MLR Review Recordkeeping: What Pharma Compliance Teams Need to Know

Summary: 

MLR approval is only one part of pharmaceutical promotional compliance. Once sales reps share approved materials through messaging apps, companies also need a reliable record of those communications. This article explains how pharma compliance teams can connect approved assets to real-world communications to strengthen oversight and reduce risk. 

Key Takeaways:

• Approval alone is not enough: Companies must preserve the conversations in which MLR-approved assets are shared and discussed in addition to the assets themselves. 
• Context can change compliance risk: An approved document can become part of a problematic communication if a rep adds unsupported claims, removes necessary context, or sends an expired version.
• Traceability is essential: Compliance teams should be able to connect each field communication to the exact approved asset, version, send, recipient, and surrounding conversation.
• Recordkeeping requires more than archiving: Effective controls should include complete capture, content fidelity, supervision, search, retention, legal hold, and audit trails.
• Messaging governance closes the gap: Governed communication channels help pharma companies retain rep conversations, detect exceptions, and demonstrate that MLR policies work.

Pharmaceutical companies invest heavily in Medical, Legal, and Regulatory (MLR) review to make sure any promotional content they distribute is accurate, balanced, substantiated, and consistent with applicable regulatory requirements before it ever gets to healthcare professionals or patients.

In some ways the MLR process is the easy part – it’s what happens after that can create compliance challenges. Once a sales representative shares an approved visual aid, responds to a physician’s question by text, forwards a product link over WhatsApp, or summarizes a clinical claim in an SMS, the communication has moved beyond the controlled environment of the company’s MLR platform — the same rep-to-HCP texting risks covered in more depth elsewhere.

A company may be able to show that the original brochure, email template, or presentation passed through MLR review. But can it also easily prove:

• Which version the representative actually shared?
• What the representative said before and after sending it?
• Whether additional claims were introduced?
• Whether risks and limitations were communicated appropriately?
• Whether the exchange was retained in its original context?
• Whether compliance personnel could retrieve and review it?

Pharma compliance teams need to maintain records of approved promotional assets, as well as preserve the communications through which those assets are distributed, discussed, interpreted, and sometimes modified in the field.

This article explains how MLR review works, why consumer messaging channels complicate traditional approval workflows, what effective MLR review recordkeeping requirements should cover, and how companies can close the gap between approved content and real-world promotional conversations. 

What is MLR Review?

MLR stands for medical, legal, and regulatory review. It is the internal process pharmaceutical and life sciences companies use to evaluate marketing and other materials before they are disseminated externally. 

Although the individual workflows vary, an MLR committee typically brings together three functions:

• Medical reviewers assess scientific accuracy, clinical substantiation, references, context, and whether claims fairly represent the available evidence
• Legal reviewers consider legal exposure, intellectual property, privacy, contractual restrictions, consumer protection, inducement concerns, and other company-specific risks.
• Regulatory reviewers evaluate whether the communication is consistent with the product’s FDA-approved labeling and applicable rules governing prescription drug promotion. 

The FDA’s Office of Prescription Drug Promotion oversees prescription drug promotional communications made by or on behalf of manufacturers, packers, and distributors. Its mandate includes helping ensure that promotion is truthful, balanced, and accurately communicated.

MLR review commonly applies to materials including:

• Sales aids and visual presentations
• Product websites and landing pages
• Email campaigns
• Printed materials and brochures
• Conference booth content
• Speaker program decks
• Social media content
• Videos and digital advertisements
• Approved response documents
• Claims libraries and modular content

As part of the review process, an audit trail is produced showing what was submitted, who reviewed it, what changes were requested, any supporting references used, when final approval was granted, and when the asset expires or should be reconsidered.

That formal audit trail is an essential part of the process, but it doesn’t capture what happens after the asset leaves the content-management system.

FDA Rules Focus on the Communication, Not the Technology Used to Distribute It

It’s clear that promotional materials have to pass MLR review, but what about text messages and chat applications that are used to discuss or share said materials, potentially with added commentary that hasn’t been through the MLR review?

A communication doesn’t stop being promotional just because it was sent through SMS, iMessage, WhatsApp, Teams, WeChat or any other consumer messaging app. While the FDA requirements are clear about the substance, context, audience, and sponsorship of the communication, they don’t focus too much on the distribution platforms. 

Prescription drug advertising must not be false or misleading and it must present an appropriate balance between benefit and risk information. FDA regulations identify numerous ways an advertisement may become misleading, including by omitting material facts overstating safety or effectiveness, using unsupported comparisons, presenting studies out of context or implying uses that are not permitted in the approved labeling. 

