Life Sciences And Medtech Policy Update: Key Things To Know Q4 2025

Market Access, Reimbursement, and Compliance

• Expected New Drug Pricing Model: We anticipate the Centers for Medicare & Medicaid Services (CMS) to release a significant proposed new drug pricing model through its Innovation Center called the Global Benchmark for Efficient Drug Pricing (GLOBE) Model. As of September 27, 2025, a proposed rule describing the model is under review with the Office of Management and Budget (OMB); however, we anticipate that this will include the most-favored-nation (MFN) pricing principles that have been the subject of much discussion this year.

• Five Expected Final Rules: CMS is also expected to publish the following final rules in Q4 2025, each of which will include provisions affecting the drug and device industries:

1. Medicare Hospital Outpatient Prospective Payment and Ambulatory Surgical Center Payment Systems for 2026
2. Clinical Laboratory Fee Schedule Annual Payment Determinations for 2026
3. Medicare Physician Fee Schedule for 2026 (CMS released its proposed rule in July 2025 with extensive implications for drug pricing, average sales price calculations, and fair market value calculations. The proposed rule also included significant changes to the 340B Drug Pricing Program and the treatment of cell and gene therapy companies and skin substitute manufacturers)
4. End-Stage Renal Disease Prospective Payment System for 2026
5. Final guidance for Initial Price Applicability (IPAY) Year 2028 under the Medicare Drug Price Negotiation Program (Note: Negotiations for IPAY 2027 end in Q4 2025)

• Voluntary 340B Rebate Pilot Program Launch: The Office of Pharmacy Affairs at the Health Resources & Services Administration (HRSA) issued a 340B Drug Pricing Program notice announcing the launch of a voluntary 340B rebate pilot program: On July 31, 2025, HRSA released the pilot, which marks a significant departure from the traditional up-front discount model that has governed the 340B program. Under the pilot, participating manufacturers will provide post-sale rebates to 340B covered entities — that is, hospitals and clinics — rather than offering discounted prices at the point of sale. HRSA is soliciting public comment on the structure and implementation of the pilot, which is designed to test the feasibility of a rebate-based approach while maintaining statutory compliance under 340B. Comments were due in September, and we will be tracking this development throughout Q4 2025.

Food and Drug Administration (FDA)

• Potential Regulatory Developments to Release in Q4: There are multiple regulatory developments under review within the OMB Office of Information and Regulatory Affairs. We anticipate that multiple of these regulatory developments could be released in Q4 2025, including:

1. Guidance for industry and FDA staff on Use of Real-World Evidence to Support Regulatory Decision-Making for Medical Devices
2. Questions and answers guidance for industry on Expanded Access to Investigational Drugs for Treatment Use
3. Two proposed rules to align FDA regulations with the revised Health and Human Services Common Rule: One harmonizes human subject protection and institutional review board (IRB) requirements to reduce duplication, and the other requires reliance on a single IRB for most domestic multisite studies to streamline oversight.

• Real-Time Release of Complete Response Letters (CRLs): On September 4, 2025, the FDA announced that it plans to release future CRLs "promptly after they are issued to sponsors." Alongside that announcement, the FDA released a new batch of 89 previously unpublished CRLs associated with pending or withdrawn applications, hosted on FDA's dedicated CRL database. This comes on the heels of the FDA's initial July 10, 2025, release, announcing its plans to publish CRLs in a database, accompanied with the release of an initial batch of approximately 200 CRLs associated with products that had already been approved by the FDA.
  
  Why It Matters: Unlike the CRLs in the initial announcement, this latest batch of 89 CRLs are for products that have not been approved by the FDA. The manner in which the FDA is releasing these CRLs, as a zip file, makes them prime candidates for data-mining and competitive intelligence.

• CNPV Program Participants Update: The FDA will soon announce the participants in the Commissioner's National Priority Voucher (CNPV) program. The FDA has been reviewing applications for participation in the program since it was first announced in June 2025. The program is designed to shorten marketing application or efficacy supplement review times from between 10 and 12 months to between 1 and 2 months. Read our Goodwin article on the topic to learn more, "Move Fast: FDA Is Accepting Submissions for the Pilot Program Class for FDA Commissioner's National Priority Voucher Program," (published August 7, 2025).
  
