need to now really direct our clinical trial resources to answer those [02:46.540 --> 02:52.720] questions where real-world data can't help us. That's very helpful. Now, you mentioned social [02:52.720 --> 02:57.640] media. So what would be some of the steps or examples the FDA has taken to kind of discern [02:57.640 --> 03:01.840] what would be a real data source on social media that will be verified versus that of, let's say, [03:01.840 --> 03:06.960] bot posting, that that may lead to some understanding which is not true or lead to [03:06.960 --> 03:13.060] an incidence for patients which could cause potential harm? So before I go to how we might [03:13.060 --> 03:17.140] deal with social media and bots, maybe what I'll do is back up a couple of steps to think about [03:17.140 --> 03:24.060] what we're learning about where real-world data might be put to task. And that will then help us [03:24.060 --> 03:29.600] start to address the questions that you've brought up around social media. So at FDA, [03:29.600 --> 03:34.080] we have been participating in a number of projects inside the agency and outside the agency [03:35.400 --> 03:40.360] to utilize real-world data to address our critical questions. And as we've been doing that, [03:40.360 --> 03:45.060] we've been learning really where we can rely on it, where do we need to do additional work [03:45.060 --> 03:51.680] in order to allow real-world evidence to be credible, and where can't we rely on it. And [03:52.920 --> 03:58.780] examples are questions such as what's the natural history of COVID-19? What are the patterns of [03:58.780 --> 04:03.020] treatments patients are receiving and how have those patterns changed over time? What are new [04:03.020 --> 04:10.060] problems we're dealing with, such as the emergence of clotting disorders or the challenges of late [04:10.060 --> 04:17.780] effects to the heart? And then how does that inform, for example, what treatments may have [04:17.780 --> 04:22.260] differing impacts, both on the safety side as well as the effectiveness of treatments, [04:22.260 --> 04:27.920] and how can we think about the role of diagnostics and differing performance of diagnostics? So [04:27.920 --> 04:33.440] those are some of the kinds of questions that real-world data is being used for. Now you asked [04:33.440 --> 04:39.380] specifically about social media feeds and how do we think about that? Well, practically speaking, [04:39.380 --> 04:44.780] you can imagine that we need to take a series of developmental steps and do this quickly. So first [04:44.780 --> 04:49.280] learning how to use electronic health record data more confidently, claims data, et cetera, [04:49.280 --> 04:56.640] and then starting to layer in new information. And an example is we have been watching some [04:56.640 --> 05:03.700] pretty interesting work happening with Twitter feeds and how Twitter can help to understand [05:03.700 --> 05:10.160] signals that people are communicating about that may deserve additional deep dive attention. So, [05:10.160 --> 05:19.100] for example, one of the areas that really received a lot of attention was around clotting events. And [05:19.760 --> 05:24.700] doctors were noticing clotting events, patients were describing challenges that sounded like [05:24.700 --> 05:30.540] clotting events, which then led to increased understanding that maybe clotting was a challenge [05:30.540 --> 05:37.040] in the context of COVID-19. And so we can use, for example, social media to help to pick up signals [05:37.040 --> 05:41.540] and then use other data sets to verify those signals. And that's something we're just starting [05:41.540 --> 05:47.960] to think about. I wouldn't call this FDA-specific work, but rather work FDA is paying close attention [05:47.960 --> 05:55.780] to. The third part of your question was around where might this go awry? So, for example, [05:55.780 --> 06:02.720] how do we need to think about the role of bots and how that may create misinformation [06:03.480 --> 06:09.560] that may also be one of the signals? And, you know, first of all, be attentive, right? So, [06:09.560 --> 06:18.240] recognize that information may be misinformation and may or may not be nefarious in how it has [06:18.240 --> 06:28.840] occurred. Secondly, to do the experimentation to understand what does inadequate information, [06:28.840 --> 06:33.660] misinformation, nefarious information look like, and be able to identify that quickly. So, [06:33.660 --> 06:42.200] oftentimes, bots have particular patterns that can be identified. And then also be transparent. [06:42.200 --> 06:47.700] I mean, one of the challenges with all these new types of data sources is that perhaps you're [06:47.700 --> 06:52.820] saying, well, we're interested in learning more about how social media data can help. And [06:53.980 --> 06:59.800] the really quick retort is, oh, but that's not reliable because dot, dot, dot, one of which is [06:59.800 --> 07:08.040] bots. And by being transparent that we are curious about some of these new data sources, [07:08.040 --> 07:15.100] but we're also attentive to the potential risks and downsides allows people to know we're paying [07:15.100 --> 07:20.320] attention to all the different aspects. So, this is something that's high in our mind as we start [07:20.320 --> 