Market Access, Reimbursement, and Compliance
- Expected New Drug Pricing Model: We anticipate the Centers for Medicare & Medicaid Services (CMS) to release a significant proposed new drug pricing model through its Innovation Center called the Global Benchmark for Efficient Drug Pricing (GLOBE) Model. As of September 27, 2025, a proposed rule describing the model is under review with the Office of Management and Budget (OMB); however, we anticipate that this will include the most-favored-nation (MFN) pricing principles that have been the subject of much discussion this year.
- Five Expected Final Rules: CMS is also expected to publish the following final rules in Q4 2025, each of which will include provisions affecting the drug and device industries:
- Medicare Hospital Outpatient Prospective Payment and Ambulatory Surgical Center Payment Systems for 2026
- Clinical Laboratory Fee Schedule Annual Payment Determinations for 2026
- Medicare Physician Fee Schedule for 2026 (CMS released its proposed rule in July 2025 with extensive implications for drug pricing, average sales price calculations, and fair market value calculations. The proposed rule also included significant changes to the 340B Drug Pricing Program and the treatment of cell and gene therapy companies and skin substitute manufacturers)
- End-Stage Renal Disease Prospective Payment System for 2026
- Final guidance for Initial Price Applicability (IPAY) Year 2028 under the Medicare Drug Price Negotiation Program (Note: Negotiations for IPAY 2027 end in Q4 2025)
- Voluntary 340B Rebate Pilot Program Launch: The Office of Pharmacy Affairs at the Health Resources & Services Administration (HRSA) issued a 340B Drug Pricing Program notice announcing the launch of a voluntary 340B rebate pilot program: On July 31, 2025, HRSA released the pilot, which marks a significant departure from the traditional up-front discount model that has governed the 340B program. Under the pilot, participating manufacturers will provide post-sale rebates to 340B covered entities — that is, hospitals and clinics — rather than offering discounted prices at the point of sale. HRSA is soliciting public comment on the structure and implementation of the pilot, which is designed to test the feasibility of a rebate-based approach while maintaining statutory compliance under 340B. Comments were due in September, and we will be tracking this development throughout Q4 2025.
Food and Drug Administration (FDA)
- Potential Regulatory Developments to Release in Q4: There are multiple regulatory developments under review within the OMB Office of Information and Regulatory Affairs. We anticipate that multiple of these regulatory developments could be released in Q4 2025, including:
- Guidance for industry and FDA staff on Use of Real-World Evidence to Support Regulatory Decision-Making for Medical Devices
- Questions and answers guidance for industry on Expanded Access to Investigational Drugs for Treatment Use
- Two proposed rules to align FDA regulations with the revised Health and Human Services Common Rule: One harmonizes human subject protection and institutional review board (IRB) requirements to reduce duplication, and the other requires reliance on a single IRB for most domestic multisite studies to streamline oversight.
- Real-Time Release of Complete Response Letters
(CRLs): On September 4, 2025, the FDA announced that it plans to release future
CRLs "promptly after they are issued to sponsors."
Alongside that announcement, the FDA released a new batch of 89
previously unpublished CRLs associated with pending or
withdrawn applications, hosted on FDA's dedicated CRL database. This comes on the heels of the
FDA's initial July 10, 2025, release,
announcing its plans to publish CRLs in a database, accompanied
with the release of an initial batch of approximately 200 CRLs
associated with products that had already been approved by the
FDA.
Why It Matters: Unlike the CRLs in the initial announcement, this latest batch of 89 CRLs are for products that have not been approved by the FDA. The manner in which the FDA is releasing these CRLs, as a zip file, makes them prime candidates for data-mining and competitive intelligence.
- CNPV Program Participants Update: The FDA will
soon announce the participants in the Commissioner's National
Priority Voucher (CNPV) program. The FDA has been reviewing
applications for participation in the program since it was first
announced in June 2025. The program is designed to shorten
marketing application or efficacy supplement review times from
between 10 and 12 months to between 1 and 2 months. Read our
Goodwin article on the topic to learn more, "Move Fast: FDA Is Accepting Submissions for the
Pilot Program Class for FDA Commissioner's National Priority
Voucher Program," (published August 7, 2025).
