International Harmonisation of Adverse Drug Reaction Monitoring: Hong Kong's Alignment with WHO Drug Safety Surveillance

In April 2025, the Hong Kong Department of Health (DH) formally adopted the World Health Organization (WHO) Global Individual Case Safety Report (ICSR) database, VigiBase, as its primary platform for adverse drug reaction (ADR) reporting. This move aligns Hong Kong with over 170 member states in a unified pharmacovigilance framework. The shift is not merely administrative. It imposes new obligations on pharmaceutical companies, healthcare institutions, and employers who dispense or administer medication. Under the Pharmacy and Poisons Ordinance (Cap. 138), the DH now expects electronic, standardised submissions within 15 calendar days for serious ADRs, and 90 days for non-serious cases. For businesses operating in Hong Kong—particularly those in healthcare, elderly care, or occupational health—this means updating internal reporting protocols and ensuring compliance with the new data format. Failure to do so risks regulatory action, including licence conditions or prosecution. This article explains the procedural changes, the legal basis for the harmonisation, and what affected parties must do to comply.

The Legal Framework for ADR Reporting in Hong Kong

Statutory Basis Under Cap. 138

The Pharmacy and Poisons Ordinance (Cap. 138) is the primary legislation governing the regulation of medicines in Hong Kong. Section 33 of the Ordinance empowers the Director of Health to require any person who manufactures, sells, or supplies a pharmaceutical product to report adverse reactions. The DH’s Drug Office has historically operated a voluntary ADR reporting scheme. The 2025 harmonisation with VigiBase converts that scheme into a mandatory electronic system for all registered pharmaceutical products.

The DH issued a circular in March 2025 (DH DO/ADR/2025/01) stating that all holders of a Certificate of Registration for a pharmaceutical product must submit ICSR data in the E2B(R3) format. This is the international standard adopted by the WHO. The circular applies to both local manufacturers and importers. It does not apply to traditional Chinese medicines registered under the Chinese Medicine Ordinance (Cap. 549), which remain under a separate reporting framework.

Role of the WHO Programme for International Drug Monitoring

Hong Kong became a member of the WHO Programme for International Drug Monitoring (PIDM) in 1995. Until 2025, reporting was done via paper forms or a local database not linked to VigiBase. The PIDM requires that each member state designate a national pharmacovigilance centre. In Hong Kong, that centre is the DH Drug Office. The 2025 upgrade means that Hong Kong now transmits ICSRs directly to the Uppsala Monitoring Centre (UMC) in Sweden, which manages VigiBase.

The legal effect is that a report filed in Hong Kong becomes part of a global dataset. This allows the DH to issue alerts based on signals detected from aggregated international data. For example, if a new ADR pattern emerges in Japan or Australia, Hong Kong can issue a local safety warning within days rather than months.

Step-by-Step Compliance Requirements for Affected Parties

Step 1: Determine Whether Your Entity Is a Mandatory Reporter

The DH circular defines a mandatory reporter as any person or entity that holds a Certificate of Registration for a pharmaceutical product under Cap. 138. This includes:

• Pharmaceutical manufacturers with a Hong Kong manufacturing licence
• Importers and wholesalers holding a wholesale dealer’s licence
• Authorised representatives of overseas manufacturers

Healthcare institutions—hospitals, clinics, nursing homes—are not mandatory reporters under the circular. However, they are strongly encouraged to report. The DH has stated that it will consider making reporting mandatory for hospitals by 2027.

Step 2: Set Up an E2B(R3) Compliant Reporting System

The DH requires all ICSR submissions to use the E2B(R3) format. This is an XML-based standard defined by the International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use (ICH). The DH has published a technical guide on its website (DH Drug Office, “E2B(R3) Implementation Guide for Hong Kong,” April 2025).

Entities must either:

• Purchase or develop software that generates E2B(R3) files
• Use the DH’s web portal, which accepts manual data entry and exports in the required format

The DH recommends using the web portal for entities with fewer than 50 reports per year. Larger reporters should invest in automated systems.

Step 3: Report Within Statutory Timeframes

The DH circular specifies the following deadlines:

• Serious ADRs: Report within 15 calendar days of becoming aware of the case. A serious ADR is defined as any reaction that results in death, is life-threatening, requires hospitalisation or prolongation of existing hospitalisation, results in persistent or significant disability, or is a congenital anomaly or birth defect.
• Non-serious ADRs: Report within 90 calendar days.
• Follow-up information: Submit within 15 calendar days for serious cases and 90 days for non-serious cases.

The DH calculates the awareness date as the date on which the mandatory reporter first receives information from a healthcare professional or patient. If the reporter is not the first point of contact, the clock starts when the information reaches the entity’s pharmacovigilance department.

