Here’s a tutorial on the usual process for vaccine development, testing and approval, for folks tracking the new coronavirus (COVID-19).  In brief: it will take a while and very large clinical trials to get a coronavirus vaccine approved at FDA. But preapproval testing is likely to happen on the ground where the coronavirus is spreading, and there is a potential for expanded access (to the unapproved vaccine) in the meantime.

Vaccines Need Preapproval

Vaccines are intended to prevent disease.  As a result they are considered “drugs” under the Federal Food, Drug, and Cosmetic Act as well as “biological products” under the Public Health Service Act.  As a result, vaccines must be approved by FDA before they can be shipped in interstate commerce.  A vaccine manufacturer must secure approval of a biologics license application, so sometimes we say they are “licensed” rather than “approved.”  FDA’s Center for Biologics Evaluation and Research (CBER) handles this.

Standard of Approval

FDA will not license a vaccine unless the applicant has shown that

• the vaccine is “safe, pure, and potent,” which in this context means “safe and effective” and
• the facility where it is made complies with “current good manufacturing practices.”

For a new drug (including a vaccine), the conventional premarket development paradigm involves preclinical testing (in the laboratory and in animals) sufficient to show that the drug is safe enough for clinical trials, followed by several phases of clinical testing.  The clinical trials start small but culminate in “phase 3” trials.  These are also known as “pivotal” trials, and they are designed to provide statistically robust proof of effectiveness and to complete the safety database that is used for the approval decision. 

The final approval decision represents the agency’s view that the data collected to date show the drug’s benefits outweigh its risks when it is used as intended.  Of course, we can’t know everything there is to know about a new drug, at the time of initial approval. Information continues to roll in, as doctors and patients use the drug.  FDA makes the approval (licensure) decision, the benefit-risk call, based on the data that can be gathered in a premarket testing program of reasonable size and duration.

For a Vaccine, What Exactly Are We Testing?

Clinically speaking, a vaccine is effective if it reduces the incidence of a disease.  The gold standard for proof of efficacy is a randomized, controlled, double-blinded trial showing a reduction of incidence in a vaccinated group compared to an un-vaccinated group.  As an ethical matter, though, we do not simply administer the test vaccine to half our enrolled subjects and then expose the entire group to a dangerous pathogen.  (Obviously!)  So one way we test vaccines is to administer them in areas where a disease is spreading; we compare the outcomes for people who’ve received the vaccine with outcomes for people who didn’t receive it (or who receive it later in time).  Put another way, we do the preapproval testing on the ground during the crisis at hand.  I give an example below.

Contents of a Vaccine Application

FDA has licensed between 80 and 90 vaccines for the U.S. market (complete list is here).  Many of these, such as the childhood vaccines, have been around for a long time.  In December 2019, however, the agency approved a vaccine for prevention of disease caused by the Zaire ebolavirus in individuals 18 and older.  I’ll describe the safety and effectiveness information in Merck’s application, from the public documents (the professional labeling and the summary basis for regulatory action, mostly), so readers can see what’s involved. 

(There is more to an application, such as information relating to the composition of the vaccine and the manufacturing process. I am just focusing here on the safety and efficacy data.)

The vaccine is a live recombinant viral vaccine, which (in very simple terms) combines the backbone of the vesicular stomatitis virus (VSV) with a glycoprotein from the Zaire ebolavirus.  You may see it written as rVSV-ZEBOV, and it’s marketed by Merck under the name Ervebo. 

Here is what the application contained:

Data from Animal Studies

• A repeat-dose toxicity study in cynomolgus macaques.
• An exploratory immunogenicity and viremia study in rats (which seems to have started with an injection 28 days before mating and to have included a checkup 21 days after birth).  An immunogenicity study measures the presence of antibodies ; a viremia study measures the presence of the virus.
• A variety of “challenge studies” in animals, including mice, hamsters, and nonhuman primates.  A challenge study involves intentionally exposing the animals to the infectious organism, and the results (in animals) support effectiveness. 
• A biodistribution study in cynomolgus macaques