Why It Matters: We expect the FDA will be heavily invested in demonstrating the success of the program for the participants it first selects to participate in the program, increasing the potential for the FDA to fulfill its promised short review times for those it selects.
- "Crackdown" on Deceptive Direct-to-Consumer
(DTC) Pharmaceutical Ads: On September 9, 2025, the FDA announced that it was seeking to
"rein in misleading" DTC pharmaceutical advertisements
and committed to initiate a rulemaking to remove a long-standing
FDA regulation established in 1997 known as the "adequate
provision" rule for prescription drug advertising. The FDA
characterized the regulation as a "loophole." On the same
day, the FDA sent approximately 100 cease and desist letters to
companies regarding their advertisements, and it sent a form letter
to the wider pharmaceutical industry putting them "on
notice" of its shift in enforcement policy over DTC
advertisements. On September 16, 2025, the FDA posted the cease and
desist letters on its website, which included both untitled letters and warning letters sent to companies that allege
general and specific deficiencies about their DTC advertisements
sent to companies that allege general and specific deficiencies
about their DTC advertisements and other promotional
materials.
Why It Matters: Historically, the FDA has chosen to surgically apply its enforcement authority over DTC advertisements and promotional materials based on First Amendment case law.
- FDA Proposes New Rare Disease Evidence Principles
(RDEP) Process: On September 3, 2025, the FDA introduced the new RDEP process "to
provide greater speed and predictability "to sponsors while
navigating the FDA's review of investigational drugs "to
treat rare diseases with very small patient populations with
significant unmet medical need" and a known genetic defect
that is the major driver of the pathophysiology. Sponsors that meet
certain eligibility criteria may apply for the RDEP process at any
time prior to the launch of a pivotal trial and for each protocol
the sponsor wants reviewed. The FDA provides additional details on
the eligibility criteria, the proposed process, and the review
process on RDEP's web page. The approval pathway for
investigational products targeting such rare diseases remains
unchanged and must meet the threshold standard of safety and
efficacy under section 505(d) of the Federal Food, Drug, and
Cosmetic Act.
Why It Matters: Although the pathway remains the same, the FDA explains that "what the RDEP offers is the assurance that drug review will encompass additional supportive data in the review." Prior FDA guidance documents describe the nature of acceptable supportive data. However, an "assurance" that supportive data would be considered by the review team suggests that the RDEP offers sponsors increased opportunities to interact with the FDA product reviewers and gain additional clarity from the FDA. Note that the RDEP process does not include any target response times, unlike FDA's Special Protocol Assessment process or formal meeting requests, but we expect FDA will share more about the mechanics of this program in the future.
- FDA Releases a Flurry of Draft Guidance Documents
Related to Oncology Clinical Trials: Since the last
quarter, the FDA's Oncology Center of Excellence (OCE) has been
quite active, releasing several draft guidance documents on topics
covering oncology clinical trials.
Why It Matters: These draft guidance documents and the FDA OCE's August 2025 public workshop suggest that the agency is encouraging the development of data collection and data quality standards from oncology clinical trials.
- On August 18, 2025, the FDA published a draft guidance to provide recommendations to sponsors on their assessment of overall survival (OS) in oncology clinical trials, with an emphasis on OS as a prespecified safety endpoint. The draft guidance document emphasizes that OS analyses should be incorporated into trial designs and statistical analysis plans for all randomized oncology trials.
- On August 18, 2025, the FDA published a draft guidance intended to assist intended to assist sponsors in aligning with the FDA's approach to oncology dose optimization for radiopharmaceutical therapies (RPTs) during the clinical development phase and prior to submitting a marketing application for new indication and usage. The draft guidance should be considered alongside the existing 2024 FDA final guidance. While some recommendations in the 2024 final guidance may be applicable to RPTs, the August 2025 draft guidance is more specific to them.
- On July 16, 2025, the FDA published a draft guidance containing recommendations for sponsors on how to characterize the safety and effectiveness of individual oncology drugs that are used in novel combination regimens, to demonstrate the "contribution of effect" containing recommendations for sponsors on how to characterize the safety and effectiveness of individual oncology drugs that are used in novel combination regimens, to demonstrate the "contribution of effect" that each drug makes to the overall treatment benefit observed in patients.
