Good Clinical Practice: A Question and Answer Guide2024/2025 Edition - 352

GCP: A Question & Answer Reference Guide
In clinical trials, medical information for specific research subjects may be collected and monitored by research
sponsors for a period of time prior to, during, and after the trial, and may even be inspected by regulatory authorities
(refer to the FDA's 2006 guidance document at http://www.fda.gov/oc/ohrt/irbs/investigator.pdf). This information
includes PHI that may be used and disclosed by the site under the provisions of the Privacy Rule. So, the question
is, " should a sponsor ensure that a research site is complying with requirements that fall outside traditional FDA
requirements? " If the requirements impact subject safety and/or data integrity specific to the trial, then yes.
Note that, in 21 CFR 312.56-General sponsor responsibilities, the FDA states that a sponsor should monitor if
an investigator is complying with the signed agreement (Form FDA-1572), the general investigational plan, and
" the requirements of this part or other applicable parts. " Also note that, in 21 CFR 312.60-General investigator
responsibilities, the agency establishes that, " an investigator is responsible for ensuring that an investigation is
conducted according to the signed investigator statement, the investigational plan, and applicable regulations...
[and] for protecting the rights, safety, and welfare of subjects under the investigator's care. "
Sponsors have different views on the extent to which they should monitor the compliance of clinical study sites
that are covered entities with the HIPAA Privacy Rule requirements specific to clinical trials. Ultimately, sponsors
must conduct their own risk assessment (i.e., of the consequences of action or inaction in this case) regarding the
risk to data integrity and subject protections. [Editor's note: Subject protections are not just physical.]
The following recommendations relate to sponsors' Privacy Rule-related monitoring of clinical study sites that
are covered entities:
* Establish organizational standards for the clinical management of covered entity research sites regarding
HIPAA Privacy requirements. Train to and be consistent in the approach. Later, assess the impact of and
adherence to these decisions.
* During pre-study site qualifications, determine if potential sites' designations are covered entities and, if
so, identify the applicable compliance standards and practices (i.e., Authorizations Policies and Practices).
Document these findings.
* Given that the OCR enforces the Privacy Rule, determine each covered entity's history of OCR compliance
reviews, and the outcomes of any such reviews. Note that, currently, the OCR's website does not provide lists
of inspected parties or the results of those reviews, but that the OCR anticipates providing this information
in the future.
* If the covered entity has had a compliance review by the OCR, research the results and actions taken (if
applicable) to address the findings.
* Identify those situations in which the covered entity must obtain assurances regarding the protection of
privacy of the PHI, which covered entities must obtain when they disclose PHI to any party that is not a
covered entity-that is, an assurance that this other party will protect the PHI once it is obtained (this would
require linkage between the research agreements and Authorizations).
* Recognize study practices that may create conflicts with a site's Privacy Rule compliance (e.g., requests
for PHI from sites prior to Authorization, as in cases of pre-screening logs; if the logs include any form of
identifiable information, such as patient initials, then these would be unauthorized disclosures).
A sponsor's clinical study monitors should be able to identify which sites are covered entities and should be
aware what implications this status has for its site management and documentation requirements. Again, those
involved in clinical research have varying views regarding HIPAA Privacy Rule-related responsibilities. But clarity
and consistency in defining the roles and responsibilities for each party involved in a specific clinical trial-IRBs,
sponsors and covered entity study sites-are critical in promoting individual privacy protections.
To date, this author has not seen or heard of any inspectional findings from another regulatory authority that cite
a covered entity for a deficiency related to Privacy Rule requirements.
15.31 Q. How is the HIPAA Privacy Rule enforced? How have the penalties been affected by the HITECH
Rule?
A. The enforcement of the HIPAA Privacy and Security Rules continues to apply to covered entities, such as health
care providers. HHS' Office for Civil Rights (OCR) is responsible for enforcing the Privacy and Security Rules.
Enforcement of the Privacy Rule began April 14, 2003 for most HIPAA covered entities. HIPAA covered entities
were required to comply with the Security Rule beginning on April 20, 2005.
352

http://www.fda.gov/oc/ohrt/irbs/investigator.pdf

Good Clinical Practice: A Question and Answer Guide2024/2025 Edition

Table of Contents for the Digital Edition of Good Clinical Practice: A Question and Answer Guide2024/2025 Edition