25.22 — Pharmacovigilance: Watching a Medicine After It Is Sold

A drug is approved after trials in perhaps three thousand patients, carefully selected, closely watched, for a fixed period. Then it launches and two million people take it in a year — including the eighty-eight-year-old on nine other medicines, the woman who did not know she was pregnant, the man who drinks heavily, and the patient with kidney failure who was excluded from every trial.

A side effect that occurs in one patient in ten thousand was almost certainly invisible in the trials. In the first year after launch it will happen two hundred times.

Pharmacovigilance is the system that notices. It is the largest single outsourced function in the industry, it runs on clocks measured in calendar days rather than working days, and it is the part of a client's operation where a missed deadline is reported to a regulator as a compliance failure with your company's name attached to it.

The vocabulary, in the order the assessment happens

These words look interchangeable and are not. Each one is a decision that changes what must happen next.

An adverse event is any untoward medical occurrence in a patient given a medicine, whether or not it is related to the medicine. The phrase "whether or not related" is the whole point: a patient who breaks an ankle while taking your drug has had an adverse event, and it is recorded rather than filtered out by someone's judgement at intake.

An adverse reaction is an adverse event where a causal relationship to the medicine is at least a reasonable possibility. Causality is assessed, not assumed, and the assessment is by a qualified person using the timing, the patient's other conditions and medicines, what happened when the drug was stopped, and whether the event is known to occur with this drug or its class.

Serious has a precise legal definition and nothing to do with how severe it feels. An event is serious if it results in death, is life-threatening, requires or prolongs hospital admission, causes persistent or significant disability or incapacity, is a congenital anomaly or birth defect, or is another medically important event that could jeopardise the patient or require intervention to prevent one of the above.

The distinction that catches everyone: a severe headache is not serious; a mild event leading to a hospital admission is. Severity describes intensity; seriousness is a regulatory category with reporting deadlines attached.

Expected or unexpected is judged against a document, not against common sense. For a marketed product the reference is the approved label; for an investigational one it is the Investigator's Brochure of Chapter 25.7. If the event is not listed there, or is listed but occurred with greater specificity or severity, it is unexpected.

And combining those gives the term that drives clinical trial reporting: a SUSAR, a suspected unexpected serious adverse reaction — serious, unexpected, and at least possibly caused by the drug. SUSARs are the events regulators want fastest, because they are the ones nobody knew about.

What makes a report a case at all

A valid individual case safety report — an ICSR, the industry's unit of work — needs four elements, and they are worth memorising because triage staff apply them hundreds of times a day.

An identifiable patient. An identifiable reporter. A suspect medicinal product. And an event.

"Identifiable" is a low bar deliberately: age group and sex can be enough for the patient, and a reporter is identifiable if they can in principle be contacted or characterised. A report missing one of the four is not yet a valid case, and the company must make and document reasonable attempts to obtain what is missing — a follow-up process that is itself inspected.

The clocks

These deadlines are the operational heart of the function, and they run from the moment anyone at the company — anyone, including a sales representative or a call centre agent — first becomes aware of the four elements.

Situation	Deadline
Marketed drug, serious, US	15 calendar days
Trial drug, fatal or life-threatening unexpected reaction	7 calendar days
Trial drug, other serious unexpected reaction	15 calendar days
EU SUSAR, fatal or life-threatening	7 calendar days
EU SUSAR, other	15 calendar days
EU non-serious reactions	90 calendar days

Three practical consequences follow from "day zero is first awareness anywhere in the company".

Every employee must be trained to pass on anything that sounds like an adverse event, immediately, without assessing it themselves. A market research call, a social media reply, a conversation at a conference — all are awareness.

Weekends and holidays do not stop the clock, which is why case processing operations run continuously and why late-arriving weekend intake is a chronic operational risk.

And when a company partners with another — licensing a product, co-promoting it — a safety data exchange agreement defines exactly how quickly each side passes cases to the other, because both are independently liable for their own reporting. Reconciliation between partners is a routine, tedious and heavily inspected activity.

What happens to a case, step by step

This is the assembly line that employs tens of thousands of people worldwide.

Intake. A report arrives from a call centre, a website, a sales representative, a literature article, a study, a patient support programme, a regulator or a partner. It is logged with the date of receipt — the date that starts the clock, and the field inspectors check first.

Triage. Is it valid? Is it serious? Is it expected? This determines the deadline, so it happens immediately, and getting it wrong is how deadlines are missed.

Data entry into the safety database, with the patient details, the medicines with doses and dates, the medical history, the event with its dates and outcome, and the reporter.

Coding. Events are coded to MedDRA, the Medical Dictionary for Regulatory Activities, which is a hierarchy: the reporter's own words map to a lowest-level term, which rolls up to a preferred term, then to higher-level terms and finally to a system organ class. The point is that "heart attack", "MI" and "myocardial infarction" all become the same preferred term, so counting is possible. Medicines are coded to WHODrug, so that a brand name in one country and a generic name in another are recognised as the same substance. Coding consistency is the difference between detecting a signal and missing it, and it is one of the most valuable places for machine assistance with human review.

Narrative writing. A structured, chronological summary of what happened to this patient — what they took, what happened, when, what was done, and how it ended. A reviewer at a regulator will read this narrative, so it must stand alone.

