FDA Regulatory Submissions over AS2 to the ESG

The FDA (Food and Drug Administration) has a few details to adhere to when communicating with it over AS2. We have done it many times, for small, medium and some of the world’s largest, pharmaceutical companies. Our solutions run on Amazon AWS, Microsoft Azure or Google GCP, and support on-premise deployment on servers, VMs or containers. They can support millions of AS2 transmissions per day, and can move very large files tens of gigabytes in size.

Regulatory Submissions to the FDA Electronic Submissions Gateway (ESG)

---

AS2 Gateway Solutions

Aayu Technologies offers AS2 Gateway solutions primarily under three options, depending on the user requirements. Smaller organizations with a lesser number of submissions to be made can opt for the low cost, hosted AS2 gateway Software as a Service (SaaS) offering. Larger organizations and those looking for more security in an isolated and dedicated environment can deploy on leading cloud platforms. Those seeking on-premise deployments for security, or close integration could deploy on servers, VMs or containers.

The MFT Gateway is a hosted AS2 Gateway service for small and medium businesses, with a flexible subscription model allowing monthly, quarterly or annual subscriptions. Its pricing depends primarily on the volume of messages sent and received, and the subscription tier can be upgraded or downgraded at any time without penalties. There are no upfront fees or start-up fees nor long term contracts, and the pricing is published openly on the pricing page to provide full transparency.

The service is provided as an all-inclusive solution, so the customer can sign up and get started in minutes, although the approval and connectivity testing completion with the FDA does take some time to conclude. There is no software to install, and thus no cost for hardware or licenses, or costs to manage and maintain a solution. MFT Gateway also has the capability to detect acknowledgements from the FDA as ACK 2 and ACK 3, so that it is easier for debugging.

The MFT Gateway is available for dedicated deployment for medium-sized or larger businesses, either as an-all inclusive hosted solution installed and maintained by Aayu Technologies, or for deployment on a customer's own Amazon Web Services (AWS) account for maximum security and control of the files exchanged, and to meet any security, regulatory or other certification requirements. The on-cloud MFT Gateway options are available under the subscriptions in the Enterprise tier. For customers with multiple deployments, or significantly low volumes, the pricing is open for negotiation.

The solution can be deployed on any AWS geographic region (e.g. within Europe to ensure Personally Identifiable Information (PII) or other such sensitive data remains within the EU) the customer selects, and can scale to support thousands of messages or even several millions of messages each day, without any impact to the performance of the system. MFT Gateway also has the capability to detect acknowledgements from the FDA as ACK 2 and ACK 3, so that it is easier for debugging.

Real world users:

• Read the Indegene Case Study about how their case processing technology and operations utilize the MFT Gateway for one of their clients’ safety database. The client is one of the top 10 of the world’s largest pharmaceutical companies by revenue.

"Indegene has a great partner with the MFT Gateway solution. A major point for us was it’s true cloud native architecture allowing us to take full advantage of the AWS ecosystem. The solution allowed us to easily configure connections and rapidly integrate our solutions through the APIs without compromising scalability and robustness"

Tarun Mathur, CTO

• Read the Smarteeva Case Study about how the leading Post Market Surveillance Suite for the Medical Device Industry utilizes the MFT Gateway for submissions to the FDA on behalf of their customers.

"MFT Gateway was exactly what we were looking for, an easy to manage, scalable and secure solution to send AS2 messages. Asankha and his team were extremely helpful and helped us migrate our existing solution and all customers into a new Serverless environment. Additionally, they listened to our needs and provided enhancements to their platform to further automate our support operations"

