|
Showing posts with label As a Monitor see's - Clinical Research In India. Show all posts
Showing posts with label As a Monitor see's - Clinical Research In India. Show all posts
Tuesday, December 21, 2010
How safe is your data?
How safe is your data?
It's the age of contract research organisations conducting clinical trials for global pharma companies. But there is always suspicion when it comes to sharing sensitive information. Arun Bhatt and Rutika Vara talk about the security concerns in CROs
Arun Bhatt
“We take data protection and privacy very seriously. The accountant in India can see the data on his screen but he can not take a download of it or print it out—our program does not allow it.” — Jaithirth Rao, MphasiS, in The World Is Flat by Thomas Friedman.
“To cope and recover from a single security breach the cost on average is $14 million per company per breach”— Ponemon Institute.
Data security is today's buzzword in the biz world. With the adoption of the BPO model and dependence on Contract Research Organisations (CRO) for clinical trial management, the pharma industry has to wake up to the data security threat. CROs, particularly, are expected to provide effective data security.
Data covers all the facets of information shared between the sponsor and the CRO during the clinical trial project. Data flows from the sponsor to the CRO starts with the request for proposal and continues throughout the duration of the clinical trial project. The data includes paper or electronic documents —protocol, case record form (CRF), investigator's brochure, regulatory dossier for IND submission, informed consent documents, completed CRFs, monitoring reports, audit and inspection reports, raw data, statistical tables, and final study report. The CRO needs to share these data with both internal stakeholders—employees, external stakeholders—investigators, EC, trial subjects, health authorities, and vendors—central lab, couriers, translators, EDC suppliers. As the CRO is central to the sponsor's relationships with these stakeholders, it has to put in place, effective security measures.
For the sponsor and the CRO, data security is driven by the business need to protect data from loss, unauthorised access, modification, destruc-tion or disclosure. In addition, regulatory guidelines ensure the authenticity and integrity of data. ICH-GCP guidelines, Indian GCP and USFDA's September 2004 guidance for Computerised Systems Used in Clinical Trials, recommend that the sponsors maintain a security system that prevents unauthorised access to the data.
The level of data security differs depending on the types of data:
Public data is available to general public, including individuals outside the CRO. Public data may be shared without limit.
Internal data is insensitive information that is used in the daily course of managing clinical trials. If internal data, for example, staff phone numbers are made public, little or no loss would be incurred.
Confidential data is sensitive data. If this data is altered inappropriately loss could occur. Examples include protocols, sponsor SOPs. Access to confidential data should be provided to limited personnel in the CRO on a need-to-know basis.
Restricted data is highly sensitive data. If such data is compromised or inappropriately modified, it will lead to significant loss, which can lead to regulatory compliance breach. Examples are the raw data after database lock, statistical tables and study report. Access to this data should be closely controlled. Technical safeguards like passwords and encryption should be used to prevent access by unauthorised personnel.
Breach of data security can occur during any data transaction, that is, during transfer of data within or among clinical study sites, from clinical trial CRO to data management CRO and from CRO to central lab. Sometimes, employees accidentally disclose information while working during travel. Employees who have remote access to company intranet might leave documents open, exposing the data to leakage or tampering. There are instances of intentional break-ins by using another person's identity, for example, badge or password. Sometimes an unhappy employee or site staff might destroy the records by inserting a virus. Besides, loss or damage to data can also occur as a result of major calamities. For instance, a lot of research data was lost during the recent Katrina hurricane. The sponsor and the CRO should have data security system policies and procedures to guard against all major security concerns.
The security policy should cover both paper and electronic data. It should include relevant physical and electronic security procedures including disaster recovery measures.
The physical procedures would consist of:
Access control—swipe cards, restricted entry to visitors and vendors, limited access to archival section, alarm system to notify in case of tampering the login username and password or the act of forceful entry to the premises.
Paper trail—archived control copies, controlled distribution of document copies, confirmation of destruction of unused copies, for example, protocol synopsis for feasibility studies, draft and final reports.