Data from Clinical (Human) Studies

• The clinical development program ultimately involved 15,997 adult subjects in North America, Europe, and Africa.  Of these, 15,399 received a dose of the vaccine.  (If this seems like a lot of people, consider Sanofi’s vaccine for dengue disease, also approved in 2019. The application included 17 clinical studies, and the 5 pivotal studies alone enrolled more than 39,000 subjects.) The program appears to have comprised eight Phase 1 studies and four Phase 2/3 studies. 
• Effectiveness was assessed during the 2014-2016 outbreak in the Republic of Guinea in something called the “Ring Vaccination Study.”  In plain English, they identified “clusters” of individuals tied to patients with laboratory-confirmed Ebola virus disease (EVD), and they randomized the clusters to receive either immediate or delayed vaccination.  Ultimately 2,108 individuals received immediate vaccination, and 1,429 received delayed vaccination.  Then they compared what happened.  Vaccine efficacy was 100%.  No cases of confirmed EVD were observed in the immediate vaccination clusters.  Ten confirmed cases were observed in the delayed vaccination clusters between Day 10 and Day 31 after randomization.
• The remaining clinical studies included a randomized, double-blind, placebo controlled trial in healthy adult subjects in the United States, Canada, and Spain, designed to test safety and immunogenicity (i.e., to measure antibody titers).  Two other clinical studies assessed antibody response: a randomized, double-blind, placebo-controlled study in 500 health adults in Liberia, and an open-label study of 8673 adults working in healthcare facilities (or other frontline activities) in Sierra Leone.  And, as noted, there were other clinical studies as well.

And How Long Did This Take?

It was almost six years from the start of the recent Ebola outbreak to the approval of a vaccine. The index patient was a toddler reported in December 2013, and Merck’s vaccine was approved at the end of 2019.

Here is the timeline in brief.

• The Ebola virus was discovered in the 1970s.  The Public Health Agency of Canada started developing a vaccine in the early 2000s.  In 2011, it licensed the commercial rights to NewLink Genetics Corp., a company in Iowa.
• In November 2014, when the Ebola outbreak in West Africa was peaking, Merck entered into a license agreement with NewLink Genetics to develop, manufacture, and distribute ERVEBO.  (To read more about this, and the U.S. government’s involvement, see here.) 
• The Ring Vaccination Study was conducted during the 2014-2016 outbreak in the Republic of Guinea.
• The company was running other studies in parallel.  The study in Sierra Leone, for instance, ran from April 2015 to December 2016.  The study in Liberia started in January 2015, with a primary completion date in June 2016. 
• In January 2017, Merck and FDA agreed that the efficacy data from the Ring Vaccination Study would support traditional approval of the vaccine, when combined with additional safety and immunogenicity data. 
• In October 2018, the company started a “rolling BLA” submission, which means that they provided chunks of the application as completed.  The application was completed on July 15, 2019, and FDA approved the application on December 19, 2019.

If you want a deeper and more contextualized dive into the history of this vaccine and the trial, Helen Branswell (who is worth following on Twitter) did a terrific story on STAT earlier this year (here).

Expanded Access

The Ebola outbreak was not in full swing for the entire six years. The region was basically Ebola-free in early 2016.  And during subsequent Ebola outbreaks in the region, Merck worked with the World Health Organization (WHO) as well as Médecins Sans Frontières to provide access to the investigational vaccine throughout the region on an expanded access (compassionate use) basis.  For example, there was a compassionate use protocol (approved by Guinean authorities) in March 2016 (discussed in this Lancet article, which is behind a paywall).  And Merck shipped doses to the WHO in 2018, to help with an outbreak in the Democratic Republic of the Congo.  (There’s a little about this here.)

What Does This Mean for Coronavirus?

News reports suggest that many organizations are working on vaccines for COVID-19. Some no doubt have substantial experience developing and manufacturing vaccines.  Others have less.  I would expect that a smaller biotech company or academic lab that develops a promising vaccine will ultimately end up partnering with a larger company that has vaccine experience and manufacturing capacity.  In any case, as explained, approval by the U.S. FDA will require an application with proof of safety and effectiveness, which will follow preclinical studies and then clinical trials.  And the pivotal trials will need to be quite large.

In the meantime, at least in theory there could be expanded access arrangements or even, perhaps, an Emergency Use Authorization (EUA).  I described the EUA process in my previous post (here).  That involves a three-step process: (1) the Secretary of HHS declares a public health emergency; (2) HHS issues a declaration saying that it’s prepared to issue emergency use authorizations; and (3) on a product-by-product basis, FDA issues authorizations. Readers should note: Secretary Azar has declared a public health emergency (step 1).  He also issued a declaration that circumstances exist to justify EUAs (step 2), but that declaration was limited to diagnostics.  So he would have to issue a new one, if FDA were going to issue EUAs for vaccines.  (This is not a big deal; I am just pointing out that another piece of paper has to be issued.)

In short, FDA and HHS have some options and flexibility here, which may be important as this situation evolves. But conventional approval of a new vaccine for widespread use typically requires very large trials.  Dr. Henry Miller, the founding director of FDA’s Office of Biotechnology, wrote a sobering piece on his blog a few days ago, reminding us just how conservative the agency is, when it comes to vaccine approval.