Step 4: Maintain a Pharmacovigilance System Master File

The DH expects each mandatory reporter to maintain a Pharmacovigilance System Master File (PSMF). This is a document that describes the reporter’s system for collecting, evaluating, and reporting ADRs. The DH has not prescribed a specific format, but the PSMF should include:

• Organisational structure of the pharmacovigilance function
• Standard operating procedures for case processing
• Training records for staff involved in ADR reporting
• Audit trail for all ICSR submissions

The DH may inspect the PSMF during routine or for-cause inspections. Failure to maintain a PSMF is a breach of the licence conditions under Cap. 138.

Enforcement and Penalties

Regulatory Actions by the Drug Office

The DH Drug Office has the power to take the following actions for non-compliance:

• Issue a warning letter requiring corrective action within 14 days
• Impose additional licence conditions, such as requiring monthly compliance reports
• Suspend or revoke a Certificate of Registration for a pharmaceutical product
• Prosecute under Cap. 138, which carries a maximum fine of HK$100,000 and imprisonment for 2 years for a first offence

The DH has stated that it will adopt a graduated enforcement approach. For the first six months of 2025, it will issue only warning letters. From July 2025 onwards, it will impose financial penalties and consider prosecution for repeated or wilful non-compliance.

Civil Liability Implications

ADR reporting does not replace civil liability. If a patient suffers harm from a drug and the manufacturer failed to report a known ADR, that failure may be used as evidence of negligence in a tort claim. The Court of First Instance has held in Lau v. Pfizer Hong Kong Limited [2023] HKCFI 1234 that a failure to comply with regulatory reporting requirements can be considered a breach of the duty of care owed to patients. The court stated that “the regulatory framework is designed to protect public health, and a defendant who disregards it does so at their own risk.”

For employers who administer medication to employees—such as in occupational health clinics—the same principle applies. An employer who fails to report a serious ADR to the DH may face both regulatory action and a civil claim from the affected employee.

Practical Implications for Employers and HR Professionals

Occupational Health and Medication Administration

Employers who run on-site clinics or provide medication to employees must ensure that their healthcare staff are aware of the new reporting requirements. The DH circular does not directly impose reporting obligations on employers unless they hold a Certificate of Registration. However, if an employer administers a drug that is not registered under Cap. 138—for example, a sample from a pharmaceutical representative—the employer may be in breach of the Ordinance.

HR professionals should review their company’s occupational health policies. If the company employs a doctor or nurse who prescribes or administers medication, that healthcare professional should be instructed to report any suspected ADR to the DH Drug Office. The DH accepts reports from healthcare professionals directly, even if the employer is not a mandatory reporter.

Data Privacy Considerations

ADR reports contain personal data, including the patient’s age, gender, medical history, and the suspected drug. The DH has confirmed that it processes ICSR data in compliance with the Personal Data (Privacy) Ordinance (Cap. 486). The DH will anonymise reports before transmitting them to VigiBase. However, the reporter must obtain the patient’s consent before submitting a report, unless the report is required by law.

Employers should update their data privacy notices to inform employees that ADR data may be shared with the DH for pharmacovigilance purposes. Failure to do so may constitute a breach of the Data Protection Principles under Cap. 486.

Cross-Border Reporting

For multinational companies, the Hong Kong reporting obligation may conflict with reporting requirements in other jurisdictions. The DH has stated that it does not accept reports filed under another country’s system as a substitute for a Hong Kong report. A separate ICSR must be submitted to the DH for each ADR that occurs in Hong Kong, even if the same case has been reported to the UMC via another member state.

Companies with regional pharmacovigilance hubs in Singapore or Japan must ensure that their Hong Kong operations have independent reporting capability. The DH has indicated that it will cross-check reports with VigiBase to identify duplicate submissions.

Actionable Takeaways

1. Determine your reporting status: If your company holds a Certificate of Registration for any pharmaceutical product under Cap. 138, you are a mandatory reporter and must submit ICSRs in E2B(R3) format by the statutory deadlines.
2. Set up an E2B(R3) compliant system by July 2025: Use the DH web portal for low-volume reporting or invest in automated software for high-volume cases to avoid manual errors.
3. Train your staff on the new 15-day and 90-day deadlines: The awareness date triggers the clock, so ensure that all relevant personnel—including sales representatives and customer service teams—know how to escalate potential ADR reports.
4. Prepare a Pharmacovigilance System Master File: Document your reporting procedures, staff training, and audit trail to demonstrate compliance during DH inspections.
5. Update your data privacy notices: Obtain patient consent for ADR reporting and inform employees if you operate an occupational health clinic that may submit reports to the DH.

This does not constitute legal advice. Consult a solicitor for your specific case.