Secure storage—fire proof cabinets, locked cabinets for paper documents and CDs, fire safety, smoke and fire alarms and burglar alarms.
Security obstacles— disallowing mobile phones with camera, CDs, pen drives, record of laptop model and numbers.
The electronic proce-dures would include:
Access control— authentication to validate identity of employees, encryption, to ensure that information is not viewed or tampered with during transmission, secure passwords or biometric identification for logging in, read only access to prevent accidental data modification, automated screen savers and log-out to inhibit access to unattended displays after particular time.
Non-repudiation—to establish an indisputable time-stamped audit trail of creation, modification, maintenance and transmit using the data entry system.
Digital signing—to attach legally binding electronic signatures to documents and forms.
Technological obstacles—firewalls to isolate internal and external networks, restricting use of pen drives and CDs in computers and laptops.
Back up procedures—regular backup through CDs or tapes storage in bank lockers and another location.
Data security system should describe legal procedures, for example, confidentiality of disclosure agreements from all persons who are likely to receive data like employees, investigators and vendors. The policy should also discuss necessary actions in case of a breach of security, for example, dismissal from employment, civil liability or criminal prosecution.
In the post-IPR era, there is a tug-of-war in India between global pharma companies expecting data exclusivity and Indian pharma companies opposing this move
The system will work only if the employees are adequately informed about their responsibilities for guarding the sponsor's data and are thoroughly trained to the use of physical and electronic systems. To quote Bruce Schneier, “People often represent the weakest link in the security chain and are chronically responsible for the failure of security systems.”
In the post-IPR era, there is a tug-of-war in India between global pharma companies expecting data exclusivity and Indian pharma companies opposing this move. Besides, Indian industry's capability of reverse engineering to make economic generics, has created an atmosphere of suspicion in post-IPR era. These concerns have made the global sponsors obsessive on the potential misuse of their valuable data. The sponsors expect the Indian CROs to establish a comprehensive data security system to ensure that their data is in safe hands. If Indian CROs want global business, they have to be ready to face the security challenge!
(The writers are the President and Assistant Manager of Data Management of ClinInvent Research Pvt Ltd)
It's the age of contract research organisations conducting clinical trials for global pharma companies. But there is always suspicion when it comes to sharing sensitive information. Arun Bhatt and Rutika Vara talk about the security concerns in CROs
Arun Bhatt
“We take data protection and privacy very seriously. The accountant in India can see the data on his screen but he can not take a download of it or print it out—our program does not allow it.” — Jaithirth Rao, MphasiS, in The World Is Flat by Thomas Friedman.
“To cope and recover from a single security breach the cost on average is $14 million per company per breach”— Ponemon Institute.
Data security is today's buzzword in the biz world. With the adoption of the BPO model and dependence on Contract Research Organisations (CRO) for clinical trial management, the pharma industry has to wake up to the data security threat. CROs, particularly, are expected to provide effective data security.
Data covers all the facets of information shared between the sponsor and the CRO during the clinical trial project. Data flows from the sponsor to the CRO starts with the request for proposal and continues throughout the duration of the clinical trial project. The data includes paper or electronic documents —protocol, case record form (CRF), investigator's brochure, regulatory dossier for IND submission, informed consent documents, completed CRFs, monitoring reports, audit and inspection reports, raw data, statistical tables, and final study report. The CRO needs to share these data with both internal stakeholders—employees, external stakeholders—investigators, EC, trial subjects, health authorities, and vendors—central lab, couriers, translators, EDC suppliers. As the CRO is central to the sponsor's relationships with these stakeholders, it has to put in place, effective security measures.
For the sponsor and the CRO, data security is driven by the business need to protect data from loss, unauthorised access, modification, destruc-tion or disclosure. In addition, regulatory guidelines ensure the authenticity and integrity of data. ICH-GCP guidelines, Indian GCP and USFDA's September 2004 guidance for Computerised Systems Used in Clinical Trials, recommend that the sponsors maintain a security system that prevents unauthorised access to the data.
