Abstract
The privacy of any subject who participates in a clinical study must be protected for ethical and legal reasons. Clinical data management professionals must be familiar with privacy laws that exist for the regions in which clinical studies are occurring and ensure all reasonable and appropriate precautions are taken. This chapter discusses strategies and considerations that data managers must understand and follow, including the varying types of personal data in clinical studies, best practices for securing and protecting data (both paper and electronic), methods of data collection, and strategies for ensuring that personnel, both internal and external (e.g., vendors), follow applicable data privacy standards.
Introduction
Data privacy refers to the standards surrounding protection of personal data. Personal data can be defined as any information that can lead to identification, either directly or indirectly, of a research subject. Some examples of personal data are subject names, initials, addresses, and genetic information.
...
Having complete anonymity may not always be practical for the design of a study, however, personal information should always be safeguarded to the greatest extent possible.
Scope
This chapter focuses on considerations needed to maintain a high degree of privacy protection (or security) for research subjects during data collection and management. Since significant regulatory guidance exists on data privacy, all applicable regulations should be considered in the creation of company policy or standard operating procedures (SOPs) to ensure full compliance with regulations governing the jurisdictions in which business is conducted. References for various regulatory documents can be found in the Further Reading section of this chapter.
Many of the tasks described in this chapter may be joint responsibilities between different groups, just as there may be many different groups involved in the implementation of various tasks. However, clinical data managers need to be conscious of whether or not these tasks have in fact been performed in a satisfactory manner.
Minimum Standards
- Ensure all personnel (including vendors) who directly or indirectly handle identifiable personal data are properly trained on data privacy issues. Training sessions should cover data privacy concepts; company policy; regulatory agency policy and applicable local, state, federal, and international laws.
- Design data-collection instruments with the minimum subject identifiers needed, including the design of case report forms (CRFs), clinical and laboratory databases, data transfer specifications, and any other area of data collection that may contain personal information.
- Ensure personal data is not identifiable, other than subject identifiers used to link documentation to a database record, from documentation (e.g., CRFs, lab reports, images associated with the clinical study) submitted to data management.
- Review and update data management processes regularly to ensure consistency with current company privacy policies and government regulations.
Best Practices
Develop and maintain an environment that respects the privacy of research subjects. Consider employee education programs that highlight the potential impact of lapses in data privacy, the benefits of applying strict criteria when handling personal information, and verification that procedures are in compliance with regulations.
Implement procedures prior to data transfer between sites, departments, subsidiaries, and countries to ensure all privacy considerations have been considered, addressed, and documented.
Promote internal and external accountability through company policies and regulations governing the use of personal information.
Implement procedures for using data for an alternate or new purpose other than what was originally intended by the informed consent. Ensure all privacy considerations have been considered, addressed, and documented.
Enforce a baseline policy of denying access to personal data. Evaluate any request for this information. If information is determined to be required for specific scientific reasons, ensure all privacy considerations have been considered, addressed, and documented.
Put stringent procedures in place to securely transfer, store, access, and report on extremely sensitive data (e.g., genetic information).
Work with those responsible for quality assurance to ensure compliance with data privacy regulations. This assurance of regulatory compliance should be a central focus of audits and a contract contingency when using external service providers.
Maintain proper physical and electronic security measures. Data should be stored in protective environments relevant to the type of media being stored. Paper CRFs should be stored in an environment with regulated access. Proper precautions should be taken to prevent external access to electronic data, such as password authentication and firewall security.
Importance of Data Privacy
Revealing a subject’s personal medical information could potentially lead to embarrassment, denial of insurance coverage, or discrimination in the workplace. For these and other reasons, most countries have passed stringent laws that mandate the protection of research subjects’ privacy.
...
Redaction is the act of obscuring or removing text from a document before releasing the document to other personnel or departments. An example of clinical data needing to be redacted could include a situation where a comments field was completed with personal identifiers. If for example a comments field had the text “Mr. Jones showed improvements,” the data manager should obscure or remove “Mr. Jones” from this text. Organizations should have SOPs to determine when redaction of personal data is needed. This should preferably be performed by the site or monitor, but if not handled at the site, data managers should be mindful of when redaction of personal data is required as well as knowledgeable on the process.
Data Collection
To ensure proper assignment of data into a clinical database, data collection instruments should be designed with some type of research subject identifiers. The use of these identifiers should be taken into consideration not only in CRF design, but also in scenarios in which the processing, transfer, reporting, or analysis of data will be completed. These scenarios include the design of clinical databases, laboratory databases, and data transfer specifications. In general, a random subject number can be used to resolve any discrepancies that might arise from transcription errors.
...
Paper-based studies—Follow organization SOPs for appropriate redaction of personal identifiers as well as appropriate study procedures for handling, transfer and storage of documents containing privacy data.
EDC studies—Follow organization SOPs to ensure appropriate network security, including password security and automatic user logout after a determined period of time.
ePRO—Follow organization SOPs to ensure appropriate network security, as well as training of subjects on use of devices and protection of data by use of assigned passwords and user identification or pin numbers.
International Studies and Data Privacy
International studies should adhere to the most restrictive regulations of the countries involved. However, ensuring data privacy also needs to be balanced with the need for collecting all data pertinent to the study. Some questions to ask in this regard may include:
- Is the data really needed?
- Does collection of needed data compromise privacy?
- Is collection of the data acceptable in all countries with study sites?
Policy Definition and Training
Corporate policy definition and training should be based on relevant company policy; regulatory agency policy; and applicable local, state, federal, and international law. Policy training sessions should address the implementation and maintenance of standards and potential harm to subjects that may occur when basic principles are not followed.
Potential Future Concerns for Data Privacy
Electronic health records and their potential integration with EDC systems are expected to garner more attention in the future. Although there is currently no mandate to use electronic health records, the topic has been discussed frequently not only by those involved with health care or clinical studies, but also within political circles. If health records do become exclusively electronic, new safeguards will be needed to ensure privacy of these records.
Recommended Standard Operating Procedures
- Organization Procedures for Data Privacy Protection
- Vendor Management
...