Pharmacovigilance Safety Database and Case Management System

AI-generated analysis of the documents. Check the official notice and any amendments for current submission details.

1. At a glance

2. Scope of Work

The Health Products Regulatory Authority (HPRA) seeks a modern, cloud-hosted pharmacovigilance safety database and case management system to replace its existing 15-year-old, on-premise solution. The new system must enable the HPRA to meet its legal obligations for collecting, processing, managing, analysing, and submitting individual case safety reports (ICSRs) and suspected unexpected serious adverse reactions (SUSARs) for human medicinal products. The contract encompasses the provision of the solution, migration of data from the legacy system, integration with external platforms, solution hosting and management, and ongoing application support and maintenance.

Key activities and system requirements include:

• Core Functionality:

• Support for end-to-end case management workflows for ICSRs and SUSARs, including intake, triage, allocation, follow-up, medical/scientific assessment, and completion.

• Configurable workflows and notifications (assignments, escalations, timers, alerts, task lists) to maximise operational efficiency.

• Comprehensive case data management with unique identifiers, date/time stamping, versioning, record linking/merging, cross-referencing, and duplicate management.

• Duplicate case detection and de-duplication workflows with a complete audit trail.

• Support for case processing and coding using up-to-date regulatory dictionaries (e.g., MedDRA) and HPRA-specific dictionaries.

• Secure electronic submission/exchange of safety information with external systems, including EudraVigilance, in accordance with ICH E2B(R3) standards, with acknowledgement management.

• Role-based access control and configurable data access, including anonymisation/pseudonymisation controls.

• Configurable templates and standard text for case processing outputs.

• Automation capabilities for case intake, coding, duplicate checking, narrative creation, and quality checks.

• Advanced search across all data elements, including structured fields and free-text, supporting configurable queries and Standard MedDRA Queries (SMQs).

• Support for Artificial Intelligence (AI) / Natural Language Processing (NLP) features for safety information extraction and interpretation, with human oversight.

• Extensibility for use in other vigilance areas (veterinary medicines, medical devices, substances of human origin).

• Future-proofing for design and functional updates to meet evolving regulatory requirements.

• Auditability:

• Audit trail and traceability of changes to data, capturing user and system activity (create/read/update/delete, workflow actions, attachments, imports/exports, report generation).

• Granular logging of field-level changes (before/after values) and sufficient information for case history reconstruction.

• Searchable, retrievable, and exportable audit trail records.

• Logging and traceability of all inbound/outbound data exchanges.

• Reporting, Analytics & Insight:

• Capabilities for authorised users to access, analyse, and interpret case, workflow, signal, data quality, and service performance information.

• Standard reports, ad hoc reporting, user-defined queries, and configurable dashboards.

• Support for creating, scheduling, running, and exporting reports to generate actionable insight.

• Signal management reporting (potential signals, review timelines, outcomes).

• Data quality reporting (missing fields, coding inconsistencies).

• Workload and service performance reporting by team, user, process stage, case category, and reporting source.

• AI/ML/NLP capabilities for use cases, data, oversight, accuracy, explainability, and bias management.

• Integration:

• Support for intake of adverse reaction reports from HPRA reporting channels, including field mapping from online forms.

• Secure ICSR/SUSAR transmission and exchange in accordance with ICH E2B(R3) and EMA requirements, including acknowledgement management via an Axway gateway for EudraVigilance.

• Machine-to-machine integration description, including technologies, protocols, authentication, security, and data mapping.

• Monitoring of interfaces and transmissions, with alerting for message failures.

• Data mapping and transformation details.

• Clear identification of responsibilities for integration implementation and maintenance.

• Support for various protocols and standards (E2B(R3), XML/JSON, HL7/FHIR).

• Data Migration:

• End-to-end migration of data from the existing legacy application to the new application, ensuring completeness, accuracy, and data integrity.

• Secure migration in compliance with data protection and information security requirements.

• Development of a full migration documentation package, including cutover plan, rollback approach, and post-migration support.

• Details of migration strategy, tools, services, roles, and resources required.

• Evidence of successful data migration before final production load.

• Details on data extraction and migration at the end of the contract, including exit and transition approach, export formats, and transfer mechanisms.

• Hosting & Service Management:

• Managed cloud hosting platform and infrastructure for the application, interfaces, and related technology components.