  Why It Matters: We expect the FDA will be heavily invested in demonstrating the success of the program for the participants it first selects to participate in the program, increasing the potential for the FDA to fulfill its promised short review times for those it selects.

• "Crackdown" on Deceptive Direct-to-Consumer (DTC) Pharmaceutical Ads: On September 9, 2025, the FDA announced that it was seeking to "rein in misleading" DTC pharmaceutical advertisements and committed to initiate a rulemaking to remove a long-standing FDA regulation established in 1997 known as the "adequate provision" rule for prescription drug advertising. The FDA characterized the regulation as a "loophole." On the same day, the FDA sent approximately 100 cease and desist letters to companies regarding their advertisements, and it sent a form letter to the wider pharmaceutical industry putting them "on notice" of its shift in enforcement policy over DTC advertisements. On September 16, 2025, the FDA posted the cease and desist letters on its website, which included both untitled letters and warning letters sent to companies that allege general and specific deficiencies about their DTC advertisements sent to companies that allege general and specific deficiencies about their DTC advertisements and other promotional materials.
  
  Why It Matters: Historically, the FDA has chosen to surgically apply its enforcement authority over DTC advertisements and promotional materials based on First Amendment case law.

• FDA Proposes New Rare Disease Evidence Principles (RDEP) Process: On September 3, 2025, the FDA introduced the new RDEP process "to provide greater speed and predictability "to sponsors while navigating the FDA's review of investigational drugs "to treat rare diseases with very small patient populations with significant unmet medical need" and a known genetic defect that is the major driver of the pathophysiology. Sponsors that meet certain eligibility criteria may apply for the RDEP process at any time prior to the launch of a pivotal trial and for each protocol the sponsor wants reviewed. The FDA provides additional details on the eligibility criteria, the proposed process, and the review process on RDEP's web page. The approval pathway for investigational products targeting such rare diseases remains unchanged and must meet the threshold standard of safety and efficacy under section 505(d) of the Federal Food, Drug, and Cosmetic Act.
  
  Why It Matters: Although the pathway remains the same, the FDA explains that "what the RDEP offers is the assurance that drug review will encompass additional supportive data in the review." Prior FDA guidance documents describe the nature of acceptable supportive data. However, an "assurance" that supportive data would be considered by the review team suggests that the RDEP offers sponsors increased opportunities to interact with the FDA product reviewers and gain additional clarity from the FDA. Note that the RDEP process does not include any target response times, unlike FDA's Special Protocol Assessment process or formal meeting requests, but we expect FDA will share more about the mechanics of this program in the future.

• FDA Releases a Flurry of Draft Guidance Documents Related to Oncology Clinical Trials: Since the last quarter, the FDA's Oncology Center of Excellence (OCE) has been quite active, releasing several draft guidance documents on topics covering oncology clinical trials.
  
  Why It Matters: These draft guidance documents and the FDA OCE's August 2025 public workshop suggest that the agency is encouraging the development of data collection and data quality standards from oncology clinical trials.

1. On August 18, 2025, the FDA published a draft guidance to provide recommendations to sponsors on their assessment of overall survival (OS) in oncology clinical trials, with an emphasis on OS as a prespecified safety endpoint. The draft guidance document emphasizes that OS analyses should be incorporated into trial designs and statistical analysis plans for all randomized oncology trials.
2. On August 18, 2025, the FDA published a draft guidance intended to assist intended to assist sponsors in aligning with the FDA's approach to oncology dose optimization for radiopharmaceutical therapies (RPTs) during the clinical development phase and prior to submitting a marketing application for new indication and usage. The draft guidance should be considered alongside the existing 2024 FDA final guidance. While some recommendations in the 2024 final guidance may be applicable to RPTs, the August 2025 draft guidance is more specific to them.
3. On July 16, 2025, the FDA published a draft guidance containing recommendations for sponsors on how to characterize the safety and effectiveness of individual oncology drugs that are used in novel combination regimens, to demonstrate the "contribution of effect" containing recommendations for sponsors on how to characterize the safety and effectiveness of individual oncology drugs that are used in novel combination regimens, to demonstrate the "contribution of effect" that each drug makes to the overall treatment benefit observed in patients.

