Cynthia Gates JD RN CIP

Transcription

1 Regulatory Update HCCA Research Compliance Conference June 3-6, 2012 Cynthia Gates JD RN CIP April 2012 FDA OHRP HIPAA 1

2 Final Guidance Continuing Review Safety Reporting Monitoring New Consent form Element Continuing Review 2

3 I I just learned the FDA issued new guidance in February on continuing review of research it s 28 pages! Must be important we d better have a meeting on this to make certain we are complaint! I really wish we had learned about this earlier.approval was just terminated on the ACME drug study because we didn t send all the paperwork the IRB wanted!! 3

4 What is Continuing Review? Study Information # of subjects at site # of subjects across study Withdrawals New information DSMB or other reports Changes at site Unanticipated problems Regulatory actions IRB Task Assess against IRB approval criteria Assess consent Assess Trial Progress What must be reviewed? Risk assessment Adequacy of consent Local issues (PI issues, complaints, investigator oversight) Trial Progress 4

5 How often? At least once per year but IRB must have SOPs in place to make decision based on: Depends on risk of study Nature of risks Degree of uncertainty Vulnerability of subjects PI experience Previous experience with PI Projected rate of enrollment Whether study involves novel therapies Lapse of review? No Report from Site/Sponsor No Continuing Review All study activities must stop 5

6 Take home message Sponsor and site must Submit required reports IRB must conduct continuing review Timing of review is based on risk Review must be substantive Study activities must stop if IRB does not conduct review IND Safety Reports (21 CFR ) 6

7 Did you hear the good news? We won t be getting so many IND Safety Reports! Wow! That is good news..but do we still have to report everything? 7

8 Of course there s no change to our reporting requirements The sponsor still needs to keep records of events for analysis An investigator must immediately report to the sponsor any serious adverse event, whether or not considered drug related, including those listed in the protocol or investigator brochure and must include an assessment of whether there is a reasonable possibility that the drug caused the event. 21 CFR (b) 8

9 Expedited Reporting for PIs Must report all SAEs (except study endpoints) even if PI believes not caused by study drug Must report SAEs listed as anticipated in protocol, investigator brochure Must follow protocol for reporting study endpoints 17 Expedited Reporting for Sponsors Suspected Adverse Reactions Evidence to suggest a causal relationship between the drug and the adverse event Serious (death, life threatening, hospitalization, incapacity, birth defect) Unexpected (not previously known or more severe or more frequent) 18 9

10 End result some of this may go away. Risk Based Monitoring 10

11 Has anyone seen the study monitor lately???? Site Monitoring BREAKING NEWS The FDA announced it will accept monitoring plans based on risk and withdrew previous guidance requiring personal contact with the PI! 11

12 Types of monitoring Onsite assess attention to detail, thoroughness of documentation, delegation of study tasks, investigator supervision critical early in study Centralized Remote checks for consistency, completeness, analyze site characteristics (metrics), identify anomalies (error rates, violations, dropouts) 23 Factors that may require on-site monitoring Subjective study endpoints (review application of protocol definitions) Seriously ill or vulnerable population monitor safeguards Experience of clinical investigator Geographical differences in standards of medical practice, infrastructure, patient demographics Stage of study more on site monitoring early, then taper 24 12

13 Critical elements to be monitored Protocol should identify critical procedures/data & monitoring should focus on preventing errors in collecting and reporting these data Critical study endpoints Protocolrequired safety assessments Documenting & reporting SAEs Adherence to eligibility criteria Ensuring study blind is maintained Verification of informed consent Test article accountability & administration 25 Risk Based Monitoring Example Evaluate protocol and site knowledge Onsite visits based on needs identified thru evaluation of protocol Onsite monitoring until comfortable with site performance Then trend data centrally Outliers - Request additional reporting Response not satisfactory - Visit site to confirm data 13

14 Take home message Sponsor must monitor but type and frequency of monitoring can be based on multiple issues Sponsor should develop monitoring plan New Consent Form Element 14

15 New Consent Form Element A description of this clinical trial will be available on as required by U.S. Law. This Web site will not include information that can identify you. At most, the Web site will include a summary of the results. You can search this Web site at any time. New element the good news Statement not required for trials approved by any IRB before March 7 No requirement for re-consent Must use exact language but can be translated, if necessary 15