The level of data security differs depending on the types of data:
Public data is available to general public, including individuals outside the CRO. Public data may be shared without limit.
Internal data is insensitive information that is used in the daily course of managing clinical trials. If internal data, for example, staff phone numbers are made public, little or no loss would be incurred.
Confidential data is sensitive data. If this data is altered inappropriately loss could occur. Examples include protocols, sponsor SOPs. Access to confidential data should be provided to limited personnel in the CRO on a need-to-know basis.
Restricted data is highly sensitive data. If such data is compromised or inappropriately modified, it will lead to significant loss, which can lead to regulatory compliance breach. Examples are the raw data after database lock, statistical tables and study report. Access to this data should be closely controlled. Technical safeguards like passwords and encryption should be used to prevent access by unauthorised personnel.
Breach of data security can occur during any data transaction, that is, during transfer of data within or among clinical study sites, from clinical trial CRO to data management CRO and from CRO to central lab. Sometimes, employees accidentally disclose information while working during travel. Employees who have remote access to company intranet might leave documents open, exposing the data to leakage or tampering. There are instances of intentional break-ins by using another person's identity, for example, badge or password. Sometimes an unhappy employee or site staff might destroy the records by inserting a virus. Besides, loss or damage to data can also occur as a result of major calamities. For instance, a lot of research data was lost during the recent Katrina hurricane. The sponsor and the CRO should have data security system policies and procedures to guard against all major security concerns.
The security policy should cover both paper and electronic data. It should include relevant physical and electronic security procedures including disaster recovery measures.
The physical procedures would consist of:
Access control—swipe cards, restricted entry to visitors and vendors, limited access to archival section, alarm system to notify in case of tampering the login username and password or the act of forceful entry to the premises.
Paper trail—archived control copies, controlled distribution of document copies, confirmation of destruction of unused copies, for example, protocol synopsis for feasibility studies, draft and final reports.
Secure storage—fire proof cabinets, locked cabinets for paper documents and CDs, fire safety, smoke and fire alarms and burglar alarms.
Security obstacles— disallowing mobile phones with camera, CDs, pen drives, record of laptop model and numbers.
The electronic proce-dures would include:
Access control— authentication to validate identity of employees, encryption, to ensure that information is not viewed or tampered with during transmission, secure passwords or biometric identification for logging in, read only access to prevent accidental data modification, automated screen savers and log-out to inhibit access to unattended displays after particular time.
Non-repudiation—to establish an indisputable time-stamped audit trail of creation, modification, maintenance and transmit using the data entry system.
Digital signing—to attach legally binding electronic signatures to documents and forms.
Technological obstacles—firewalls to isolate internal and external networks, restricting use of pen drives and CDs in computers and laptops.
Back up procedures—regular backup through CDs or tapes storage in bank lockers and another location.
Data security system should describe legal procedures, for example, confidentiality of disclosure agreements from all persons who are likely to receive data like employees, investigators and vendors. The policy should also discuss necessary actions in case of a breach of security, for example, dismissal from employment, civil liability or criminal prosecution.
In the post-IPR era, there is a tug-of-war in India between global pharma companies expecting data exclusivity and Indian pharma companies opposing this move
The system will work only if the employees are adequately informed about their responsibilities for guarding the sponsor's data and are thoroughly trained to the use of physical and electronic systems. To quote Bruce Schneier, “People often represent the weakest link in the security chain and are chronically responsible for the failure of security systems.”
In the post-IPR era, there is a tug-of-war in India between global pharma companies expecting data exclusivity and Indian pharma companies opposing this move. Besides, Indian industry's capability of reverse engineering to make economic generics, has created an atmosphere of suspicion in post-IPR era. These concerns have made the global sponsors obsessive on the potential misuse of their valuable data. The sponsors expect the Indian CROs to establish a comprehensive data security system to ensure that their data is in safe hands. If Indian CROs want global business, they have to be ready to face the security challenge!
