The year 1999 was a troubling year for clinical research. The death of a young man in a gene transfer clinical trial led to intense scrutiny of that trial. During the Food and Drug Administration (FDA) review of the protocol and procedures, several concerns were raised about this clinical trial. Also in 1999, the Office for Human Research Protections (OHRP) inspected a number of medical centers for compliance with human subject regulations. Major medical centers had human research shut down for noncompliance. Specific patient safety concerns were addressed by the FDA Center for Biologics Evaluation and Research in letters to investigators involved in gene transfer research. In response to the irregularities in the gene transfer studies, the FDA sent every gene transfer researcher a letter dated March 6, 2000 requesting numerous records for each study, audit results and plans, and compliance with Good Clinical Practice.

Recently, several agencies have published reports and made recommendations on research subject safety. The Department of Health and Human Services (DHHS) Office of Inspector General (OIG) issued Protecting Human Research Subjects: Status of Recommendations in April 2000. This report was a followup to a June 1998 report entitled, Institutional Review Boards: A Time for Reform. The June 1998 report warned that the effectiveness of the Institutional Review Boards (IRBs) was in question and presented numerous recommendations for improving IRB function. The April 2000 report showed increased enforcement of regulations related to human clinical research, both by the NIH/OPRR and by the FDA. (Examples of letters sent by the OHRP to major institutions regarding irregularities with the IRBs at these institutions are also available online.) Investigations into irregularities and IRB procedures resulted in the suspension of Federal funding at seven institutions. The April 2000 OIG report stated that the problems in the gene transfer trials should be a "catalyst" for greater attention "to be directed to ensuring human-subject protections for a broader universe of clinical trials, particularly those in which patients face significant risks."

Recent Actions

With these examples of seeming disregard for regulations to protect patient safety, the National Institutes of Health (NIH), DHHS, and the FDA published a number of documents aimed at protection of human subjects. Specifically, NIH issued Data and Safety Monitoring and Required Education in June 2000.

This guidance document is the product of a committee formed from the GCRC Program Directors Association at the request of Dr. Judith Vaitukaitis, director of the National Center for Research Resources (NCRR). This committee (chaired by Dr. Louise M. Markert, Program Director of the Duke University GCRC), although initially focused on the new requirements, expanded the scope of its review in the interest of research subject safety. Although the examples above relate to gene transfer research, the goal of the present effort is to restore public trust in the clinical research community. This document (edited by NCRR staff) clarifies the impact of these new requirements on the GCRCs, reemphasizes ongoing requirements related to patient safety at GCRCs, and suggests mechanisms by which GCRCs can aid investigators in their efforts to enhance patient safety and comply with governmental requirements. Some of the areas included in this document stem from issues that were found to be important at the committee members' institutions. This document highlights new and previously unrecognized requirements applicable to clinical research and patient safety at GCRCs.

Although a tragic death occurred in 1999 in a gene transfer trial and FDA audits confirmed that lapses in protocol had occurred, the recent cumulative record of human-subject protection is one of accomplishment. Achievements in this area have included the development of IRBs; principles of consent; inclusion of women, minorities, and children in research studies; avoidance of coersion; and emphasis of risk/benefit to the research subject. Clinical investigators have been at the forefront, advancing the cause of human subjects protection. The heightened awareness regarding human research protection has served as the impetus for the recommendations in this report. The committee recommends that new support mechanisms be instituted to enhance research subject safety.

The committee believes that this is an opportune time to refresh and strengthen the education and training of the clinical research and support staff community with respect to the following areas:

1. current guidelines with respect to patient safety
   
2. good clinical practice
   
3. good manufacturing practice
   
4. adverse event reporting
   
5. data and safety monitoring
   
6. the Clinical Laboratory Improvement Act (CLIA)
   
7. new recommendations regarding privacy and security

The committee views this time as an opportunity for GCRCs to fill a leadership role at medical centers across the country. In many institutions, GCRCs can provide this help to investigators.

