Health: the CNIL adopts two standards concerning early access and compassionate access

The Public Health Code allows, under certain conditions, pharmaceutical companies to make certain medicines available to patients outside the framework provided for by their marketing authorization (AMM). These devices are generally intended for patients suffering from particularly serious pathologies, for which there is no effective medicinal product benefiting from MA, and who will be able to access supposedly innovative medical treatments due to this particular context.

The 2021 Pension Funding Act revised the market access derogation mechanisms, previously known under the terms temporary authorization for use (ATU) by name or cohort and temporary recommendation for use (RTU):

  • the cohort AHUs have become “early access authorizations” (AAP) issued by the High Authority for Health (HAS) at the request of a pharmaceutical laboratory. The medicinal products covered by these authorizations are intended for a group or subgroup of patients and are presumed to be innovative in one or more therapeutic indications;
  • named AHUs have become “compassionate access authorizations” (AAC) issued at the request of a healthcare professional by the National Agency for the Safety of Medicines and Healthcare Products (ANSM). They are intended for a single patient and concern drugs that are presumed to be innovative or authorized abroad;
  • RTUs have become “compassionate prescribing facilities” (CPCs). These SPCs are decided by the ANSM on its own initiative in order to allow the use of a medicinal product in a therapeutic indication other than that (these) foreseen in its AIC. Caution: the standards published today by the CNIL do not concern this case.

The law requires pharmaceutical laboratories, with the collaboration of healthcare professionals who take care of the patient, to ensure the follow-up of patients who receive a drug affected by one of these devices. This follow-up requires the creation of a personal data file.

What are these references for?

The standards, adopted following the feedback received from the CNIL in the context of the public consultations launched on February 15, 2022, respond to three main objectives:

  • driving professionals in their compliance efforts;
  • allow professionals to carry out the processing of personal data involved in these therapeutic acts without the need for authorization from the CNIL, subject to a declaration of conformity. The standards allow pharmaceutical companies, after verifying the compliance of their project with the rules and principles established by these standards, to make a declaration of conformity (early access, compassionate access);
  • constitute an aid to the realization of a Data Protection Impact Assessment (DPIA) if needed.

What data processing is covered by the “early access” repository?

The “early access” archive is intended for all pharmaceutical companies that use a drug that has obtained an early access authorization. The processing of personal data implemented by the laboratories will allow for the monitoring of patients, the dispensing of the drug and the management of relations with prescribers and dispensers.

What data processing is covered by the “compassionate access” standard?

Contrary to what was foreseen in the draft submitted for consultation, the reference system of “compassionate access” is targeted. to pharmaceutical companies that manage a drug that has obtained authorization for compassionate access when patient monitoring is required by the ANSM in his decision.

What are the main changes made with respect to the projects placed in consultation?

Most of the changes consist of clarifications requested by contributors, including:

  • adding the definitions used;
  • the distinction between the subjects who access the data (professional who collects the data and laboratory personnel) and the categories of recipients;
  • the conditions under which a re-use of the collected data can be expected. In this regard, the CNIL recalls that any use of the data for a purpose (objective) other than that for which they were collected constitutes subsequent processing which may be subject to separate formalities.

Furthermore, the standards are not applicable to treatments carried out for pharmacovigilance management purposes, which have a dedicated standard, or for the execution of the indemnity agreement envisaged by the public health code.

The various texts adopted since the start of the consultation and which have an impact on the processing of data relating to “early access” and “compassionate access” have been taken into account. Concretely:

Finally, certain categories of data (first and last initials) were detailed, as well as the conditions under which, in the context of early access, a questionnaire on quality of life can be sent by post.

What happens if the planned data processing does not comply with the standard?

If a treatment is not not fully compliant to one of these standards (eg: on the responsibility of the treatment, the categories of data, the data retention period, etc.), it is necessary to send an authorization request to the CNIL.

In this case, the entity requesting authorization is advised to insert, in its file, a document in which it highlights and justifies the deviations from the reference system.

Do the guidelines cover someone outside the support team performing the data quality check?


A term from healthcare research, quality control (or monitoring) consists in verifying the completeness and accuracy of the data transmitted by the investigation centers to the sponsor (the person or organization responsible for setting up the research), in order to ensure the reliability of the results of a study. It usually takes place in the center where the patient is being treated and is carried out under the supervision of the investigative team.

Quality control may consist in particular in the verification, by a “clinical research associate” (CRA) on behalf of the promoter, of the source documents (medical records, laboratory analysis reports, etc.) against the data collected in the observation book by the detective. These source documents are generally covered by medical secrecy.

The provisions of the Public Health Code specify that the data collected in the context of “early access” or “compassionate access” are transmitted by health professionals in compliance with medical secrecy.

The CNIL has not identified any waiver of medical secrecy similar to that envisaged in research involving the human person.

Consequently, within the archives, only members of the care team are authorized to consult the direct identification data of the patients concerned collected as part of their health monitoring.

Do the guidelines cover compassionate prescribing frameworks (CPCs)?

The “early access” and “compassionate access” standards are not applicable to this data processing.

The execution of the data processing related to the CPCs is therefore subject to the authorization of the CNIL. Subsequent simplification work can take place if the requests sent to the CNIL have sufficient similarities to allow the development of a reference system.

Leave a Reply

Your email address will not be published. Required fields are marked *