FDA has also made clear that digital platforms with character limitations do not eliminate the need to communicate required risk information when benefit information is presented. Its social media guidance does discuss promotion conducted through electronic, digital, and social platforms and explains that firms should consider whether the format permits a truthful and non-misleading presentation.

That principle is directly relevant to using various messaging apps. A sales rep who texts, “Drug X reduced symptoms by 40% – here’s the study,” may have inadvertently created a new promotional communication, even when the linked study was previously approved. The messaging surrounding the link may emphasize a favorable endpoint, omit limitations, expand the intended audience, or change the overall impression of the approved material. The approved attachment does not automatically make the accompanying conversation compliant. 

Why Real-Time Rep Communications Fall Outside Traditional MLR Workflows 

Traditional MLR systems were designed for discrete content assets. A marketing team uploads a brochure, deck, email template, or webpage. Reviewers annotate it and then revisions are made until a final version is approved and assigned a reference number and an expiration date.

This process doesn’t work as neatly for messaging conversations which are:

• Continuous rather than discrete
• Conversational rather than pre-scripted
• Frequently initiated by a healthcare provider or customer
• Spread across multiple channels
• Influenced by previous interactions
• Difficult to predict in advance
• Often conducted from mobile or personal devices
• Capable of mixing approved and improvised language

For example, a representative may begin with a logistical message like “are you available Tuesday afternoon?” And then the conversation could move into product-related territory such as “I can send you the new efficacy data,” followed by attaching an approved document with the comment “the results were particularly strong in older patients.” 

That final statement may or may not be supported by the approved asset. It may refer to a subgroup analysis, omit qualifications, or imply an approved indication more broadly than the evidence permits.  From an MLR perspective, the problem is less that the rep used a messaging app and more that the organization may have no controlled record of the complete exchange.

An approved asset may remain safely stored in the MLR repository, while the communication that gave it meaning exists only on the rep’s phone.

Recordkeeping Obligations Extend Beyond the Approved Asset

One of the most important principles for compliance teams to adhere to is that MLR review recordkeeping doesn’t actually end when an asset receives final approval. Companies need to keep records that connect the approved material to its actual use.

Under 21 CFR 314.81, prescription drug application holders must submit examples of mailing pieces and other labeling and advertising at the time of initial dissemination or publication, accompanied by Form FDA 2253 and current professional labeling, 

That submission obligation addresses the formal promotional material, but doesn’t solve the operational question of how a company proves what an individual representative said when distributing or discussing that material. 

Effective recordkeeping, therefore, needs to operate at two levels – the approved-content record and the communication-use record.

The Approved-Content Record

This includes:

• The final approved asset
• MLR approval date
• Review history
• Supporting references
• Approved claims
• Required safety language
• Intended audience
• Permitted channels
• Geographic restrictions
• Version number
• Expiration or withdrawal date
• FDA submission records, where applicable 

The Communication-Use Record

This includes:

• The representative who sent the communication
• The external recipient
• Date and time
• Messaging channel
• Full text of the conversation
• Attachments, links, images, audio, and other media
• Metadata
• The specific approved asset and version shared
• Replies from recipient and ongoing conversations
• Detled or edited-message events
• Compliance review history
• Escalations, alerts, and resulting actions

Without both layers, the company only has part of the evidentiary chain. It may be able to prove that an approved asset existed, but not that the asset was used correctly. 

Traceability is the Missing Link in Many MLR Programs

Because of MLR requirements, many pharmaceutical companies already maintain sophisticated digital asset management and MLR approval systems. The weakness often appears after approval.

Consider the following scenario:

1. MLR approves version 4.2 of a product efficacy deck.
2. The prior version expires after new labeling is introduced.
3. A rep saved version 3.8 locally several months earlier. 
4. The rep sends the outdated deck to a healthcare provider through a personal messaging account.
5. The rep adds an informal summary that is not contained in either version.
6. The company’s MLR system records only the approved version 4.2.
7. The personal chat is not captured.

The company’s central records might suggest that appropriate content controls were in place, but the actual field communication tells a different story. 

A defensible MLR review recordkeeping framework should make it possible to trace any field communication back to:

• The exact approved asset
• The approval decision
• The permitted use conditions
• The approved claims library
• The representative who sent it
• The surrounding conversation
• Any monitoring or supervisory action taken afterward

Compliance teams need to be able to establish the connection between the approved source material and its downstream use.

