25.23 — Medical Affairs

A cardiologist asks a company's field scientist whether their heart failure drug has been studied in patients on dialysis. It has, in a small investigator-run study, and the results were mixed. The drug is not approved for that group and the label says nothing about it.

What the scientist may say depends entirely on who they work for inside the company, whether the doctor asked first, and how the answer is delivered. Get it right and this is legitimate scientific exchange. Get it wrong and it is promotion of an unapproved use — the conduct behind some of the largest corporate penalties in American legal history, several exceeding a billion dollars.

Medical affairs is the function built around that line. Understanding it explains a great deal about how pharmaceutical companies are organised, and about why the systems you build for them have such strict separation between what different people can see.

The line that defines the function

A company may promote its product only for what the approved label says (Chapter 25.13). That is the rule. But doctors have questions the label does not answer, researchers want to study the drug in new ways, and genuine scientific discussion has to be possible.

The resolution has three parts, and each one appears as a real control in real systems.

Scientific exchange is separated from promotion by function. Commercial staff promote, within the label. Medical staff engage scientifically, and are not compensated on sales, do not carry sales targets, and do not report into the commercial organisation. That reporting line is not administrative trivia; it is the evidence a company relies on when demonstrating the separation is real.

Unsolicited requests may be answered fully. If a doctor asks, unprompted, about data outside the label, the company may respond with truthful, balanced, scientific information, through the medical function, in a documented way. The word doing all the work is unsolicited — the company may not prompt the question and then answer it.

And everything is documented. Who asked what, when, what was sent, and by whom.

Medical science liaisons

The MSL is a scientifically trained field-based employee — typically a PharmD, PhD or MD — whose job is discussing the science with clinicians and researchers.

What they actually do: answer detailed questions about the data; discuss disease areas and unmet needs; identify and support researchers who want to run their own studies; collect insights from clinicians about how the disease is treated in practice and what the data does not answer; support advisory boards; and act as the scientific presence at conferences.

What they must not do: promote, discuss pricing, influence prescribing decisions commercially, or be measured on the sales in their territory.

The insights they collect are a genuine business asset, and this is where a great deal of medical affairs software sits. A structured record of what fifty specialists said about where current treatment fails is exactly the evidence a company needs to plan its next trial — and it is also, if handled carelessly, a record that looks like market intelligence gathered by people who are supposed to be non-commercial. So these systems have careful access boundaries, and building them without understanding why the boundaries exist is how a project gets stopped by compliance.

Medical information

Medical information is the function that answers questions from anyone — doctors, pharmacists, nurses and patients — about a company's products.

The machinery is more careful than it looks. Questions arrive by phone, email and web forms. Standard response documents, written and approved in advance and referenced to published evidence, cover the common questions. Anything not covered gets a custom response prepared and reviewed. Every interaction is logged.

And two things happen in parallel on every single call, which is why this function is operationally interesting.

If the caller mentions any adverse event, it goes into the pharmacovigilance path of Chapter 25.22 with its clock running from that moment. If they mention a product defect, it goes into the complaints path of Chapter 25.17. A single call can generate three separate records in three systems with three different deadlines, and the integration between them is a common and valuable piece of work.

Response times are contractual in outsourced operations, and the content is inspectable, because a wrong answer about a dose is a patient safety event.

Publications, and the rules that came from a scandal

Companies publish their research in journals. That is necessary — the evidence in Chapter 25.10 is worthless if nobody can read it — and it was for years done in ways that damaged trust badly.

The abuses were specific. Trials with unfavourable results went unpublished. Articles were written by company-paid writers and then signed by academics who had not done the analysis. Single studies were published repeatedly in different forms to make the evidence look larger than it was.

The rules that resulted are now firm and are worth knowing because they constrain what your clients may ask for.

Authorship criteria. The international criteria require that an author contributed substantially to the design or the analysis, drafted or critically revised the work, approved the final version, and agrees to be accountable for it. Someone who merely provided funding or patients is not an author, and someone who did the work must not be omitted.