16 Take home message 1. Determine whether trial must be posted 2. Include information in consent form 16

17 FDA Draft Guidance Financial Disclosures Electronic Source Documentation Exculpatory Language Research without an IND In Vitro Companion Devices FDA Decisions for IDE Clinical Investigations 17

18 Applies to Anyone who is directly involved in the treatment or evaluation of research subjects and that individual s spouse or dependent child What is reportable? Compensation by sponsor in which value could be affected by study outcome Proprietary interest in investigational product Equity interest in sponsor > $50,000 or of a undetermined value during the study and for one year after study completion Significant payments (totaling $25,000 or more) made by sponsor investigator or institution during trial or for one year after completion - except payment for conducting trial. 18

19 Must report before trial initiation & for one year after trial is discontinued Trial Discontinued means.. Last study site is complete Or Each study site individually as it is completed (Sponsor decides) 19

20 Important things to remember Sponsor of the covered clinical study means the party supporting a particular study at the time it was carried out Important things to remember Covered clinical studies are studies relied upon to provide data to support a marketing application 20

21 Important things to remember Source documentation for the reports must be maintained according to regulatory requirements for any source document FDA will the documents review during an inspection Electronic Source Documentation 21

22 Electronic Record - Any combination of text, graphics, data, audio, pictorial or other information in digital form that is created, retrieved or distributed by computer system Examples: Clinical data in electronic health records Electronic case report forms Electronic medical images Electronic laboratory analysis and data Electronic diaries Transmissions from medical devices Computerized randomization 22

23 Did you know that a lot of computer documents can be copied, revised, deleted or transferred? So - electronic system must reveal: Data Elements Attributes Identifiers Value Date Time Source Originator Date & Time of Entry Subject 23

24 Modifying a data element Original data element must be preserved, writeprotected, and available for review New data element should include Identifier Date and time of change Originator of change Reason for change Relationship to original record (append, replace, etc.) New data element must be write protected and available for review Resources Computerized Systems Used in Clinical Investigations Part 11, Electronic Records; Electronic Signatures Scope and Application General Principles of Software Validation; Final Guidance for Industry and FDA Staff 24

25 Identifiers Each authorized data originators should have an individual identifier (e.g., user name and password) that enables him/her to electronically enter specific data elements into the system. Who/What is authorized to enter/transmit data to CRF? Investigators Electronic health Study staff records Biomedical devices Randomization tools Automated laboratory Barcode readers reporting systems recording medications Imaging facilities Pharmacies Study subjects Keep prospectively determined originator list include users unique identifiers and the period of authorization for data entry 25

26 Security of electronic signatures Passwords + user accepts responsibility Biological identifier + user accepts responsibility Device identifier (model or serial number) Originators Investigator oversight Review ecrf before data archived or released Document review and sign off under name and password Review can be delegated 26

27 ecrf storage Generate write-protected copy following sign-off if amended, maintain audit trail and document reason Maintain control Retain per regulation Make read-only format available for inspections If source document is paper, maintain per requirements Exculpatory language in consent forms 27

28 I have more news FDA and OHRP issued guidance limiting the interpretation of the waiver of rights language in consent forms! Consent form cannot include: exculpatory language through which the subject is made to waive or appear to waive any of the subject's legal rights, or releases or appears to release the investigator, the sponsor, the institution, or its agents from liability for negligence 28

29 Examples of Exculpatory Language I waive any possibility of compensation, including any right to sue, for injuries that I may receive as a result of participation in this research. If you suffer a research-related injury, neither the institution nor the investigator can assume financial responsibility or liability for the expenses of treatment for such injury. In the event that you suffer a research-related injury, your medical expenses will be your responsibility or that of your third-party payer. 57 Examples of acceptable language Although future research that uses your samples may lead to the development of new products, you will not receive any payments for these new products. By agreeing to this use, you are giving up all claims to any money obtained by the researchers from commercial or other use of these specimens. I donate any and all blood, urine, and tissue samples to the ABC company and hereby relinquish all property rights, title, and interest I may have in those samples. If you suffer a research-related injury, your medical expenses will be your responsibility or that of your third-party payer, although you are not precluded from seeking to collect compensation for injury related to malpractice, fault, or blame on the part of those involved in the research. The hospital is not able to offer financial compensation if you are injured as a result of participating in this research. However, you are not precluded from seeking to collect compensation for injury related to malpractice, fault, or blame on the part of those involved in the research, including the hospital

