Imposed Post-Authorisation Safety Study (PASS)

In plain language

An imposed Post-Authorization Safety Study (PASS) is a study a government medicines regulator legally orders a drug company to run after approving a drug, because a safety concern could not be fully resolved before approval. The regulator writes the study rules into the approval itself — picking the question, locking the study plan, and setting hard deadlines — so the company cannot quietly drop it or change the design without permission. Unlike a study a company chooses to run on its own, an imposed PASS carries real consequences: if results show a serious risk, the regulator can change the drug label, restrict who can use it, or even pull it from the market.

An imposed post-authorisation safety study (PASS) is a study a medicines regulator legally obligates a marketing-authorisation holder (MAH) to conduct, as opposed to one the MAH proposes voluntarily. In the EU the legal instrument is a condition of the marketing authorisation under Article 21a of Directive 2001/83/EC (imposed at the time of initial authorisation) or Article 22a (imposed after authorisation, typically in response to an emerging safety concern), introduced by the 2010 pharmacovigilance legislation (Regulation (EU) No 1235/2010 and Directive 2010/84/EU). For non-interventional imposed PASS, the Pharmacovigilance Risk Assessment Committee (PRAC) endorses the protocol before the study starts, reviews protocol amendments, and assesses interim and final results; operational conduct follows GVP Module VIII. The closest US analogue is an FDA postmarketing requirement (PMR) under section 505(o)(3) of the FD&C Act (FDAAA 2007) — legally mandatory and enforceable — which is distinct from a postmarketing commitment (PMC), the voluntary counterpart.

Core conceptual distinction

. "Imposed" is a governance and accountability qualifier, not an epidemiologic design. The same cohort or case-control machinery can underlie an imposed or a voluntary PASS; what differs is the chain of obligation. An imposed PASS carries: (1) a legal trigger and a defined regulatory question (a specific safety concern in the risk-management plan, e.g., a signal from spontaneous reports or a clinical-trial imbalance); (2) a binding, regulator-endorsed protocol with pre-specified outcomes, sample size, feasibility, and a statistical analysis plan that cannot be materially changed without PRAC agreement; (3) mandatory timelines — protocol submission, registration in the EU PAS Register / HMA-EMA Catalogue, progress and interim reports, and a final study report due on a fixed date; and (4) binding consequences — the results feed a PRAC/CHMP recommendation that can change the label, add risk-minimisation measures, restrict indications, or trigger suspension/withdrawal, and non-compliance is itself a regulatory infringement. The estimand is therefore fixed up front and adversarially scrutinised; you do not get to re-specify the primary outcome after seeing the data.

Pros, cons, and trade-offs

(specific and comparative, naming the alternatives). - vs voluntary PASS: An imposed PASS guarantees the question gets answered on a regulator's timeline and locks the estimand against post-hoc drift, which is exactly why regulators reach for it when a signal is consequential. Cost: far less analytic latitude — protocol changes require PRAC endorsement, the timeline is non-negotiable, and a "negative feasibility" answer does not excuse the MAH from the obligation. Prefer imposed only when the question is regulatory-grade and a voluntary commitment would be too slow, too soft, or insufficiently independent. - vs a randomized post-authorisation efficacy/safety trial (or registry-based RCT): An RCT removes confounding by indication and channeling that haunt a non-interventional PASS, but is slow, costly, sometimes unethical for a marketed product, and underpowered for rare safety outcomes. A non-interventional imposed PASS in claims/EHR/registry data delivers large populations and rare events fast, at the price of confounding that must be handled by an active-comparator new-user design, propensity scores, negative controls, and sensitivity analyses. Prefer the non-interventional route for rare or long-latency safety endpoints; prefer a trial when residual confounding cannot be credibly ruled out and equipoise exists. - vs spontaneous reporting / disproportionality signal detection alone: Signal detection is hypothesis-generating and cannot estimate incidence or a comparative effect; an imposed PASS is hypothesis-testing with a denominator. They are sequential, not substitutes — a signal triggers the imposed PASS that quantifies it.

When to use

. Use (or expect) an imposed PASS when a regulator concludes there is an important identified or potential risk, or missing safety information, that (a) is consequential enough to drive a regulatory decision, (b) cannot be resolved by spontaneous reporting or routine pharmacovigilance, and (c) the MAH would not adequately address on its own timeline. Typical triggers: a serious signal at authorisation for a first-in-class product; a post-marketing signal (Article 22a) such as a malignancy or cardiovascular imbalance; or a class-wide safety question requiring a denominator and an active comparator. As a methodologist designing the underlying study, treat the regulatory question as the protocol's North Star and pre-specify everything PRAC will scrutinise.