Plarent Ymeri, CEO

The AS2 Gateway is available for deployment on-premise on a customer's own servers or virtual machines or containerized environments (e.g. Linux, Windows, Docker etc). It can also be deployed onto virtual machines or containerized runtime environments on Amazon AWS, Microsoft Azure or Google GCP. The on-premise version of the AS2 Gateway has support for extremely large submissions in the Gigabyte range, and also supports AS2 restart - where partial file transfers are resumed from the failure point again, to save network bandwidth and time - without restarting from the beginning. It also includes the ability for the console to pick up such large files from shared drives within the customers own private network. This prevents a duplicate copy from being made, even within the internal network, and also allow different departments to prepare the submissions, and use the AS2 Gateway to be used to directly pick up and send the individual files, and even prepare the .tar.gz file expected by the FDA. The AS2 Gateway allows the specification of an Application ID and a Sequence number to generate the required .tar.gz file, using the proper GNU format file and path names, making sure that the submission can be successfully processed by the FDA. While the FDA uses the .tar.gz format with the specific folder structure and file names, the EMA uses a .zip file format without any specific required folder structure. The support for the creation of custom 'Profiles' in the AS2 Gateway allows sending profiles to be created to include specific headers for submissions to the FDA, Health Canada (HC) and the European Medicines Agency (EMA) etc, so that the correct preset 'Profile' can be selected when making a submission, reducing the manual effort required, and the chances for errors. Finally, the AS2 Gateway also has the capability to detect acknowledgements from the FDA as ACK 2 and ACK 3, so that it is easier for debugging.

Real world users:

• The AS2 Gateway is used by one of the top 10 of the world’s largest pharmaceutical companies, to make submissions to the FDA for very large files.
• Read the Compliance Quest Case Study

"Aayu Technologies has been a fantastic partner. They understand the underlying technology and continue to provide great support. We look forward to expanding our offerings using AS2 Gateway solution"

Atulya Risal, COO / CTO

References

Electronic Submissions Gateway

The U.S. Food and Drug Administration’s Electronic Submissions Gateway (ESG) is an agency-wide solution for accepting electronic regulatory submissions. Utilizing the AS2 protocol for ESG submissions, ensures that the submissions are digitally signed by the sender, and encrypted such that only the FDA can decrypt the submission. In addition, the AS2 protocol allows a digitally signed receipt to be received for each submission, called an MDN or Message Disposition Notice. The signed MDN receipts issued by the FDA provides legally valid non-repudiation.

The ESG accepts both pre-market and post-market regulatory information for review, and acts as the conduit through which submissions are received by the FDA, and internally routed through to the relevant center or office. The MDN received as a part of the AS2 based file submission becomes the first acknowledgement for any submission, and is usually referred to as the ACK1. Once a submission is received by the relevant center, and ACK2 or second level acknowledgement is sent by the FDA, and this will return the assigned Core ID for the submission. The Core ID would be the reference to the submission within the FDA systems, and an ACK3 or third level acknowledgement will be the final response from the FDA for the submission, and will typically include additional information in either or both XML and HTML formats.

References: ESG User Guide

Making Successful Submissions

Making a successful submission to the FDA will require AS2 Gateway software, purchased and deployed on-premise, or acquired as Software as a Service (SaaS). FDA has certain requirements about the usage of specific ports and protocols, and typically communicates only over the port 4080 using SSL secured transmissions. In addition, your AS2 URL must have a compatible SSL certificate issued by a trusted Certification Authority (CA), against a leaf Common Name (CN), instead of a wildcard certificate. Submissions to specific FDA centers will also require the inclusion of HTTP headers “X-Cyclone-Metadata-FdaCenter” and “X-Cyclone-Metadata-FdaSubmissionType”. Submissions must also indicate the correct routing ID, and the FDA uses two AS2 Identities “ZZFDATST” for test submissions, and “ZZFDA” for production submissions. The FDA also requires file name preservation on all AS2 submissions.

The FDA will usually expect files in the .tar.gz format (i.e. tarred and gzipped), especially when submissions contain multiple files. Certain centers might also expect archives with a special structure such as with an application-ID and sequence number etc. While the combined length of the file name and path name must not be too long, it is recommended to be encoded in the GNU format. The content-type for archive files would also need to use “application/octet-stream” instead of the more obvious “application/x-gzip”. For more information refer creating and compressing tar archives