Professional writing support is allowed and must be disclosed. A medical writer preparing a draft under the direction of the named authors is legitimate; the same writer producing an article for an academic to sign is ghostwriting, and it is prohibited.

All trials are registered before they start and results are posted regardless of outcome (Chapter 25.8), which removes the ability to bury a negative study quietly.

And funding, employment and all financial relationships are disclosed.

The publication planning systems that support this — tracking every planned manuscript, congress abstract and presentation, with authors, timelines, approvals and disclosures — are a standard piece of medical affairs infrastructure.

Advisory boards, external experts, and where it goes wrong

Companies convene advisory boards: groups of specialists paid to give advice on a development programme, a study design, or an unmet clinical need.

These are legitimate and useful. They are also the classic vehicle for disguised promotion, so the controls are specific. There must be a genuine need for the advice, documented before the meeting. The number of participants must match that need rather than the size of the audience you would like to influence. Payment must be fair market value for the time. The agenda must ask for advice rather than deliver messages. And the output — what was advised — must be recorded and actually used.

A meeting where the company presents for six hours and asks two questions at the end is not an advisory board, and compliance functions know exactly what that pattern looks like.

Payments to clinicians are also public in several countries. In the United States, the Open Payments programme created by the Physician Payments Sunshine Act requires manufacturers to report payments and transfers of value to physicians and teaching hospitals, and the data is published and searchable. Similar transparency arrangements operate in Europe through industry codes. The systems that collect, validate and submit this data are a standing compliance obligation and a recurring piece of service work — high volume, deadline-driven, and unforgiving of poor data quality, because a mis-reported payment to a named doctor is a public error.

Investigator-initiated research and grants

A clinician has an idea for a study using a company's drug. They design it, they run it, they own the data, and the company supports it with funding, product, or both.

These are valuable because they answer questions a company would not fund itself, and they are tightly controlled for an obvious reason: a grant is an easy way to pay a high-prescribing doctor without calling it that.

So requests come through a defined intake process, are reviewed on scientific merit by the medical function, are decided by a committee that excludes commercial staff, and are documented end to end. The same applies to educational grants and charitable donations: separated from commercial decision-making, awarded on stated criteria, recorded.

Value, access and the evidence payers want

One part of medical affairs — sometimes a separate function — exists to answer a different question from the regulator's. The regulator asks whether the drug works and is safe. The payer asks whether it is worth paying for, and compared to what.

Health economics and outcomes research produces that evidence: the cost of the disease as it is currently treated, what the new treatment changes in real practice, quality-of-life measurements, and economic models projecting costs and outcomes over years.

And real-world evidence from claims data, electronic records and registries (Chapters 25.31 to 25.33) is increasingly the raw material, because payers want to know what happens in ordinary patients rather than in trial populations.

This work has its own communication rules. In the United States there is an established route for providing health care economic information to payers and formulary committees, which allows a broader discussion than promotion to prescribers would permit, provided the information relates to the approved indication and is competently supported. It is the reason a company can talk to a health plan in terms it may not use with an individual doctor.

Why the separation shows up in your architecture

Everything above lands on system design in ways that surprise engineers on their first medical affairs project.

Field medical systems and sales systems are usually separate, even when the underlying platform is the same product, with access controls preventing the commercial organisation from seeing medical interaction records.

Insight data is aggregated before it moves anywhere near commercial planning, because an individual doctor's scientific conversation is not a sales lead.

Content is approved through a controlled review process — medical, legal and regulatory reviewers signing off every piece of material before use, with the approved version and its expiry tracked. Materials used after their approval expires are a routine audit finding, which is why these systems enforce it rather than reminding people.

And everything is retained, because a question asked in 2026 about what a company told a doctor in 2020 must have an answer.

If you take one thing from this chapter into a client meeting, take this: when someone from compliance objects to a data flow you thought was harmless, they are almost always protecting the separation described at the top of this page. Ask which line they are protecting, and the design problem usually resolves itself.

Next: Chapter 25.24, regulatory affairs as a working job — submissions, labels, variations, and the systems that keep a hundred markets in step.