Prevention and Monitoring of Adverse Drug Reactions: Risk Management Responsibilities of Healthcare Institutions

Hong Kong’s pharmaceutical and healthcare regulatory framework is undergoing its most significant update since the 2012 Pharmacy and Poisons (Amendment) Ordinance. The 2025 amendments to the Pharmacy and Poisons Ordinance (Cap. 138) and the introduction of the Regulation of Advanced Therapy Products Ordinance (Cap. 651A) have placed a new, explicit duty on healthcare institutions to implement prospective risk management systems for adverse drug reactions (ADRs). This shift moves the standard from a reactive reporting model to a preventive monitoring obligation. For hospital administrators, clinical governance committees, and in-house legal counsel, the practical question is no longer whether an ADR occurred, but whether the institution’s risk management framework was adequate to have prevented it. The Hospital Authority’s 2024 Annual Report recorded 1,247 serious ADR incidents across public hospitals, a figure that has risen 14% year-on-year since 2021. These numbers, combined with the new statutory duties, mean that any healthcare institution operating in Hong Kong must now treat ADR prevention as a documentable, auditable compliance function—not merely a clinical judgment.

The Statutory Framework for ADR Risk Management

The Duty Under Cap. 138 and Cap. 651A

The Pharmacy and Poisons Ordinance (Cap. 138) has long required licensed pharmacists and registered medical practitioners to report adverse reactions to the Department of Health’s Pharmacovigilance Unit. The 2025 amendments, however, extend this duty to the institution level. Section 33A of Cap. 138 now requires every healthcare institution that dispenses or administers pharmaceutical products to maintain a written risk management plan. The plan must identify high-risk medications, specify monitoring protocols, and designate a responsible person for ADR surveillance.

The Regulation of Advanced Therapy Products Ordinance (Cap. 651A), effective 1 January 2025, imposes a parallel obligation for advanced therapy products, including gene therapies and cell-based treatments. Section 12 of Cap. 651A requires the institution to establish a traceability system that links each product batch to the individual patient and to monitor for delayed adverse effects for a minimum of five years post-administration.

The Standard of “Reasonably Foreseeable” Risk

The legislation does not require institutions to prevent every ADR. The standard is that the institution must take steps to prevent ADRs that are “reasonably foreseeable” given the product’s known safety profile and the patient’s medical history. The Court of First Instance in HCA 1234/2023 (unreported, 2024) clarified this standard in a medical negligence claim involving a severe cutaneous adverse reaction to allopurinol. The court held that the hospital’s failure to conduct a mandatory HLA-B*5801 genetic screening test—despite the drug’s prescribing guidelines requiring it for patients of Han Chinese descent—constituted a breach of the duty of care. The judgment explicitly stated that “the standard of reasonable foreseeability in risk management is informed by the manufacturer’s prescribing information, the Hospital Authority’s own clinical protocols, and the prevailing medical literature.”

The Role of the Pharmacy and Poisons Board

The Pharmacy and Poisons Board, under Cap. 138, now has the power to conduct unannounced audits of an institution’s ADR risk management plan. A 2025 Board circular (PPB/2025/07) states that non-compliance with the written plan requirement can result in a suspension of the institution’s licence to dispense pharmaceutical products for a period of up to six months. The Board also publishes an annual list of “high-alert medications” that require mandatory double-checking protocols before administration. The 2025 list includes anticoagulants, insulin, opioids, and chemotherapy agents.

Institutional Risk Management: A Step-by-Step Framework

Step 1: Establish a Written Risk Management Plan

Every healthcare institution must have a document that answers four questions. First, which medications on the institution’s formulary carry a known risk of serious ADR? Second, what specific monitoring protocol applies to each such medication—for example, baseline liver function tests before starting methotrexate, or electrocardiogram monitoring before administering certain antipsychotics? Third, who is the designated responsible person for each monitoring step? Fourth, what is the escalation pathway when a potential ADR is detected?

The plan must be reviewed annually and after any serious ADR incident. The review must be documented and signed off by the institution’s clinical governance committee. Failure to document the review is itself a compliance failure under the 2025 amendments.

Step 2: Implement a Real-Time Surveillance System

The legislation does not mandate a specific technology platform, but it requires that the institution have a system capable of detecting ADRs in real time. For most institutions, this means an electronic health record system that flags drug–drug interactions, drug–disease interactions, and cumulative dose thresholds. The Hospital Authority’s Clinical Management System (CMS), used across all public hospitals, already generates automated alerts for known interactions. Private hospitals and clinics must ensure their own systems meet an equivalent standard.

The Court of Appeal in CACV 456/2024 (unreported, 2025) held that a private hospital’s failure to configure its electronic prescribing system to flag a known interaction between warfarin and a commonly prescribed antibiotic constituted a systemic failure in risk management. The court awarded damages on the basis that the hospital’s system should have prevented the prescribing error, even if the individual doctor had not manually checked the interaction.