(The writers are the President and Assistant Manager of Data Management of ClinInvent Research Pvt Ltd)
Unethical practice or a product of necessity?
Clinical trials in developing countries
Unethical practice or a product of necessity?
Emmaline Brouwer
Kano, Nigeria, early 1996.
An outbreak of cerebral spinal meningitis kills 15 000. Médecins sans Frontières (MSF, Doctors without Borders) are the first NGO to arrive and work around the clock to treat the over 115 000 infected. The epidemic constitutes a severe public health crisis to the Nigerian government. A few weeks after the onset of the outbreak, Pfizer, the largest pharmaceutical company in the world, sends employees to Nigeria to conduct a clinical trial with the newly developed antibiotic trovafloxacin (Trovan®). Pfizer aims to bring Nigeria a life saving, innovative, less painful and cost effective form of antibiotic that could be used effectively to treat epidemic meningococcal meningitis, including in children. Almost 200 children are included in the study. Half of them receive trovafloxacin, the others are treated with the ‘best practice medication’, ceftriaxon. At least eleven of the children in the study group die, many others develop mental or physical disorders during or after the treatment. In 2001, the Nigerian federal government starts a lawsuit against Pfizer, claiming $7 billion for the victims and their relatives. The government declares that the authorities did not approve this clinical trial and the patients and their families did not give informed consent before treatment. Pfizer denies all accuses. The court case proceeds until today.
The Trovan® case has become famous as the illustration of negative consequences of clinical testing in developing countries. Although exact numbers are unknown, it is clear that an increasing part of clinical trials by pharmaceutical companies is conducted in low-income countries. Large companies such as GlaxoSmithKline, Wyeth and Merck report to perform 29-70% of their trials in ‘non traditional research areas’; scientists estimate this number to be 40% on average for all pharmaceutical trials.
Reasons for testing in developing countries
The main reason for the companies to choose new locations for their trials is that costs are 10-50% lower than in traditional research areas. Furthermore, less strict (or lack of) legislation helps research protocols to be easier and earlier accepted. If preparatory procedures take less time, more years for profit making within the patent period remain. Another pull factor is the fact that volunteers for trials are more easily found. This is partly because populations are larger and thus more patients with a certain disease are available. Yet, in many cases participation in a trial is the only chance for a patient to receive any treatment at all, and often the (financial) incentives form an important encouragement. A medical argument for testing in developing countries is that the outcome of research has a higher validity if the subjects of study have received less medication (similar to the one studied) before participating in the trial. Finally, there are high economical benefits for hosting governments, an important incentive to relocate trial venues to their countries. For example, India receives an estimated income of $1.7 billion in 2010, when 2 million Indians are estimated to take part in clinical trials.
Informed consent?
Non Governmental Organizations (NGOs) critically follow this transition to trial locations in developing countries. Their main argument against most of the clinical trials is that they are unethical, for they do not comply with the Helsinki Declaration, a document adopted by the World Medical Association stating ethical principles regarding human trials.
One of the concerns is the issue of informed consent. Due to analphabetism, language difficulties and a hierarchic doctor-patient relationship, informed consent is complex to obtain. Furthermore, poverty and dependency on the offered treatment make informed consent a subjective matter of discussion and question the voluntarism of the participants. Moreover, the Helsinki Declaration states that after the trial ends, the participants should be assured access to the best proven therapy identified by the study. This is often not the case in developing countries and was true for the meningitis outbreak in Kano, Nigeria, too.
Social and public health aspects of the debate include the shortages of educated health personnel in developing countries. Working for the trials means a large burden on the already heavy workloads of doctors and nurses. On a larger scale, it is often argued that most drugs on trial are developed to combat welfare diseases (as this entails greater profit) and to a lesser extent to combat tropical diseases that local residents mostly suffer from.