30 Research without an IND I am getting a research grant to a trial on Super Drug and I can t figure out if I need an IND! I wish they would provide guidance on how to decipher the requirements! 30

31 No IND required if: Lawfully marketed drug No intent to report trial results to FDA to support label change Not intended to support significant advertising change Not intended to commercialize drug through trial IRB approval & informed consent Doesn t significantly affect risk In Vitro Companion Device 31

32 The observation on your 483 will state that you failed to report to the sponsor and the IRB your deviation from the investigational plan to save the life or physical well being of subject XD147. Federal regulation 21 CFR (a)(4) requires you to report such a deviation within five working days. Doesn t federal regulation 21 CFR 812 cover device studies? This was an oncology drug study..i m so confused! 32

33 In Vitro Companion Devices Provides information essential to safe and effective use of corresponding therapeutic product Considered a significant risk device (SRD) and requires an IDE - if used to make treatment decisions Studies under an IDE must comply with 21 CFR 812 An IVD companion diagnostic device could be essential for the safe and effective use of a corresponding therapeutic product to: Identify patients who are most likely to benefit from a particular therapeutic product Identify patients likely to be at increased risk for serious adverse reactions as a result of treatment with a particular therapeutic product Monitor response to treatment for the purpose of adjusting treatment (e.g., schedule, dose, discontinuation) to achieve improved safety or effectiveness 33

34 FDA Decisions for Investigational Device Exemption (IDE) Clinical Investigations FDA Decisions for IDE Clinical Investigations In an effort to promote timely initiation of clinical investigations in a manner that protects study subjects, FDA has developed methods to allow a clinical investigation of a device to begin under certain circumstances, even when there are outstanding issues regarding the IDE submission

35 FDA Approval with Conditions FDA approval of an IDE with conditions: If FDA approves an IDE application with conditions, the sponsor may begin subject enrollment upon receipt of IRB approval on the condition that, within 45 days from the date of FDA s decision letter, the sponsor submits information addressing the issues identified in FDA s letter. 69 FDA Decisions for IDE Clinical Investigations These methods include: approval with conditions, staged approval, staged approval with conditions, and communication of outstanding future considerations

36 Future Considerations in Approval, Approval with Conditions, or Disapproval Letters Examples of typical future considerations include discussion of: Known limitations of the IDE clinical investigation with regard to supporting certain claims or indications Potential limitations of the IDE that depend on currently unknown variables Specific analyses that FDA will expect to see in the marketing application 71 FDA Approval with Conditions Outstanding issues that may lead to approval with conditions include: Issues related to data analysis methods and handling if the corrections will occur prior to the gathering of important study data; Issues related to late stage follow-up procedures and assessments, if the corrections are made prior to beginning any late-stage procedures or assessments; Minor divergences from what FDA considers appropriate study endpoints, design assumptions, or key definitions; Issues related to the informed consent document that must be corrected before enrolling subjects but can be reviewed by FDA after study initiation

37 OHRP Announced Notice of Proposed Rule Making (ANPRM) for Revisions to the Common Rule Origin The ANPRM started as a project of NIH bioethicist Zeke Emanuel during his assignment to the Office of Management and Budget (OMB) in the White House. Also supported by Jerry Menikoff, Director of the Office for Human Research Protections (OHRP)

38 Nine Sections of the ANPRM Background Ensuring risk based protections Streamlining review of multi-site studies Improving informed consent Strengthening data protections to minimize information risks Data collection to enhance system oversight Extension of Federal regulations Clarifying and harmonizing regulatory requirements and agency guidance Agency request for information 75 Introduction Lots of proposals, some of them fleshed out and others lacking in detail. The proposed changes are significant and would affect many stakeholders in the research environment, including IRBs, sponsors, CROs, institutions, and investigators. 74 questions to the public for commentary

39 Timeline ANPRM released July 26, day comment period, which closed October 26, 2011 HHS currently considering the public comments HHS may issue a Notice of Proposed Rule Making (NPRM) Original goal was to issue final rule by early Three Significant Interlocking Changes Eliminate and/or reduce prospective and continuing IRB review of minimal risk research; Establish mandatory data security and information protection standards for identifiable information; and Require consent for research use of existing data and bio-specimens