• FDA Vacates the 2024 Laboratory Developed Tests (LDT) Rule: On September 19, 2025, 2025, the FDA issued a notice announcing that it was vacating the final rule and reverting the definition of "'in vitro diagnostic products'" to the prior text of the regulation before the 2024 LDT rule, which does not explicitly address "'when the manufacturer of these products is a laboratory.'"
  
  Why It Matters: This official agency action marks the end of a long controversial FDA initiative to regulate LDTs as "medical devices."

• FDA Begins Real-Time Reporting of Adverse Event Data: As the agency moves toward a unified system, on August 22, 2025, the FDA announced that it had begun the daily publication of adverse event data from its Adverse Event Reporting System (FAERS) database. Later, on September 8, 2025, the FDA posted a notice as a means of market research to identify potential vendors to support a new modernized FDA Adverse Event Management software that would represent "a consolidation of multiple disparate systems, functions and contracts supporting mission critical" existing adverse event reporting (AER) and product quality system "capabilities across the FDA's IT infrastructure." In the same vein, on September 12, 2025, the FDA announced the launch of a FAERS public dashboard for cosmetic products for real-time AER.
  
  Why It Matters: Although the FDA had a long-standing adverse event public database, the difference communicated in these series of announcements is the increase in speed (described as "real-time") and consolidation of the locations at which such adverse event data will be publicly available, aligning with the FDA's broader data transparency strategy.

• FDA Proposes New PreCheck Program to Boost US Drug Manufacturing: On August 7, 2025, the FDA announced the FDA PreCheck program to strengthen the domestic drug supply chain and facilitate the construction of manufacturing sites in the United States. The two-phased approach consists of (1) a Facility Readiness Phase and (2) an Application Submission Phase. The timeline for the program's implementation is unknown, and the FDA solicited stakeholder input for a public meeting held on September 30, 2025.
  
  Why It Matters: According to the notice in the Federal Register, through the program, applicants and manufacturers can leverage regulatory engagements to "give FDA advanced awareness of facility and manufacturing strategies for specific drugs in forthcoming applications, while enabling earlier assessment and inspection activities within the review cycle." Under the program, the FDA will provide feedback on the chemistry, manufacturing, and controls section of the application and "accelerate quality element assessments for applications from new U.S. facilities through early facility engagement and frontloaded assessment activities."

• FDA Requires Major Labeling Changes to Opioid Pain Medications and Notifies Relevant Applicants: On July 31, 2025, the FDA announced that it is requiring safety labeling changes to all opioid medications to better emphasize and explain the risks associated with their long-term use. The labeling changes include clearer risk information from studies, stronger warnings about high doses, clarification of use limits to avoid misinterpretation, treatment guidance, and information about safely discontinuing use of opioids. Refer to the FDA's Key Opioid Label Updates table and FAQs in its Drug Safety Communication. Additionally, the FDA required a prospective, randomized, control clinical trial to directly examine the benefits and risks of long-term opioid use. The FDA also published a draft guidance on development of non-opioid analgesics for chronic pain, fulfilling a mandate under section 3001(b) of the SUPPORT Act, which requires the FDA to issue guidance to help address challenges related to developing non-opioid treatments for pain management.
  
  Why It Matters: The labeling changes, prompted by the FDA's review of two observational studies and public and academic discourse, aim to help providers and patients make decisions rooted in the latest evidence about opioid medications. The FDA reported that it has sent letters outlining required changes to relevant applicants, and the companies have 30 days to submit their labeling updates to the FDA for review. In a September 2025 press release issued in connection with the draft guidance, FDA Commissioner Marty Makary highlighted that "America's opioid crisis is not over," reflecting the continued focus of the Trump administration on this issue.

US Privacy

• Department of Justice (DOJ) Data Security Program Due Diligence and Audit Requirements Go Into Effect: By October 6, 2025, companies that are subject to the US DOJ regulations implementing Executive Order 14117, "Preventing Access to Americans' Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern" (the Data Security Program), will need to adopt a written compliance program that includes (a) risk-based procedures to verify data flows for any restricted transaction involving China, Russia, or another "country of concern," (b) a written policy that describes the company's data compliance program that is annually certified by a compliance officer, and (c) procedures to conduct an annual audit to verify compliance with the Data Security Program.
  