- FDA Vacates the 2024 Laboratory Developed Tests (LDT)
Rule: On September 19, 2025, 2025, the FDA issued a notice announcing that it was
vacating the final rule and reverting the definition of
"'in vitro diagnostic products'" to the prior
text of the regulation before the 2024 LDT rule, which does not
explicitly address "'when the manufacturer of these
products is a laboratory.'"
Why It Matters: This official agency action marks the end of a long controversial FDA initiative to regulate LDTs as "medical devices."
- FDA Begins Real-Time Reporting of Adverse Event
Data: As the agency moves toward a unified system, on
August 22, 2025, the FDA announced that it had begun the daily
publication of adverse event data from its Adverse Event Reporting
System (FAERS) database. Later, on September 8, 2025, the FDA posted a notice as a means of market
research to identify potential vendors to support a new modernized
FDA Adverse Event Management software that would represent "a
consolidation of multiple disparate systems, functions and
contracts supporting mission critical" existing adverse event
reporting (AER) and product quality system "capabilities
across the FDA's IT infrastructure." In the same vein, on
September 12, 2025, the FDA announced the launch of a FAERS public
dashboard for cosmetic products for real-time AER.
Why It Matters: Although the FDA had a long-standing adverse event public database, the difference communicated in these series of announcements is the increase in speed (described as "real-time") and consolidation of the locations at which such adverse event data will be publicly available, aligning with the FDA's broader data transparency strategy.
- FDA Proposes New PreCheck Program to Boost US Drug
Manufacturing: On August 7, 2025, the FDA announced the FDA PreCheck program to
strengthen the domestic drug supply chain and facilitate the
construction of manufacturing sites in the United States. The
two-phased approach consists of (1) a Facility Readiness Phase and
(2) an Application Submission Phase. The timeline for the
program's implementation is unknown, and the FDA solicited
stakeholder input for a public meeting held on September 30,
2025.
Why It Matters: According to the notice in the Federal Register, through the program, applicants and manufacturers can leverage regulatory engagements to "give FDA advanced awareness of facility and manufacturing strategies for specific drugs in forthcoming applications, while enabling earlier assessment and inspection activities within the review cycle." Under the program, the FDA will provide feedback on the chemistry, manufacturing, and controls section of the application and "accelerate quality element assessments for applications from new U.S. facilities through early facility engagement and frontloaded assessment activities."
- FDA Requires Major Labeling Changes to Opioid Pain
Medications and Notifies Relevant Applicants: On July 31,
2025, the FDA announced that it is requiring safety
labeling changes to all opioid medications to better emphasize and
explain the risks associated with their long-term use. The labeling
changes include clearer risk information from studies, stronger
warnings about high doses, clarification of use limits to avoid
misinterpretation, treatment guidance, and information about safely
discontinuing use of opioids. Refer to the FDA's Key Opioid Label Updates table and
FAQs in its Drug Safety Communication. Additionally, the FDA
required a prospective, randomized, control clinical trial to
directly examine the benefits and risks of long-term opioid use.
The FDA also published a draft guidance on development of non-opioid
analgesics for chronic pain, fulfilling a mandate under section
3001(b) of the SUPPORT Act, which requires the FDA to issue
guidance to help address challenges related to developing
non-opioid treatments for pain management.
Why It Matters: The labeling changes, prompted by the FDA's review of two observational studies and public and academic discourse, aim to help providers and patients make decisions rooted in the latest evidence about opioid medications. The FDA reported that it has sent letters outlining required changes to relevant applicants, and the companies have 30 days to submit their labeling updates to the FDA for review. In a September 2025 press release issued in connection with the draft guidance, FDA Commissioner Marty Makary highlighted that "America's opioid crisis is not over," reflecting the continued focus of the Trump administration on this issue.
US Privacy
- Department of Justice (DOJ) Data Security Program Due
Diligence and Audit Requirements Go Into Effect: By
October 6, 2025, companies that are subject to the US DOJ
regulations implementing Executive Order 14117, "Preventing Access to Americans' Bulk Sensitive
Personal Data and United States Government-Related Data by
Countries of Concern" (the Data Security Program), will
need to adopt a written compliance program that includes (a)
risk-based procedures to verify data flows for any restricted
transaction involving China, Russia, or another "country of
concern," (b) a written policy that describes the
company's data compliance program that is annually certified by
a compliance officer, and (c) procedures to conduct an annual audit
to verify compliance with the Data Security Program.