40 Section III - Streamlining IRB Review of Multi- Site Studies Large amount of research is multisite Multiple IRB reviews may not enhance protection of human subjects and may divert valuable resources from more detailed reviews of other studies. Public comment was requested on feasibility, advantages, and disadvantages of mandating that all domestic sites in a multi-site study rely upon a single IRB 79 Section IV. Improving Informed Consent Criticisms of current informed consent requirements - Average length of consent forms has been increasing and the form has become legalistic. Proposals for: revising required content limiting other content including boilerplate Increased use of templates Reducing requirements for waivers of consent Strengthen consent provisions for use of existing data and bio-specimens 80 40

41 Section V - Strengthening Data Protections to Minimize Information Risks Proposal - mandate data security and information protection standards that would apply to all research that involves collected, stored, analyzed, or otherwise reused identifiable or potentially identifiable information. 81 Section VI - Data Collection To Enhance System Oversight Currently, the collection of safety data during the course of a research study, such as adverse events and unanticipated problems, is dependent on agency jurisdiction, and differs widely. Proposal to harmonize safety reporting guidance across all Federal agencies, including harmonizing terminology and clarifying the scope and timing of such reports. Proposal to create a central Web-based repository to house the information

42 Section VII - Extension of Federal Regulations Proposal to require domestic institutions that receive any federal funding for research from a Common Rule agency to extend the Common Rule protections to all research studies. Would not apply to sites outside of the United States. 83 Section VIII - Clarifying and Harmonizing Regulatory Requirements and Agency Guidance Fifteen agencies have adopted the Common Rule. Many have issued guidance, which often differs from other agencies. Many have also implemented additional regulations. Public asked if there should be mandatory harmonization of regulations and guidance across all agencies

43 What Did the Public Say? Very mixed comments A few recommendations received strong majority agreement, such as longer continuing review cycles for minimal risk research. Other recommendations received strong disagreement. On several recommendations the opinions were divided. Overall, not a strong mandate for action. 85 HIPAA Enforcement 43

44 Enforcement Actions with Penalties HHS settles case with Phoenix Cardiac Surgery for lack of HIPAA safeguards UCLA Health System Settle Potential Violations of the HIPAA Privacy and Security Rules Massachusetts General Hospital Settles Potential HIPAA Violations DHHS OCR hit Cignet Health with a $4.3 million penalty for violating HIPAA Privacy Rule Phoenix Cardiac Surgery Used 3 rd party /calendar service without a BA contract Failed to appoint a security official Failed to conduct risk analysis Failed to training workforce 44

45 UCLA Employees accessed electronic PHI (Covered entities must reasonably restrict access) Covered entities are responsible for the actions of their employees. This is why it is vital that trainings and meaningful policies and procedures, including audit trails, become part of the everyday operations of any health care provider, - OCR Director Georgina Verdugo. Massachusetts General Hospital Loss of PHI of 192 patients after employee left documents on a subway Failed to implement reasonable safeguards to protect privacy of PHI 45

46 Cignet Health Failed to provide medical records to patients after request Did not respond to OCR subpoena Cignet produced records after OCR went to Federal Court most of fine was due to Cignet s failure to cooperate with OCR Cignet never took action to resolve patient complaints HIPAA Privacy/Security Audits American Recovery and Investment Act of 2009 requires audits of covered entities and business associates OCR will perform up to 150 audits between 2011 and 2012 Goal of audit: identify compliance gaps and provide technical assistance/best practices 46

47 States Attorneys General HITECH Act gave SAGs authority to bring civil actions on behalf o state for violations & to obtain damages on behalf of state residents OCR offers training to SAGs Business Associates first action by SAG against business associate theft of unencrypted computer containing about $23,500 patient records HHS said it will not enforce HITECH Act against Bas until the final regulations become effective but SAGs can enforce 47

48 Pending information Individual right to collect percentage of penalties Final Rules Coming? Enforcement Rule Breach Notification Rules Changes to Privacy Rule required by GINA New Guidance Coming? Business Associate Contracts De-identification Conducting Risk Assessments to determine breaches Accounting for Disclosures Questions?