• Management includes technology service operations, patching, upgrades, backup, rollback, restore, and disaster recovery.

• Compliance with GDPR, European, and Irish data privacy legislation.

• Details of proposed hosting arrangements, technical architecture, and hosting locations.

• Data residency and jurisdiction within the EU/EEA.

• Logical or physical segregation of HPRA tenant and data.

• Expected performance characteristics, scalability, and handling of high traffic volumes.

• Relevant certifications for operation, security, and management, including NIS2 compliance.

• Provision of production, pre-production, and testing environments.

• Operational support model, including hours, incident management, change management, and a sample Service Level Agreement (SLA).

• Measures for resilience and continuity, including disaster recovery and business continuity, with defined solution recovery times.

• Processes for keeping the solution current throughout the contract term, managing updates without adverse impact.

• Security:

• Protection of infrastructure, application, and hosted data from unauthorised access, loss, or compromise, in compliance with data protection legislation.

• Single sign-on controls integrated with HPRA's technical access management.

• Effective security controls including vulnerability management, timely patching, incident response, regular penetration testing, and protection against denial-of-service attacks.

• Technical and organisational measures for data protection throughout its lifecycle.

• Encryption for data in transit and at rest, including standards, key ownership, rotation, and storage.

• Security-related event logging, monitoring, and alerting, with proactive monitoring and log retention.

• Proactive security measures, including plans and independent assurance for security/intrusion testing and vulnerability scans.

• Procedures for security incident and personal data breach management, including response process, notification timelines, and escalation routes.

• Implementation Approach:

• Description of the proposed approach and methodology for delivering, commissioning, and transitioning the solution.

• Plan for accelerated but controlled transition, with clear sequencing, risk management, stakeholder engagement, and service continuity safeguards.

• Project overview, structure, key delivery phases, and transition to production.

• Outline project plan with phases, activities, timelines, milestones, dependencies, and decision points.

• Description of governance arrangements, roles, responsibilities, and escalation routes.

• Scope management and change control process.

• Approach to training and knowledge transfer for users, administrators, and support teams.

• Activities for rollout, cutover support, production readiness, and transition to business-as-usual support.

The contract is for an initial three-year term, with annual extensions possible, subject to satisfactory performance.

3. Background & buyer context

The Health Products Regulatory Authority (HPRA) is an Irish state agency responsible for regulating medicines and medical devices to benefit people and animals. With 420 personnel, the HPRA operates across nine departments, overseeing human medicines, veterinary medicines, medical devices, clinical trials, and other health-related products and services. The HPRA's mission is "to regulate medicines and devices for the benefit of people and animal" with a vision of "excellence in health product regulation through science, collaboration and innovation."

The HPRA is the national competent authority for pharmacovigilance, managing Ireland's adverse reaction reporting system for human medicines and clinical trials. This involves collecting, processing, and reporting suspected adverse reactions in compliance with national and international regulations, including Good Pharmacovigilance Practice Module VI. The HPRA ensures the quality, safety, and efficacy of medicines available in Ireland and participates in EU-wide regulatory systems.

The current pharmacovigilance system, ARISg (version 7.4.1.2), has been in operation for over 15 years and is hosted on-premise. The technology and application are dated and require an upgrade. The HPRA is self-funded, with 85% of income generated from fees charged to the pharmaceutical industry and 15% from grants. Value for money is a key objective. This procurement seeks a modern, state-of-the-art solution to improve efficiency and effectiveness in pharmacovigilance activities and contribute to public health.

4. Eligibility & selection criteria

Bidders must meet the following minimum requirements to be considered for this tender:

• Turnover requirement: Not specified for this tender.
• Insurance:
• Employers Liability: €12.7 million
• Public Liability: €6.5 million
• Professional Indemnity: €1 million
• Cyber Security: €5 million
• Certifications: Not specified for this tender.
• Past experience: Not specified for this tender.
• Personnel: Not specified for this tender.
• Geographic / facility constraints: Data must remain within the EU/EEA unless expressly approved by HPRA and supported by appropriate transfer safeguards.

5. Award criteria & scoring

The contract will be awarded based on the Most Economically Advantageous Tender (MEAT) principle, balancing cost and quality.

Criterion Weight (%) Sub-criteria