Medical review and causality assessment, by a physician or other qualified professional.

Follow-up. Missing details are chased, sometimes repeatedly, and each new piece of information may change the assessment.

Submission. The case is transmitted electronically to the relevant authorities in the required format, and receipt acknowledgements are tracked. The standard is E2B, now in its R3 version, which defines the message structure so that a case can move between company and regulator systems without re-keying.

And quality control at every stage, because the error rate on a manual process at this volume is not zero and the regulator's copy is permanent.

Where the reports come from, and the honest limitation

Spontaneous reports — from doctors, pharmacists, nurses and patients — are the backbone. Solicited reports come from studies, registries and patient support programmes, and are handled slightly differently. Literature monitoring is a formal obligation: companies must search published literature regularly for cases involving their products, and Europe operates a central service that covers specified substances so that duplicate work is reduced.

Now the limitation that governs how all of this data should be interpreted. Spontaneous reporting is voluntary for clinicians, and only a small fraction of adverse reactions are ever reported — commonly estimated at well under ten percent, and varying enormously by drug, by how newsworthy the reaction is, and by how long the product has been on the market.

So the database counts do not measure incidence. You cannot say "there were 412 reports, so the rate is 412 per two million patients". You can say that 412 reports of that event exist, and compare that against what you would expect given everything else reported. This is the single most important thing to understand before building anything analytical on safety data, and it is misunderstood by newcomers constantly — including journalists, which is why raw counts from public databases regularly produce alarming and meaningless headlines.

Signal detection: finding the pattern before the harm spreads

A signal is information suggesting a new possible causal association, or a new aspect of a known one, that justifies further investigation.

Detection is both statistical and human.

The statistical part uses disproportionality: is this event reported more often with this drug than would be expected given how often it is reported with all drugs? The measures have names you will see in tooling — the proportional reporting ratio, the reporting odds ratio, and Bayesian methods used by regulators for large databases.

And the arithmetic behind them is simple enough to state. Take the number of reports of your drug with the event, divided by all reports of your drug; divide that by the number of reports of the event with all other drugs, divided by all reports of all other drugs. If the answer is well above one and rests on more than a handful of cases, the event appears disproportionately with your drug.

What disproportionality does not tell you is whether the drug caused it. Reporting is biased by publicity, by litigation, by the indication itself, and by the fact that sicker patients get certain drugs. So every statistical signal goes to human review: are these cases clinically coherent, is there a plausible mechanism, what happened when the drug was stopped and restarted, is there supporting evidence in trials or literature?

Validated signals then move into signal management: assessment, prioritisation, and a decision — no action, more investigation, a label change, a risk minimisation measure, restricted use, or withdrawal. The whole process is documented, and regulators inspect it, because the failure they most fear is a company that had the data and did not look.

The periodic reports

Alongside individual cases, companies submit aggregate reports summarising everything known over a period. Four names cover almost all of it.

PBRER, the Periodic Benefit-Risk Evaluation Report, is the international standard format for marketed products — and its structure encodes a genuine principle: it is not a list of side effects but an assessment of whether the balance of benefit and risk is still favourable. In Europe this submission is called the PSUR.

PADER, the Periodic Adverse Drug Experience Report, is the older American format, submitted quarterly for the first three years after approval and annually thereafter.

DSUR, the Development Safety Update Report, is the annual safety report for products still in clinical development.

And risk management documents. In Europe, a Risk Management Plan describes the known and potential risks, what is still unknown, and the activities in place to characterise and minimise them. In the United States, the equivalent enforcement tool is the REMS of Chapter 25.13.

One more European specific: the pharmacovigilance system master file, a single document describing the company's entire safety system — its people, its processes, its databases, its subcontractors — kept current and produced on request during an inspection. The named individual accountable for that system is the Qualified Person for Pharmacovigilance, and their personal accountability shapes how European clients behave.

The systems, and where the work actually is

A safety operation runs on a validated safety database, an intake layer, a submission gateway to the regulators, tools for signal detection, document systems for the periodic reports, and reconciliation processes against every partner and every clinical trial database.

The economics are simple and they explain why this function is outsourced more than any other. Case volume rises with product uptake and never falls. Each case takes a defined amount of skilled human work. Deadlines are absolute. So cost grows linearly with success, and any reduction in cost per case goes straight to the bottom line.

Which is why this is the single most active area for automation in the whole industry, and why it is worth knowing exactly where automation is and is not accepted. Reading an incoming document to extract fields, suggesting MedDRA codes, drafting a narrative from structured data, detecting duplicate cases, and translating source documents — all of these are in production use with human review. The causality assessment, the medical judgement and the final release of a case are not delegated to a model, and any proposal that implies otherwise will be rejected on the spot.

And the compliance metric everyone is measured on is simple: the percentage of cases submitted within the deadline. It is reported to regulators, examined during inspections, and written into service contracts as a penalty clause. If you build one dashboard for a safety client, build that one — cases approaching their deadline, by hours remaining, by owner.

Next: Chapter 25.23, medical affairs — the function that talks to doctors about the science without being allowed to sell, and the legal line that makes that separation absolute.