Privacy, the Participant Code and Site Systems

Part of Principal Investigator (PI) Training: The Data You Sign For.

About 4 minutes. Free, in your language, no account needed.

Why this matters

A trial participant hands over an unusual amount of personal information and is told it will be protected. Four sub-sections of Annex 1 describe how, and three of them sit squarely with the site.

This is also the area where an ordinary clinical habit — a shared login, a spreadsheet on a desktop, a name on a specimen tube — becomes a regulatory finding.

Privacy and the code

§2.12.7 requires measures to protect the privacy and confidentiality of participants' personal information, in accordance with applicable regulatory requirements.

§2.12.8 is the mechanism: the participant's identity in reported data should be protected by a code, and the site holds the key that resolves it. The sponsor receives coded data; only your site can connect the code to a person.

That is a simple system with three predictable leaks:

• The enrollment log — the document mapping codes to names. It is the key to the whole scheme and it is often the least protected file at a site. Access should be limited to delegated staff and it should never travel.
• Documents sent to the sponsor. Laboratory reports, imaging, discharge summaries and electrocardiogram traces routinely carry names, dates of birth and hospital numbers. Redaction before transmission is a step that has to be someone's named job, and it has to be checked, because it is the leak that happens most.
• Specimens. Tubes and requisitions labeled in clinical habit rather than trial convention.

Note that the monitor's direct access to identifiable records at your site (§2.12.14, §3.16.4) is not a breach of confidentiality — it is a specified activity the participant agreed to in consent. What is not permitted is identifiable data leaving the site in reported data.

Site systems

§2.12.9 requires that, for systems deployed by the site to hold trial data, measures are in place to protect against unauthorized access, disclosure, dissemination, alteration, inappropriate destruction and accidental loss.

§2.12.10 then sets out the computerized-systems obligations in five parts, and each has a practical site consequence:

• (a) Secure access — individual accounts, no sharing. A shared login destroys attributability and breaches this sub-section simultaneously.
• (b) Notify the sponsor when access permissions change — including when someone leaves. This pairs with the delegation log end date from Module 2; make them one action.
• (c) The section 4 requirements for computerized systems apply to systems the site deploys for trial data — a locally built database or spreadsheet is not exempt because you built it.
• (d) Traceability and training where participants use equipment or devices — the person handed a device is trained, and it is recorded.
• (e) Significant system incidents are reported to the sponsor and the IRB/IEC — an outage that lost data, a security breach, a corruption event.

The five things worth checking yourself

Most of this is delegated, and most of it is invisible until an audit. Five checks, once a quarter, catch nearly all of it:

1. Does anyone share a login for a trial system? (The answer at a busy site is more often yes than people admit.)
2. Has every departed staff member's access actually been revoked?
3. Is there a trial spreadsheet or document on a local desktop, an email account, or a personal device?
4. Does anything leaving the site carry an identifier — a name, a date of birth, a hospital number?
5. Is the enrollment log access-controlled, and does it stay at the site?

Key takeaways

• §2.12.7 and §2.12.8: protect personal information, and protect identity in reported data with a code the site alone can resolve.
• The three predictable leaks are the enrollment log, unredacted documents sent to the sponsor, and specimen labeling.
• §2.12.9 and §2.12.10: individual accounts only, notify the sponsor when permissions change, treat site-built systems as in scope, and report significant incidents.
• Monitor and inspector access to identifiable records at the site is authorized (§2.12.14); identifiable data in reported data is not.