07:26.500] to think about these new types of data. That's fantastic, Danelle. You mentioned risks when it [07:26.500 --> 07:31.580] comes to these platforms, et cetera. Now, with the rise of digital health and many of these tech [07:31.580 --> 07:36.920] giants really taking a foray into healthcare. Now, having been within the clinical trial space for [07:37.460 --> 07:41.400] almost two decades now, one of the primary steps to get to clinical trials is really informed [07:41.400 --> 07:45.400] consent. Because without informed consent, you really can't get anywhere. And the informed [07:45.400 --> 07:48.900] consent is always for the intended use of the clinical trial that the patient's participating [07:48.900 --> 07:54.400] for, for the data they want to collect for in that trial. Now, with these tech giants, when you have [07:54.400 --> 07:59.620] wearables and devices, even your smartphone with the 11 to 15 sensors that are embedded [07:59.620 --> 08:04.640] within the actual phone itself, you're continuously capturing data to understand not just overall [08:04.640 --> 08:08.840] demographic information, but you understand behavioral patterns, you understand behavioral [08:08.840 --> 08:14.500] impulse control, geographic location, et cetera. What is the FDA's perspective in terms, or even [08:14.500 --> 08:19.160] Amy's perspective, really in this understanding what is the patient's rights in being able to [08:19.160 --> 08:23.420] access this data to get a better understanding of themselves and how it's being used to really [08:23.420 --> 08:27.820] create new services for them that they may not even want or something they can overall contribute [08:27.820 --> 08:36.160] to in the future? Well, so you're bringing up a really important point and focus that's near and [08:36.160 --> 08:41.600] dear to my heart, which is that as we have all of these new data sources, all of these new [08:41.600 --> 08:50.820] capabilities, we also have new challenges as it relates to privacy, a person's rights, how do we [08:50.820 --> 08:54.840] know that information is being used in the way that we intended? In the context of a clinical [08:54.840 --> 09:01.000] trial, I'm an old clinical trial myself, it was quite explicit upfront. Here's what's going to [09:01.000 --> 09:07.000] happen. Here's how my information is going to be used. And those controls are already put in place [09:07.000 --> 09:14.420] in a very explicit way. Within the context of the real world data space, when it's around health, [09:14.420 --> 09:21.960] we have clear laws as it relates to, for example, HIPAA. However, as you start to talk about the [09:21.960 --> 09:29.720] consumer space, as we start to now think about products, you mentioned the smartphone that has [09:29.720 --> 09:35.320] many different sensors and where information may be used in many different ways that are sort of [09:35.320 --> 09:41.680] outside of the traditional context of health information for HIPAA. We now are in a privacy [09:41.680 --> 09:46.800] space and a data utilization space that's very different than that which we envisioned 20 years [09:46.800 --> 09:54.000] ago, to be honest. And I think we're at a place where the EULA, the agreements you sort of [09:54.000 --> 10:02.940] nonchalantly sign off on as you use different software solutions is probably becoming less [10:02.940 --> 10:09.020] and less adequate for making sure that people are fully informed about how their information [10:09.020 --> 10:14.840] is going to be used. So you asked, you know, what's FDA doing? So FDA doesn't really hold, [10:14.840 --> 10:20.620] or under rare circumstances, do we hold identifiable patient health information. [10:20.620 --> 10:26.600] And really, we work under the context of the law, as you can imagine, and that's really not our focus. [10:27.040 --> 10:34.100] So we work in that way. But we are also, though, and I am very much a part of a social conversation [10:34.660 --> 10:41.440] that's really, you know, asking, what does this look like now and into the future? And I think [10:41.440 --> 10:48.080] that as we see these different uses of information, as we also see the different challenges [10:48.080 --> 10:55.340] of how it can be misused, it's forcing us as a society to ask what is and is not okay. Right now, [10:55.340 --> 11:01.140] it's largely in the hands of tech companies that we're sort of all these stories are playing out, [11:01.140 --> 11:06.300] likely needs to be in the hands of all the different people who really are the core to [11:06.300 --> 11:12.580] not only the conversation, but the data. Exactly, exactly. That's a really good point. [11:12.580 --> 11:17.760] Thank you for that. Now, with staying with the tech space, and in terms of cybersecurity, [11:17.760 --> 11:22.260] now you have with the advent of the smartphone since 2007, many of the different applications [11:22.260 --> 11:27.960] of how we live and interact with life are now onto this little rectangular device that we have [11:27.960 --> 11:32.220] in our hands. And that would also include from a health perspective, insulin pumps, [11:32.220 --> 11:37.620] and even glucose monitors, that we can now see the actual overall results of what's happening [11:37.620 --> 11:43.240] inside our bodies on our phones. Now, with many different news