When Does an Approved Asset Become an Unapproved Communication?

It’s a common misconception to assume that a rep is definitely in compliance whenever the document or link they are sharing has been approved by MLR. In reality, the surrounding conversation can alter the communication’s meaning, and an approved asset may become part of problematic communication if a representative does any of the following (on purpose or inadvertently):

• Adds an unsupported claim – The rep supplements the approved material with a stronger, broader, or more definitive claim than the content supports. 
• Removes necessary context – The rep extracts a chart, headline, image, or statistic from a larger approved document without the surrounding limitations or risk information. 
• Sends an expired version – The content may have been approved previously but is no longer authorized because of updated labeling, new safety information, revised claims, or an expired review period. 
• Uses the asset for an unapproved audience or purpose – A document approved for trained healthcare professionals may not be appropriate for patients, caregivers, or the general public. 
• Introduces off-label discussion – A rep may respond to an unsolicited question in a way that moves beyond the approved indication or bypasses the company’s medical-information process.
• Summarizes selectively – The rep may describe only favorable results while omitting study limitations, adverse events, endpoints that were not met, or population restrictions.  
• Changes the channel context – Material designed to be viewed with accompanying disclosures may be sent in a format where those disclosures are separated, truncated, or difficult to access. 

These risks demonstrate why MLR approval and communication governance cannot be managed as isolated functions. MLR establishes what is allowed to be said, and communication governance helps establish what was actually said. 

Does Every Rep Text Need to Go Through MLR Review?

While the above may make it sound like every text is a potential compliance misstep, that’s not necessarily true. Requiring formal MLR review of every individual message would be impractical and would prevent representatives from communicating naturally with customers. 

A more workable model separates communications into categories to help determine when MLR review is needed and when it’s not. 

• Administrative communications – Messages about scheduling, meeting locations, availability, delivery logistics, or basic follow-up are unlikely to require MLR review, provided they don’t introduce promotional claims. 
• Preapproved promotional messages – Companies may provide approved text templates, modular content, approved links, disclaimers, and message sequences that reps can use within defined parameters.
• Free-form product discussions – When reps write their own product-related explanations, the risk rises. These communications may need stronger controls monitoring, restricted functionality, or escalation pathways.
• Medical-information requests – Questions involving unapproved uses, complex scientific interpretation, unpublished data, or requests outside the rep’s permitted role should be redirected to medical affairs or an approved medical-information function.
• Adverse-event and product-complaint communications – Messaging channels should support procedures for escalating potential adverse events, product complaints, and other reportable information.

The practical objective is not to force every “can we meet at 2:00?” message into an MLR queue. It is to ensure that product-related conversations occur within a governed environment where approved content can be used appropriately and exception can be detected. 

What Should MLR Review Recordkeeping Requirements Include?

There is no universal retention rule labeled specifically as the “MLR text-message retention period.” Applicable requirements can come from FDA regulations, company policies, litigation holds, state law, privacy law, contractual commitments, corporate integrity agreements, records schedules, and the nature of the underlying activity. 

Nevertheless, there are core requirements that any sound recordkeeping program should address, including: 

Complete Capture

The system should capture the entire business conversation, and not just messages that contain attachments or selected keywords. That’s because partial capture can distort context, and a seemingly compliant message may look different when read alongside an earlier question or later clarification.

To be complete, capture should include:

• Sent and received messages
• Group messages
• Attachments
• Voice notes
• Images
• Links
• Reactions
• Timestamps
• Participant information
• Message edits and deletions
• Relevant metadata

Content Fidelity

Records should preserve communications in a format that accurately represents what participants in the conversation saw. If all communications are just flattened into plain text, important information might be removed, such as:

• Who replied to which message
• Whether content was forwarded
• The relationship between text and an attachment
• Emojis or reactions that alter tone
• Message sequence
• Group membership
• Whether a message was deleted or edited

For investigation and inspection purposes, context is often as important as the individual sentence.

Identity Attribution

The company must be able to determine which employee communicated with which external party. This is especially difficult when employees use personal accounts, shared devices, nicknames, changing phone numbers, or consumer applications that aren’t connected to corporate identity systems.

A professional identity should remain attributable to the employee and the company, even when the underlying conversation takes place on a familiar messaging channel. 