  Why It Matters: The Data Security Program imposes novel requirements on companies that handle sensitive personal data, including health and genetic data, with particular impacts on the life sciences sector. Compliance is complex and requires cross-functional participation, including engagement from legal, IT, security, human resources, procurement, and other business functions.

• California Privacy Regulator Finalizes Regulations on Automated Decision-Making Technologies, Risk Assessments, and Cyber Audits: The California Privacy Protection Agency approved regulations that require regulated businesses to conduct risk assessments prior to processing any sensitive personal information (including health and genetic information) and adopt safeguards to protect consumers when using automated decision-making technologies, including certain forms of artificial intelligence and other automated systems that make decisions impacting individuals with limited human involvement. Regulated businesses will also need to conduct robust cybersecurity audits of their personal information processing activities. The regulations come into effect on January 1, 2026, with some provisions (including those related to cyber audits) delayed to 2028.
  
  Why It Matters: Life sciences companies will take on new internal compliance requirements for any activities involving sensitive personal information, such as health or genetic data, outside the confines of a regulated clinical trial.

European Union Updates

• Court of Justice of the European Union (CJEU), in European Data Protection Supervisor (EDPS) v. Single Resolution Board (SRB), Weighs In on Pseudonymization: On September 4, 2025, the CJEU delivered a ruling in EDPS v. SRB (Case C-413/23 P) that clarified how the EU General Data Protection Regulation (GDPR) applies to pseudonymized data. The ruling addressed both the definition of personal data in this context and the responsibility on controllers when transferring personal data to third parties.
  
  Why It Matters: Following the CJEU ruling in EDPS v. SRB, three key points stand out: (1) an individual's opinion qualifies as personal data, meaning organizations must include opinions when reviewing whether pseudonymized information falls under the GDPR; (2) when pseudonymized data is shared with third parties, controllers must assess reidentification risks in context, document their reasoning, and demonstrate why further processing is unlikely to identify individuals; and (3) controllers remain responsible for transparency and must inform data subjects of any sharing, while recipients are expected to ensure they do not attempt reidentification. For further details, read Goodwin's "Personal Data or Not? CJEU Weighs In on Pseudonymisation in EDPS v. SRB" alert (published September 25, 2025).

• EU Network and Information Systems Directive 2 (NIS2) Is in Effect: NIS2 significantly raises cybersecurity obligations for the health sector (e.g., laboratories, research centers, pharmaceutical companies, medical device manufacturers, digital health providers). The legislation requires "state of the art" security measures across risk management, secure development, incident response, and supply chain oversight. Major incidents must be reported within 24 hours, requiring companies to strengthen monitoring and response capabilities. Senior management is held directly accountable for compliance, with mandatory training and potential liability for failures.
  
  Why It Matters: Regulators gain stronger supervisory powers, including the power to issue penalties of up to €10 million or 2% of global turnover. As an EU directive, the member states are required to issue national legislation to give effect to NIS2. Some member states are yet to issue such legislation. For further details, read Goodwin's alert: "The NIS 2 Era Is Here: Are You Compliance-Ready?" (published November 4, 2024).

• The Council of the European Union Adopted Its Position on the Proposed EU Pharmaceutical Law Reform: On June 4, 2025, the Council of the European Union adopted its position on the proposed package to reform the EU pharmaceutical legislation, aimed at improving patient access to medicines, boosting competitiveness of the EU's pharmaceutical industry, and ensuring supply security to prevent medicine shortages. Key elements of the Council's position include maintaining the eight years of regulatory data protection, reducing regulatory market protection to one year (with some possible extensions), retaining the 10 years of orphan drug exclusivity, and introducing some additional conditions and limitations on the proposed transferable exclusivity vouchers to incentivize antimicrobial development.
  
  Why It Matters: Now that the Council has adopted its position, the next stage is trilogue negotiations between the European Parliament, the Council, and the European Commission, with the aim of reaching agreement on a final version of the legislation.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.