Why It Matters: The Data Security Program imposes novel requirements on companies that handle sensitive personal data, including health and genetic data, with particular impacts on the life sciences sector. Compliance is complex and requires cross-functional participation, including engagement from legal, IT, security, human resources, procurement, and other business functions.
- California Privacy Regulator Finalizes Regulations on
Automated Decision-Making Technologies, Risk Assessments, and Cyber
Audits: The California Privacy Protection Agency approved
regulations that require regulated businesses to conduct risk
assessments prior to processing any sensitive personal information
(including health and genetic information) and adopt safeguards to
protect consumers when using automated decision-making
technologies, including certain forms of artificial intelligence
and other automated systems that make decisions impacting
individuals with limited human involvement. Regulated businesses
will also need to conduct robust cybersecurity audits of their
personal information processing activities. The regulations come
into effect on January 1, 2026, with some provisions (including
those related to cyber audits) delayed to 2028.
Why It Matters: Life sciences companies will take on new internal compliance requirements for any activities involving sensitive personal information, such as health or genetic data, outside the confines of a regulated clinical trial.
European Union Updates
- Court of Justice of the European Union (CJEU), in
European Data Protection Supervisor (EDPS) v. Single Resolution
Board (SRB), Weighs In on Pseudonymization: On
September 4, 2025, the CJEU delivered a ruling in EDPS v. SRB (Case C-413/23 P) that
clarified how the EU General Data Protection Regulation (GDPR)
applies to pseudonymized data. The ruling addressed both the
definition of personal data in this context and the responsibility
on controllers when transferring personal data to third
parties.
Why It Matters: Following the CJEU ruling in EDPS v. SRB, three key points stand out: (1) an individual's opinion qualifies as personal data, meaning organizations must include opinions when reviewing whether pseudonymized information falls under the GDPR; (2) when pseudonymized data is shared with third parties, controllers must assess reidentification risks in context, document their reasoning, and demonstrate why further processing is unlikely to identify individuals; and (3) controllers remain responsible for transparency and must inform data subjects of any sharing, while recipients are expected to ensure they do not attempt reidentification. For further details, read Goodwin's "Personal Data or Not? CJEU Weighs In on Pseudonymisation in EDPS v. SRB" alert (published September 25, 2025).
- EU Network and Information Systems Directive 2 (NIS2)
Is in Effect: NIS2 significantly raises cybersecurity
obligations for the health sector (e.g., laboratories, research
centers, pharmaceutical companies, medical device manufacturers,
digital health providers). The legislation requires "state of
the art" security measures across risk management, secure
development, incident response, and supply chain oversight. Major
incidents must be reported within 24 hours, requiring companies to
strengthen monitoring and response capabilities. Senior management
is held directly accountable for compliance, with mandatory
training and potential liability for failures.
Why It Matters: Regulators gain stronger supervisory powers, including the power to issue penalties of up to €10 million or 2% of global turnover. As an EU directive, the member states are required to issue national legislation to give effect to NIS2. Some member states are yet to issue such legislation. For further details, read Goodwin's alert: "The NIS 2 Era Is Here: Are You Compliance-Ready?" (published November 4, 2024).
- The Council of the European Union Adopted Its Position
on the Proposed EU Pharmaceutical Law Reform: On June 4,
2025, the Council of the European Union adopted its position on the
proposed package to reform the EU pharmaceutical legislation, aimed
at improving patient access to medicines, boosting competitiveness
of the EU's pharmaceutical industry, and ensuring supply
security to prevent medicine shortages. Key elements of the
Council's position include maintaining the eight years of
regulatory data protection, reducing regulatory market protection
to one year (with some possible extensions), retaining the 10 years
of orphan drug exclusivity, and introducing some additional
conditions and limitations on the proposed transferable exclusivity
vouchers to incentivize antimicrobial development.
Why It Matters: Now that the Council has adopted its position, the next stage is trilogue negotiations between the European Parliament, the Council, and the European Commission, with the aim of reaching agreement on a final version of the legislation.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