articles in the last year, [11:43.240 --> 11:48.180] really coming out that these devices could be hacked into from a cybersecurity perspective, [11:48.180 --> 11:54.180] what has the FDA done to take safety steps and precautions to ensure that these devices meet the [11:54.180 --> 11:58.660] minimum criteria to ensure patient safety, and this would not happen again in the future, [11:58.660 --> 12:06.200] or at least minimize it to some degree? So as FDA, this is a huge area of concern for us. [12:06.200 --> 12:14.520] And certainly has been a core focus of our devices center, CDRH. And I commend them, [12:14.520 --> 12:19.420] but I also commend the entire community for focusing on this. And that's been done both [12:19.420 --> 12:24.560] through public-private partnerships, as well as specifically through work done at FDA, [12:24.560 --> 12:31.320] where we worry about really the development of more secure devices going forward, but also [12:31.320 --> 12:37.880] the challenge of legacy devices that still exist. For example, the insulin pump that was around [12:37.880 --> 12:48.020] since many years ago that may now have a security challenge because those have not been fully [12:48.020 --> 12:55.360] patched. And as FDA, one of the things that we've done is build partnerships. And an example of [12:55.360 --> 13:03.060] those partnerships is with actually DEFCON and the biohacking community. And when I arrived at FDA [13:03.060 --> 13:13.980] about 18 months ago, I was pleasantly surprised to learn that not only were we excited attendees [13:13.980 --> 13:19.640] of DEFCON, that we also participated in the biohacking community and had been doing so [13:19.640 --> 13:27.180] since 2014, I believe. And that in 2019, we even developed the We Heart Hackers initiative really [13:27.640 --> 13:33.620] as a part of our partnership with the white hacking community. And the interesting thing [13:33.620 --> 13:41.220] to me about this work that I've at least learned about is that there have been a number of [13:41.940 --> 13:48.000] companies participating, I think over 40 different devices that have been attempted [13:48.000 --> 13:54.600] to be hacked into and otherwise patched. And really has actually led to a community-based effort [13:54.600 --> 14:01.180] to start to resolve problems that could otherwise hurt patients if they don't get resolved. And so [14:01.180 --> 14:07.340] to me, this is an example of how the FDA has tried to be forward-leaning into this space. And instead [14:07.340 --> 14:12.820] of just writing guidances and saying thou shall or thou shalt, but actually trying to figure out [14:12.820 --> 14:19.760] how we will fix together this particular space. That's amazing. That's really good to hear. [14:20.200 --> 14:25.940] That really brings us to the end of our discussion today. Maybe some last, I guess, [14:25.940 --> 14:31.160] parting words for you, Amy, if you want to share with the audience today in terms of what you would [14:31.160 --> 14:35.740] tell the hacking community and the attendees of this overall conference and what to do and how [14:35.740 --> 14:39.880] best to contribute data so they can, I guess, better not just devices, but really the overall [14:39.880 --> 14:45.680] experience for those that use those devices. Yeah, you know, I've been thinking a lot about [14:47.240 --> 14:54.120] the realities of real-world data, how important I think it's going to be for COVID-19 and how I [14:54.120 --> 15:00.940] think that this sets a template for how we may also use real-world data and real-world evidence [15:00.940 --> 15:08.140] in the future. And then that quickly ports me over to the questions around cybersecurity and [15:08.140 --> 15:13.580] hacking. And why do these two come together? Because if our data sets and our real-world [15:13.580 --> 15:19.160] data sets are important for health in the way that helps us understand not only natural history [15:19.160 --> 15:25.820] disease, but also what treatments are working or downstream safety events of treatments or vaccines, [15:25.820 --> 15:33.040] then those data and the safety of the data themselves and our ability to have confidence [15:33.040 --> 15:37.400] that they haven't been tampered with, that the devices that are generating those data haven't [15:37.400 --> 15:44.140] been tampered with, right, is also a critical task. And so to the white hat hacking community, [15:44.140 --> 15:50.800] I ask us to think about how do we continue to keep our real-world data sources safe because [15:50.800 --> 15:55.720] those data sources are going to be important for actually our overall public health and safety in [15:55.720 --> 15:59.800] the future. And I think that that's going to be an important area of inquiry and questioning [15:59.800 --> 16:05.320] that really hasn't gotten enough attention yet. Thank you for that. That's really helpful. And [16:05.320 --> 16:08.600] it's nice to know that this partnership is going to continue and only probably blossom in the [16:08.600 --> 16:14.140] future to get even more insights that you can possibly get to, I guess, from now on. With that, [16:14.140 --> 16:21.180] that brings us to the end of this fireside chat session. So thank you so much for attending and [16:21.180 --> 16:23.680] have a great conference, everyone. Thank you.