When NOT to use — and when it is actively misleading or dangerous

. - The question is hypothesis-generating, not estimable. If you cannot define a denominator, a validated outcome, and a credible comparator, a "study" imposed to quantify the risk will produce an under-powered, confounded estimate that looks authoritative and can wrongly reassure or wrongly condemn a product. Resolve feasibility first. - No fit-for-purpose data source exists in the required timeframe. Imposing a 3-year final-report deadline on an outcome that needs 10 years of latency (e.g., solid tumors) guarantees an interim that is uninterpretable; the design must match the latency or the imposition is theatre. - Confounding by indication is irreducible. A non-interventional PASS comparing a new drug to "non-users" for an outcome tied to disease severity will mistake channeling for drug effect. If no active comparator initiates for the same indication at the same decision point, the imposed cohort can be actively misleading — flagging or clearing a drug on the basis of confounding, with label or market consequences. - Using the imposed label to skip rigor. "It's mandated, ship it" is the failure mode: the legal obligation does not relax the methodologic bar; it raises it, because the result is binding.

Data-source operational depth

. A non-interventional imposed PASS lives or dies on the substrate, and PRAC will probe each weakness. - Claims (US FFS / EU national): Strong for large denominators, dispensing-based exposure (NDC/ATC + `fill_date` + `days_supply`), and rare-event capture. Failure modes PRAC will raise: Medicare Advantage (MA)-only person-time lacks fee-for-service claims, so exposure and outcomes are silently missing — restrict to enrollees with full medical + pharmacy benefit (A/B/D) and exclude MA-only spans, or person-time and events are under-counted differentially. Differential competing risks (e.g., cancer outcomes in an older, sicker arm where death from other causes is more common) bias a naive cause-specific analysis — pre-specify a Fine–Gray subdistribution or cause-specific approach. `days_supply` is distorted by 90-day mail order, samples, and stockpiling. Outcomes are coded for billing, not truth — every endpoint needs a validated algorithm with reported PPV, and ideally chart adjudication of a sample. - EHR: Adds severity, labs, and free text to sharpen the indication and confounder set, but exposure is the order, not the dispensing (link to pharmacy fills to confirm initiation), and visit-driven capture means a patient who leaves the network is differentially lost — define observation windows and treat loss to follow-up as informative. - Registry (disease / product / pregnancy): Often the regulator's preferred substrate for an imposed PASS because it supports adjudicated outcomes and product-specific follow-up; weak for complete background exposure and for an external comparator. Link to claims for the full fill history and to a death/cancer registry for mortality and malignancy ascertainment. EU multi-country imposed PASS frequently federate several national data sources (a common data model), which raises harmonisation and heterogeneity issues that must be pre-specified. - Linked claims–EHR–vital/cancer records: The ideal substrate (severity + completeness + reliable mortality), but linkage selects the linkable subset and creates order/fill/service date discrepancies that must be reconciled before time-zero assignment. Immortal time is a recurrent trap in procedure- or initiation-anchored safety studies — follow-up must start at exposure, not at an earlier qualifying event.

Worked example (imposed, claims-based)

A regulator authorises a new SGLT2 inhibitor and PRAC notes a potential signal for urinary-tract malignancy from the clinical-trial program. Under Article 22a the MAH is required to conduct a non-interventional imposed PASS; PRAC endorses the protocol before start. The endorsed protocol pre-specifies an active-comparator new-user cohort in a multi-payer US claims database: (1) Eligibility — adults with type 2 diabetes, ≥2 diabetes diagnoses, and 365 days of continuous medical + pharmacy enrollment with FFS-observable claims (MA-only person-time excluded so "no prior fill" is real, not missing). (2) Washout — no fill of the study drug or the comparator (e.g., a DPP-4 inhibitor) in the 365-day lookback, making both arms incident users. (3) Time zero — the first qualifying `fill_date`; the arm is assigned from the NDC dispensed that day. (4) Outcome — incident urinary-tract cancer via a validated claims algorithm (≥1 inpatient or ≥2 outpatient dx codes ≥30 days apart + a confirmatory procedure), with a ≥6-month lag/latency window to exclude prevalent/baseline-detected disease. (5) Follow-up — from time zero to the validated event, censoring at disenrollment, death, end of data, and (as-treated) discontinuation (`days_supply` end + grace period) or switch; competing risk of death handled by a cause-specific or Fine–Gray model. (6) Confounding — high-dimensional propensity score from the 365-day baseline window, with a negative-control outcome and negative-control exposure to detect residual bias. (7) Governance — the protocol, an interim report at the PRAC-specified milestone, and a final study report on the fixed date are registered in the EU PAS Register; the final result feeds a PRAC recommendation that may revise the label or impose risk-minimisation measures. The "imposed" character is everything outside the epidemiology: the legal trigger, the pre-endorsed locked estimand, the binding timeline, and the regulatory decision the result will drive.

