Beyond the EHR: meeting the FDA’s new real-world evidence standards

For years, the use of real-world evidence (RWE) in regulatory submissions has required managing complex privacy constraints, fragmented data standards, and ambiguous agency expectations. A series of recent regulatory updates has fundamentally shifted this landscape.

Between December 2025 and March 2026, the FDA issued two distinct but highly complementary pieces of guidance regarding Real-World Data (RWD). While one targeted medical devices and the other focused on drugs and biologics, together they signal a unified regulatory philosophy: the FDA is lowering the privacy barrier for RWD while significantly raising the requirements for data structure and provenance.

For clinical operations and data strategy leaders, understanding the nuances of both pathways is critical for adapting to this shift.

A side-by-side assessment: devices vs. drugs

Medical devices: lowering the privacy barrier (December 2025)

In December 2025, the FDA finalized guidance that sent a strong signal to the life sciences industry by relaxing the requirement for individually identifiable source data, and creating a conditional pathway for de-identified RWD when using RWE in medical device submissions.^[1]

• The core change: The agency acknowledged that requiring identifiable patient data for expansive post-market registries or EHR-derived datasets was a significant operational and privacy hurdle. The FDA substantially reduced the operational and legal friction involved in using large-scale databases for regulatory submissions.
• The implication: For MedTech, this accelerates the ability to use post-market registries for label expansions and regulatory decision-making. Regulatory attorneys across the industry viewed this as a leading indicator: if the FDA accepts de-identified data for devices, similar flexibility for drug and biologic submissions is likely to follow.

Drugs and biologics: raising the quality requirements (March 2026)

In March 2026, the FDA adopted ICH M14: General Principles on Planning, Designing, Analyzing, and Reporting of Non-Interventional Studies That Utilize Real-World Data for Safety Assessment of Medicines, a harmonized international guidance developed in collaboration with EMA and PMDA.^[2] While the device guidance created flexibility around identifiability, the drug guidance raised the methodological bar.

• The core change: The guidance established explicit standards for how sponsors must design, analyze, and report non-interventional pharmacoepidemiological studies used for post-approval safety assessment. It directly addresses the limitations of unstructured EHR and claims data for this purpose.
• The implication: Sponsors cannot submit an EHR export and treat it as fit-for-purpose safety evidence. The study design, data provenance, and statistical approach must be pre-specified and documented to the ICH M14 standard.

The shared destination: enriching RWD with patient perspectives

Because the FDA is increasingly focused on the patient perspective alongside clinical endpoints, relying solely on administrative claims or EHR data is often insufficient. To meet regulatory standards, sponsors are increasingly combining retrospective clinical data with prospective, direct-to-patient data collection via electronic patient-reported outcomes (ePRO).

We see this exact shift in our own platform data. Across the Castor platform today, over 360 observational and registry studies are actively enriching their clinical datasets by capturing more than 16.4 million patient-reported data points. Sponsors recognize that pairing clinical data with quality-of-life and patient-reported outcomes is a defensible way to satisfy regulatory scrutiny.

The technology imperative

If sponsors are going to submit pseudonymized RWE to support a regulatory decision, the agency still needs to trust the origin and integrity of the data.

The important distinction is between de-identification and pseudonymization. At the study conduct level, data must be pseudonymized: direct identifiers are stripped for the sponsor and regulator, while a secure coded link is maintained at the investigator level for safety reporting and source data verification. True de-identification, which severs that link entirely, is generally inappropriate during an active study because it makes source data verification and adverse event follow-up impossible. The FDA’s December 2025 device guidance accepts de-identified data at the point of regulatory submission, where the audit trail has already been captured during the study itself.

This requires infrastructure built on modern data standards: CDISC for regulatory output (required for FDA submissions) and FHIR for EHR data ingestion (an FDA-encouraged standard currently under active evaluation for RWD submissions).^[4]

At Castor, our clinical trial solutions are powering 1,077 observational studies and registries encompassing over 627,000 patients globally.

Across that volume, we see a distinct trend: sponsors are building reusable, interoperable data assets rather than single-submission registries. This requires infrastructure capable of ingesting EHR data via FHIR, integrating prospective ePRO, and producing CDISC-compliant output with full audit trails. Castor’s Catalyst platform is built to this specification. By maintaining full audit trails without exposing Protected Health Information, this infrastructure provides the exact defensibility the FDA requires.

In practice: the Kaleido Registry

To understand how this shift plays out operationally, we can look at large-scale commercial deployments on the Castor platform. The Kaleido Registry, a prospective commercial registry, successfully enrolled nearly 34,000 participants across 8 sites. Rather than relying solely on administrative site data, the sponsor deployed a high-volume ePRO strategy to capture over 117,000 patient-reported data points directly from the participants. This approach reflects the direction both guidance documents point: large-scale observational datasets that integrate patient-reported data at the point of collection, rather than appending it retrospectively.

Conclusion: building for the long term

The 2025 and 2026 RWD guidance changes provide a clear framework for the future of clinical development. The FDA has outlined a pathway for faster, more pragmatic evidence generation across both devices and drugs, provided sponsors can meet the heightened expectations for data provenance.

For mid-size biotechs and MedTech organizations, the immediate action item is evaluating the foundational architecture of their observational studies. A registry designed only to satisfy a post-market surveillance requirement captures limited downstream value. A registry built on interoperable, pseudonymized infrastructure, with prospective ePRO built in from the start, can support subsequent label expansions and serve as a reusable data asset across the product lifecycle.

Organizations that build interoperable, audit-ready data infrastructure now will be better positioned to meet current FDA standards and to repurpose registry data for lifecycle management as their product pipelines mature.

Diagnostic: assessing your RWE readiness

Use the questions below to evaluate your organization’s current position relative to the 2025 and 2026 FDA guidance requirements.

For MedTech and device leaders

• Pseudonymization and provenance: With the December 2025 guidance relaxing the need for individually identifiable data, can your post-market registries securely pseudonymize data to protect PHI while maintaining the investigator-level audit trail required for regulatory submission?
• Post-market scalability: Are you treating post-market surveillance as a static compliance exercise, or are you capturing direct-to-patient outcomes (ePRO) to build a reusable asset for future label expansions?

For pharma and biotech leaders

• Patient perspective enrichment: To meet the March 2026 standards for relevance and reliability, are you relying solely on unstructured EHR pulls, or are you actively enriching your non-interventional datasets with structured patient-reported outcomes?
• Regulatory interoperability: Is your observational data CDISC-ready by default, or would it require months of costly, manual, retroactive mapping to meet the strict FDA submission standards for drugs and biologics?

References

1. FDA. “Use of Real-World Evidence to Support Regulatory Decision-Making for Medical Devices.” Finalized December 18, 2025. fda.gov/regulatory-information/…
2. FDA. “M14 General Principles on Planning, Designing, Analyzing, and Reporting of Non-Interventional Studies That Utilize Real-World Data for Safety Assessment of Medicines.” Federal Register, March 4, 2026. federalregister.gov/…
3. FDA. “Real-World Evidence: Considerations Regarding Non-Interventional Studies for Drug and Biological Products.” Draft guidance, March 2024. [In draft as of April 2026.] fda.gov/regulatory-information/…
4. FDA. “Exploration of HL7 FHIR for Use in Study Data Created from Real-World Data Sources for Submission to the FDA.” Federal Register, April 2025. federalregister.gov/…