There is now an opportunity for GCRCs to explore what mechanisms will work best to help investigators enhance research subject safety. It is likely that different GCRCs will develop different ways to help investigators, considering the diverse portfolio of the GCRCs. If the GCRCs start to explore different possible mechanisms now, the GCRCs will be positioned to provide leadership roles across the country.

The committee has developed these recommendations with the intent that the GCRC will play a leadership role in education, training, and support. This is complementary to the NCRR initiative to support a Research Subject Advocate (RSA) for the GCRC. While meeting core requirements, individual GCRCs may employ a variety of tools and offer specific services to improve research integrity. A GCRC may elect to offer limited audits for researchers on a voluntary basis. In the future, the local medical centers, the NIH, and/or the FDA, may require an audit mechanism. Individual institutions will likely decide the role of the GCRC in such plans. The committee envisions that the GCRCs will help investigators comply with existing regulations and prepare for changes in the regulatory requirements. The remainder of this document is intended to clarify how GCRCs function to enhance both research subject safety and the integrity of clinical research.

The committee's recommendations identify mechanisms that can be used to help investigators comply with the new requirements. Different mechanisms (and personnel) may be needed at different centers because of the differences in the types of research being conducted. This document is not meant to establish a single method of compliance.

The committee discussed a wide-ranging list of topics that may prove useful to GCRCs. Advances in patient care depend on excellent clinical research, which can never be risk free. Program Directors (PDs) will carry the banner by continuing to advance the cause of full human-subject protection. This will only serve to enhance the current vibrant, active, clinical research enterprise.

1. There is no requirement that an individual be a physician or have clinical privileges in order to serve as a PI on a GCRC protocol. The GCRC Guidelines state, "All GCRC research subjects must receive optimal medical care. It is the responsibility of the principal investigator of the project to assure that appropriate medical care is provided to research subjects participating in his or her research proposals. This responsibility may be discharged either personally if the principal investigator is a physician, by a physician, co-investigator, fellow, resident or other physician who possesses the requisite clinical expertise, admitting privileges, and is familiar with the protocol. This individual must be named in advance of implementing the protocol. Responsibility for protocol design, authorship, and like issues resides with the principal investigator; however, for reporting purposes, the physician who provides medical coverage should be identified on the protocol in new and competing GCRC grant applications and in the GCRC annual report. Arrangements for emergency and night care must be formalized. House officer coverage is desirable."

2. If the research involves the study of subjects with a disease(s) or procedures that impart more than minimal risk, then either the PI or one of the co-investigators should be a physician with demonstrated expertise in the disease under study and/or the procedures that impart more than minimal risk. This physician should also have clinical privileges for any study procedures that require such privileges. When risks relate to more than one disease or procedure, then appropriate expertise must be demonstrated among the investigators. The committee recommends that the PI be located on-site at the host institution in order to assure that he/she can discharge oversight functions on a day-to-day basis. If a PI relocates to another institution, then a new PI must be appointed at the host institution. That individual assumes primary responsibility for the day-to-day conduct and oversight of the study. The previous PI can remain on the project as a co-investigator.

The NIH published notice of required education in the NIH Guide (release date: June 5, 2000).

As of October 1, 2000, all key personnel involved in human research protocols must receive relevant training. "Key personnel" in this context is defined as those involved in the design and/or conduct of the study. By December 1, 2000, the PI of each GCRC should have submitted—to NCRR—a list of key personnel for all protocols and verified that all had been appropriately trained. The committee recommends that the PD ensures that all key personnel—for protocols submitted after this date—have received training.

Each institution will establish its own training guidelines, which may vary from institution to institution. The GCRC Advisory Committee (GAC) may participate in this process at the host institution.

The NIH published notice of new guidance on conflict of interest in the NIH Guide (release date: June 5, 2000).

Each GCRC investigator must follow the host institution's conflict of interest guidelines. Compliance is the responsibility of the university administration and IRB.

NCRR has stipulated that each GCRC will have a Research Subject Advocate (RSA). This position was described in the September 27, 2000 request from the Director of the NCRR to the NIH Deputy Director for Extramural Research (Dr. Wendy Baldwin) for a waiver for the GCRC Program monitoring plan for Phase I and II clinical trials. The following language is derived from that document.