Asset Version Linkage

Whenever and wherever approved content is shared, the record should identify the precise asset and version. Capturing only a screenshot, shortened link, or file name may be insufficient. Compliance should be able to determine whether the asset:

• Had been approved
• Was still valid
• Was permitted for that audience
• Was authorized for that geography
• Contained the required disclosure language
• Matched the version stored in the MLR repository

Search and Retrieval 

Records should be searchable using practical investigation criteria, including:

• Employee
• Recipient
• Product
• Brand
• Date range
• Channel
• Keyword
• Approved asset ID
• Territory
• Communication type
• Review status

The ability to retain millions of messages has limited value if relevant conversations can’t be located and exported promptly.

Supervision and Monitoring

Archive creation is not the same as compliance supervision. In addition to saving (archiving) messages, organizations need to be able to monitor them for indicators such as:

• Off-label terminology
• Unsupported superiority claims
• Missing risk context
• Expired assets
• Unapproved links
• Competitor comparisons
• Adverse-event language
• Product complaints
• Improper inducements
• Requests for patient data
• Attempts to move conversations to unmonitored channels

Alerts should feed into documented view and escalation workflows rather than simply accumulate in a dashboard that is rarely ever checked. 

Retention and Legal Hold

Messages should follow a defined retention schedule based on applicable legal and business requirements. The system should also support preservation beyond the normal disposal date when records become relevant to an investigation, subpoena, litigation hold, inspection, internal review, or enforcement matter. 

Exportability and Audit Trails

Compliance teams should be able to produce records in an intelligible format while preserving metadata and chain of custody. The archive should also keep track of:

• Who accessed a conversation
• Who reviewed it
• Whether it was exported
• Which alerts were generated
• How an alert was resolved
• Whether a record was placed on hold
• Whether policy or disciplinary action followed

How Long Should MLR-Related Communications Be Retained?

Pharmaceutical companies should avoid adopting a single retention period across the board without analyzing the applicable record category and regulatory context.

FDA promotional submission requirements, internal approval records, HCP communications, medical-information records, adverse-event reports, sampling records, privacy records, and records covered by litigation may all be subject to different schedules and requirements. 

Some pharmaceutical Corporate Integrity Agreements (CIA) require companies to retain records relating to federal healthcare program reimbursement and CIA compliance for six years, or longer when another law requires it. That six-year period is not an automatic rule for every pharmaceutical company, but it illustrates the longer retention expectations that can arise in enforcement and oversight contexts.

Companies should therefore establish retention schedules in consultation with regulatory, legal, records-management, privacy, pharmacovigilance, and litigation teams. The schedule should account for:

• Applicable FDA requirements
• The company’s product and promotional record policies
• Statues of limitation
• Pending or foreseeable litigation
• Government investigations
• Corporate Integrity Agreements 
• State-law requirements
• Privacy and data-minimization obligations
• Cross-border transfer restrictions
• Adverse-event and compliant handling
• Contractual commitments

The key is consistency. A company shouldn’t claim that promotional communications are retained for a defined period and then allow messages on certain applications or personal devices to disappear earlier.

The FDA Inspection Risk of a Recordkeeping Gap

During an FDA inspection or related inquiry, the compliance risk is rarely limited to a single missing text. But a recordkeeping gap may raise broader questions about whether the company’s promotional controls function properly and whether there is adequate oversight.

FDA inspection guidance directs investigators examining promotion and advertising to evaluate the methods used to promote products, review promotional materials, consider oral representations, and obtain relevant instructions provided to sales personnel. Messaging records from the field may provide evidence of how those instructions were applied.

An inspector or investigator can ask questions like:

• How are sales representatives permitted to communicate with HCPs?
• Which channels are approved?
• Are personal devices permitted?
• How are product-related messages retained?
• How does the company detect off-label discussion?
• Can the company retrieve messages associated with a particular product or representative?
• Can it show which approved asset was sent?
• How are expired materials blocked?
• How are adverse events identified and escalated?
• What happens when employees use unauthorized applications?
• Has compliance tested whether the controls work?

If the company can’t answer those questions with records, the issue may be interpreted as a weakness in the broader compliance program. Potential consequences may include:

• Expansion of the inspection or investigation
• Requests for additional employee or device records
• Questions about the effectiveness of MLR and sales-force supervision
• Difficulty disproving allegations of off-label or misleading promotion
• Increased litigation and discovery costs
• Remediation obligations
• Disciplinary and employment issues
• Reputational damage
• Reduced cooperation credit in a government investigation

The Department of Justice’s corporate compliance guidance also asks prosecutors to evaluate company policies governing personal devices, communication platforms, and messaging applications, including whether business-related electronic data is accessible and capable of preservation.