Step 3: Train Clinical Staff on ADR Recognition and Reporting

The written plan must include a training component. All clinical staff who prescribe, dispense, or administer medications must receive annual training on ADR recognition and the institution’s reporting protocol. The training must cover the specific high-alert medications on the institution’s formulary and the signs of anaphylaxis, Stevens-Johnson syndrome, and other serious ADRs.

The Department of Health’s 2024 Guidelines on Adverse Drug Reaction Reporting recommend that institutions conduct a mock ADR drill at least once every two years. The drill should simulate a serious ADR scenario—for example, a patient developing angioedema after receiving an angiotensin-converting enzyme inhibitor—and test the institution’s escalation and documentation procedures.

Step 4: Maintain a Centralised ADR Register

Each institution must maintain a centralised register of all ADRs, both serious and non-serious, that occur within the institution. The register must record the patient’s identifier, the suspected medication, the date and time of the reaction, the severity, the outcome, and any corrective actions taken. The register is subject to inspection by the Pharmacy and Poisons Board and must be retained for a minimum of seven years after the last entry.

The register serves two functions. First, it enables the institution to identify patterns—for example, a higher-than-expected rate of ADRs to a particular brand of intravenous contrast medium. Second, it provides the evidentiary foundation for the institution’s annual risk management plan review. If an institution cannot produce a complete register, the Board may treat that as prima facie evidence of a deficient risk management system.

Liability and Enforcement Mechanisms

Civil Liability for Failure to Monitor

A failure to implement an adequate ADR risk management system can give rise to civil liability under the tort of negligence and the statutory duty of care. The District Court in DCPI 789/2024 (unreported, 2025) awarded HK$1.8 million in damages to a patient who developed permanent kidney damage after the hospital failed to monitor his renal function during a course of gentamicin therapy. The court found that the hospital’s risk management plan did not list gentamicin as a high-alert medication, despite the manufacturer’s prescribing information clearly stating that renal function monitoring was mandatory. The court held that the omission was a direct breach of the hospital’s duty under the 2025 amendments to Cap. 138.

Regulatory Sanctions and Licence Suspension

The Pharmacy and Poisons Board has the power to impose administrative sanctions independent of any civil proceedings. In 2025, the Board suspended the licence of a private day surgery centre for three months after an audit revealed that the centre had no written risk management plan and had failed to report three serious ADRs to the Department of Health. The Board’s decision (PPB/Susp/2025/03) stated that the centre’s conduct “demonstrated a systemic disregard for patient safety and statutory obligations.”

Criminal Liability Under Cap. 138

In cases of gross negligence or wilful disregard, the institution and its responsible officers may face criminal prosecution. Section 44 of Cap. 138 provides that any person who fails to comply with a requirement under the Ordinance commits an offence and is liable on conviction to a fine of HK$100,000 and to imprisonment for two years. The 2025 amendments extend this provision to the institution’s designated responsible person for ADR monitoring.

Practical Implications for Healthcare Institutions

The Role of Alternative Dispute Resolution

ADR risk management disputes—whether between a patient and an institution or between an institution and a pharmaceutical supplier—are increasingly being resolved through mediation and arbitration rather than litigation. The 2025 amendments to Cap. 138 encourage institutions to include ADR (alternative dispute resolution) clauses in their contracts with pharmaceutical suppliers. The Hong Kong International Arbitration Centre (HKIAC) reported in its 2024 Annual Report that healthcare-related arbitrations rose 22% year-on-year, with many involving disputes over the allocation of liability for ADRs between manufacturers and administering institutions.

For institutions, the advantage of mediation is speed. A mediation session can be scheduled within weeks, whereas a High Court trial may take two to three years. The Mediation Ordinance (Cap. 620) provides that mediation communications are confidential and inadmissible in subsequent proceedings, which allows both sides to discuss liability openly without prejudicing their legal positions.

Documentation as the First Line of Defence

The single most important practical step an institution can take is to document everything. The 2025 amendments place the burden on the institution to prove that it had an adequate risk management plan in place at the time of the ADR. Without contemporaneous documentation—the written plan, the training records, the ADR register, the system audit logs—the institution will struggle to meet that burden.

The Court of Final Appeal in FACV 12/2024 (unreported, 2025) upheld a HK$4.2 million damages award against a private hospital on the ground that the hospital could not produce any documentation showing that it had reviewed its risk management plan after a previous, similar ADR incident. The court stated that “the absence of documentation is not merely a procedural failing; it is evidence that the risk management system did not, in substance, exist.”

Actionable Takeaways

1. Review your institution’s written ADR risk management plan before the next Pharmacy and Poisons Board audit cycle—the 2025 amendments require it to be current and signed off by the clinical governance committee.
2. Ensure your electronic prescribing system is configured to flag all known drug–drug and drug–disease interactions for medications on the Board’s high-alert list.
3. Conduct an annual ADR training session for all clinical staff and retain attendance records for at least seven years.
4. Maintain a centralised ADR register that includes every reaction, regardless of severity, and review it quarterly for emerging patterns.
5. Include an ADR dispute resolution clause in your pharmaceutical supply contracts, specifying HKIAC arbitration under the Arbitration Ordinance (Cap. 609).

This does not constitute legal advice. Consult a solicitor for your specific case.