Each GCRC is to have an RSA. (The title may differ among GCRCs. For example, "Medical Director" may be used at some sites.) The RSA will be supported by NCRR through the GCRC grant and will be directly responsible to the PI of each GCRC grant (usually the Dean of the School of Medicine or another individual with trans-departmental authority). The RSA is to ensure that the IRB- and GAC-approved monitoring plan is fully implemented and that the protocol carried out at the GCRC complies with the IRB- and GAC-approved protocol. The RSA is to have appropriate training and experience within the clinical research arena. An RSA may hold an M.D. degree, but appropriately trained Ph.D.s, pharmacists, and research nurses also qualify. The RSA will be responsible directly to the PI of the GCRC grant; the GAC also reports directly to that PI.

The committee appreciates that the Division for Clinical Research Resources at NCRR has acknowledged this need and is committed to supporting this activity.

Responsibility assigned to the RSA may be divided among two or more qualified individuals, depending on the size of the research portfolio of a GCRC site and if that site has outreach programs to satellites at other institutions. If there is an RSA at a satellite center, the RSA at the satellite site will also report to the PI of the GCRC grant.

The RSA will help ensure that GCRC investigators send expedited adverse event (AE) reports in a timely fashion to the IRB and appropriate Federal agencies.

The GAC—in conjunction with the PD and PI—will exercise its judgment as to the most appropriate personnel needed to fulfill the responsibilities of the RSA and to help in other areas of patient safety.

A professional with the appropriate expertise is desirable to head up AE reporting and evaluation of data and safety monitoring.

A professional with the appropriate expertise in Good Clinical Practice (GCP), Good Laboratory Practice (GLP), and Good Manufacturing Practice (GMP) may help investigators come into compliance with the requirements. This individual can also help perform audits as requested.

Data monitoring should have the appropriate biostatistical input and support.

The most appropriate person(s) for these roles—and the expertise needed at a given GCRC—depends upon the protocol mix at that center and can best be ascertained by the GAC, PD, and PI. Guidelines should allow for flexibility in the hiring of these personnel and appropriate administrative support.

Current Regulations

The NIH published notice of new guidance on data and safety monitoring for Phase I and Phase II clinical trials sponsored by NIH in the NIH Guide (release date: June 5, 2000).

Beginning with the October 1, 2000 grant submission deadline, each investigator must submit a monitoring plan for Phase I and Phase II clinical trials before the trial begins. "A detailed monitoring plan ... must be included as part of the protocol and submitted to the local IRB and reviewed and approved by the funding Institute and Center (IC) before the trial begins. At a minimum, all monitoring plans must include a description of the reporting mechanisms of adverse events to the IRB, the FDA and the NIH." NCRR has a waiver that allows the GAC to approve these plans in lieu of NCRR for Phase I and II clinical trials conducted at the GCRC not funded by another NIH institute. NCRR requires that the monitoring plans for these studies be approved by the IRB prior to review by the GAC.

According to the requirements, if Phase I or Phase II trials are high risk, involve vulnerable populations, or are blinded, a data and safety monitoring board (DSMB) may be appropriate. The meeting frequency of a DSMB, its composition, and its responsibilities should be tailored to the design and risks of each study.

Data and safety monitoring boards for Phase III trials are described under the policy published in 1998.


Rationale for Recommendations

Research subject safety issues need to be clearly thought out and defined. Investigators may enhance safety by periodically reviewing the protocol.


Recommendations

The committee recommends that all GCRC protocols (not just Phase I and Phase II) have a data and safety monitoring plan, which includes periodic review and reporting as appropriate for each study. These plans should be approved by the GAC prior to the initiation of the study.