Responsibility
A large responsibility is with the local medical ethical committees that approve the research protocols. Assessment of these local committees has shown that 25% of the clinical trials in developing countries has had no ethical evaluation at all and that less than a quarter of the ethical committees follow the existing guidelines when reviewing a proposal. If guidelines are in place, there is often a lack of legislation to support them.
Large differences between the committees make it easy for pharmaceutical companies to choose the lenient ones to send their protocols to. They should promote responsible behaviour among themselves to comply with international guidelines and regulations.
NGOs urge stronger stakeholders to take responsibility in this matter. The European Union and the US Food and Drug Administration (FDA), as drug approving institutions, should help local governments to comply with the Helsinki Declaration. Strict control of medical ethical committees will force them to review their protocols critically. Development support (e.g. training of health care workers) could also strengthen local health care systems. Another recent development is an (online) database of clinical trials that are being conducted worldwide. This ensures an easier method of control for NGOs and Western governments, as well as making sure no double research is conducted.
Because of the lower costs, lack of ethical evaluation, guidelines and supporting legislation, it remains attractive for pharmaceutical companies to conduct clinical trials in developing countries. Informed consent procedures that are adhered to are inadequate. Also, patients are often denied the best available care after trial completion. Responsibility for changing this situation is shared by local ethical committees, pharmaceutical companies, NGOs, the EU and the FDA.
The Helsinki Declaration
The World Medical Association (WMA) compiled a document with ethical principles regarding clinical trials on human subjects. The Helsinki Declaration is regarded as the basis of human research ethics for all doctors, researchers and other health care workers worldwide.
A summary of relevant paragraphs is listed below.
2. It is the duty of the physician to promote and safeguard the health of the people.
5. The well-being of the human subject should take precedence over the interests of science.
8. Vulnerable research populations require special protection.
13. The protocol for a clinical trial should be reviewed by an independent ethical review committee.
20. Participation in a trial must be voluntary and participants must be informed.
29. A new method should be tested against the best current method.
30. At the conclusion of the study, all trial participants should be assured access to the best proven therapy identified by the study.
In developing countries, it is often difficult if not impossible to comply with all guidelines. Therefore, alternatives have been proposed. For example, the Nuffield Council of Bioethics, London, has recommended to test against the best available treatment for a disease in that national public health system.
Further reading
Pfizer: Trovan fact sheet
SOMO 2008: Ethics for Drug Testing in Low and Middle-income Countries
Wemos & SOMO: Examples of unethical testing
Wemos: “A bitter pill”
WMA: Helsinki Declaration
Nuffield council of bioethics: The ethics of research related to health care in developing countries (2002)
Photo © by Amfion Fotoshoots (Antonette de Groot-Klootwijk), photos for Global Medicine only, all rights reserved.
Wednesday, February 17, 2010
Licensing CRA's In India
Seeing the enormous growth of the industry we have a challenge to maintain the quality of the clinical trials happening in India .This is a very fragile industry and the succes depends deeply on the way we position us on the global platform as we have major pharma giants looking at us for a credible research data.Since it is a budding industry so the standards if placed in very start of the the industry shall reap the benefits in the later stage.Growth and global reputation of the IT industry in India a good example of this strategy .
DCGI (Drugs Controller General of India) can take a lead in this case and start issuing licences based on an activity based testing modules and experience of the monitors .The vast expanse of our country make it difficult to manage the affairs, specially when the functioning of DCGI's office is quite opaque.
This will further need specific clinical trials based on the complexity of the trials to be monitored by the licenced CRAs (Clincial Research Associate).
This wil also help establish carreer as a CRA and also encourage the free lancing career CRA's.Licencing will also give a a legal teeth to the Monitor to mange and monitor the reasearch on non compliant clinical research sites in India and contain the attitute of the rouge PI's (Principal Investigators).Once India develop this abilty it can also guide the other Asian nations in developing similar frameworks .
Subscribe to:
Posts (Atom)