A policy that prohibits off-channel communication, for example, is not enough if the company doesn’t test enforcement, retain the relevant data, or address known violations. 

Why Manual Logging is Not a Reliable Solution

This risk is compounded when representatives rely on apps with ephemeral messaging features, since some organizations then attempt to manage the resulting gap by asking representatives to document significant conversations manually in a CRM or call-note system.

This approach can supplement a compliance program, but it is not a suitable substitute for source capture. Manual records create predictable weaknesses because they depend on the representatives to decide which conversations are significant and what details to include — a failure mode that shows up across regulated industries, including the common archiving pitfalls seen in FINRA and SEC enforcement.

The record may be incomplete, delayed, subjective, or written after the fact. It may omit the exact question asked or the representative’s precise response. It may also be difficult to prove that the summary accurately reflects the original conversation. Source capture preserves the actual message rather than an employee’s later interpretation of it. 

Best Practices for Closing the Gap Between MLR and Field Communications

A strong and effective MLR recordkeeping model should connect content approval, communication enablement, capture, supervision, and investigation. Best practices include:

Create Channel-Specific Communication Policies

Policies should define:

• Which messaging channels are permitted
• Whether personal devices can be used
• Which types of communication are allowed
• Which product discussions are prohibited
• When reps must escalate conversations to medical affairs
• How adverse events and product complaints are handled
• What records are captured
• What happens when an employee violates the policy

Make Approved Behavior Easier Than Noncompliant Behavior

Reps frequently use messaging apps because HCPs prefer them and they provide a faster and more convenient route to response. Blocking every popular channel will likely just push conversations into unmanaged accounts.

A more sustainable approach is to provide governed access to approved channels, preapproved content, compliant workflows, and clear escalation paths. 

Integrate Approved Content into the Messaging Workflow 

Reps should be able to find and share current, approved assets without saving local copies. Putting controls in place will help prevent the distribution of expired materials, unauthorized editing, and using materials in restricted geographies or with the wrong audience.

Capture Conversations Automatically

Sales reps should not have to remember to copy messages into another system. Automatic capture reduces dependence on employee judgment and produces a more complete and consistent audit trail. 

Connect Messages to Enterprise Archives and Review Systems

Communication records should integrate smoothly with existing archiving, eDiscovery, compliance, and supervision infrastructure rather than creating a separate, isolated repository. 

Test the Program

Compliance teams should periodically test all elements of the program to make sure they can:

• Retrieve communications for a selected representative
• Located all messages involved a particular product
• Identify an approved asset that was shared
• Detect an expired or unapproved document
• Reconstruct a full conversation
• Export records with metadata
• Document the resolution of a monitoring alert

A policy should only be deemed effective if the organization can demonstrate that it works operationally. 

How LeapXpert Supports Governed Pharma Communications

The LeapXpert Communications Platform enables pharmaceutical companies to bring all of their business communications conducted through channels such as WhatsApp, iMessage, SMS, WeChat, Signal, and more into a governed enterprise environment.

Rather than relying on employees to submit screenshots or manually summarize conversations, these communications are captured at the source and associated with professional identities. All conversational context is retained, and the resulting records are easily connected to existing compliance and archiving systems.

For pharmaceutical and life sciences companies, this can help close the operational gap between MLR-approved content and the real-time conversations through which representatives engage HCPs. The objective is not to replace the MLR platform, but rather to extend governance beyond the platform by creating a traceable record of how approved communications are used in the field. 

Schedule a demo today. 

FAQs

Does MLR review apply to text messages sent by sales reps?

MLR review can apply to text messages sent by sales reps. Administrative texts may not require MLR review, but messages that make product claims, share promotional content, summarize clinical evidence, or discuss safety and efficacy may fall within the company’s promotional review and supervision framework. Even when a rep shares an approved asset, the accompanying text can create a separate compliance risk.

How long should MLR-related communications be retained?

There is no single universal retention period for every MLR-related communication. The appropriate period depends on the record type, applicable FDA requirements, company policy, litigation obligations, Corporate Integrity Agreements, pharmacovigilance requirements, privacy rules, and other legal considerations. 

What is the risk of an MLR recordkeeping gap during an FDA inspection?

A gap can prevent the company from demonstrating what a representative actually communicated, which asset version was shared, and whether the exchange remained within approved boundaries. It may also lead inspectors to question the effectiveness of the company’s border promotional controls, supervision, and records-management program.