Worked example

Scenario

A regulator approves a new blood-sugar drug (an SGLT2 inhibitor) for type 2 diabetes, but trial data hinted at a possible link to urinary-tract cancer — a rare outcome that would take years and a large population to properly study. Under EU Article 22a, the regulator orders the drug company to conduct an imposed PASS in real-world claims data. PRAC reviews and locks the study protocol before any data are touched. The table below shows the kind of records the analyst works from; the steps explain what makes this PASS imposed rather than voluntary.

Dataset

Simplified milestone tracker showing the binding deliverables for this imposed PASS, as registered in the EU PAS Register. Every row is a regulatory obligation — missing a due date is itself an infringement.

Steps

• The regulator — not the company — defines the safety question: does this SGLT2 inhibitor raise the risk of urinary-tract cancer compared with a similar diabetes drug?

• PRAC endorses the study protocol before data collection begins, locking the primary outcome, the comparator drug, and the statistical plan; the company cannot change any of these without PRAC agreement.

• The study is registered publicly in the EU PAS Register with all planned dates visible, creating an auditable record of every obligation.

• The company runs the study in a large claims database, following the endorsed design: new users of either drug, with a 365-day look-back to confirm no prior use, and a validated cancer outcome definition agreed with PRAC.

• Interim and final reports are submitted on the dates PRAC set — not when the company prefers — and PRAC assesses whether the results require a label change, a use restriction, or no action.

Result

An imposed PASS applies when: (1) a safety concern is real enough to influence a regulatory decision but cannot be resolved before approval; (2) the question requires a large real-world population and years of follow-up; and (3) the regulator concludes a voluntary study commitment would be too slow or too easy for the company to drop. The imposed design guarantees the question gets answered on the regulator's timeline, with a locked study plan and binding consequences — the defining difference from a voluntary PASS, where the company controls the design and schedule.

Runnable example

import pandas as pd

# GVP Module VIII mandatory deliverables for a non-interventional imposed PASS, in order.
REQUIRED = ["protocol", "prac_endorsement", "registration_eu_pas",
            "progress_report", "interim_report", "final_study_report"]

def pass_compliance(milestones: pd.DataFrame, as_of: pd.Timestamp) -> pd.DataFrame:
    m = milestones.copy()
    m["milestone"] = m["milestone"].str.lower()

    # Flag any mandatory deliverable that is entirely absent from the tracker.
    present = set(m["milestone"])
    missing = [{"study_id": m["study_id"].iloc[0], "milestone": req,
                "planned_date": pd.NaT, "status": "MISSING_FROM_PLAN"}
               for req in REQUIRED if req not in present]

    def status(row):
        # Protocol/amendments cannot proceed without PRAC endorsement.
        if row["milestone"] in ("protocol", "interim_report") and not row.get("prac_endorsed", True):
            return "BLOCKED_NO_PRAC_ENDORSEMENT"
        if pd.notna(row["submitted_date"]):
            return "on-time" if row["submitted_date"] <= row["planned_date"] else "LATE"
        return "overdue" if as_of > row["planned_date"] else "pending"

    m["status"] = m.apply(status, axis=1)
    out = pd.concat([m, pd.DataFrame(missing)], ignore_index=True)
    return out.sort_values("planned_date", na_position="last")

library(data.table)

REQUIRED <- c("protocol", "prac_endorsement", "registration_eu_pas",
              "progress_report", "interim_report", "final_study_report")

pass_compliance <- function(milestones, as_of) {
  m <- as.data.table(milestones)
  m[, milestone := tolower(milestone)]

  # Add any mandatory GVP Module VIII deliverable missing from the plan.
  miss <- setdiff(REQUIRED, unique(m$milestone))
  if (length(miss)) {
    m <- rbind(m, data.table(study_id = m$study_id[1L], milestone = miss,
                             planned_date = as.Date(NA), submitted_date = as.Date(NA),
                             prac_endorsed = NA, status = "MISSING_FROM_PLAN"),
               fill = TRUE)
  }

  m[is.na(status), status := fifelse(
    milestone %chin% c("protocol", "interim_report") & prac_endorsed %in% FALSE,
    "BLOCKED_NO_PRAC_ENDORSEMENT",
    fifelse(!is.na(submitted_date),
            fifelse(submitted_date <= planned_date, "on-time", "LATE"),
            fifelse(as_of > planned_date, "overdue", "pending")))]
  setorder(m, planned_date, na.last = TRUE)
  m[]
}