The minimum required content includes the following:
• AE grading and attribution scale
• Plan for unanticipated AE reporting
• Plan for annual reporting of AEs
• Plan for safety review (by whom and at what frequency)

The content will include additional information as determined by the GAC as appropriate for the protocol. Examples may include:

Safety review questions:
• What was the reason for dropouts?
• Are AEs too frequent or severe for protocol to continue?
Enrollment numbers and protocol violations:
• Did all enrolled patients meet entry criteria?
Plan for ongoing review of results (if appropriate):
• No risk is justified if the hypothesis has been disproved.
Regarding the Data and Safety Monitoring Plans (DSMPs) required by the NIH for Phase I and Phase II trials, the GCRCs may help investigators if requested in the preparation of these plans for GCRC protocols. Per the NCRR waiver, these plans must be approved by the IRB prior to GAC review and approval. It is recognized that the approval of these DSMPs is a primary IRB responsibility.
The committee recommends that NCRR allow GACs to review the DSMPs prior to review by the IRB (not only after approval by the IRB). For the most efficient review of protocols, parallel review by the IRB and GAC is often desirable.

Regarding the DSMPs required for all other GCRC protocols, the GAC will review and must approve these prior to study initiation. The investigators will be asked by the GAC to submit these DSMPs to the IRB for review.

VIII. Adverse Event (AE) Reporting

Current Regulations on Expedited Reporting

DHHS has published regulations regarding reporting of adverse events under 45CFR46.103(b)(5)(i). This regulation requires that the PI follow written procedures to ensure prompt reporting to the IRB, institutional officials, and the department or agency head of any "unanticipated problems involving risks to subjects." The committee recommends that the investigator copy these reports (being sent to the funding institute and local IRB) to the local GCRC.

The FDA has a parallel set of published regulations related to AE reporting under 21CFR 312.32(c)(1)(i) and 21 CFR 56.108(b). These regulations apply to any study operating under an Investigational New Drug Application (IND). The sponsor must notify the FDA and participating investigators of any AE associated with the use of a test drug that is "both serious and unexpected."

"Unanticipated problems—as defined by DHHS—are often the same as "serious adverse events" (SAEs) as defined by the FDA. Investigators, in their protocols, may precisely define the severity of "unanticipated problems" that will be subject to expedited review.

Trials for which the National Cancer Institute is the IND Sponsor have somewhat different reporting requirements. Trials involving recombinant DNA molecules have additional reporting requirements.

The preceding requirements regarding expedited reporting apply to category A, B, and D protocols.


Rationale for Recommendations Regarding Expedited Reporting

Unanticipated AEs should be immediately reported to the GCRC. The information should be promptly reviewed to determine if it is safe to continue the protocol in the GCRC or whether additional patient care resources may be required.

If a multicenter clinical trial is put on hold by the FDA, the GCRC needs to know if patients from its local site are at risk.

The GCRC should evaluate the magnitude of the annual AE for all GCRC protocols to determine if any protocols need additional staffing for safety or, possibly, need to be done in another setting.

This rationale explains why copies should go to the GCRC in addition to the IRB that is primarily responsibility for research subject safety. The GCRC may be able to increase research subject safety by changing GCRC staffing patterns or applying other patient care resources to a protocol. This can only be done if the GCRC is informed in real time about the AEs of a protocol.


Recommendations Regarding Expedited Reporting

The local GCRC office should receive expedited AE reports no later than 15 calendar days after the event. If such an event occurs during a multicenter or industry-sponsored study that is being conducted—totally or partially—at the GCRC, the committee recommends that the PI of record—at the local GCRC where the event occurred—sends a copy of the report (the original of which is sent to the FDA and IRB) to the local GCRC administrative office. The investigator should provide a copy of the report sent to the FDA; if the report cannot be made available within 15 calendar days of the event, the PI should send a summary of the event to the GCRC within this period. A copy of the report that was sent to the FDA should then be provided to the GCRC as soon as it is available from the sponsor.

The committee recommends that for multicenter studies, any SAE that leads to the study being put on hold should be reported to each GCRC. This responsibility lies with the investigators at the local GCRCs who receive the SAE information from the study sponsor. They should forward it to the local GCRC.

The committee recommends that each GAC establish a procedure to review the expedited reports of "unanticipated problems involving risks to subjects" as these reports are received. This in no way replaces or minimizes the primary role of the IRB in reviewing AEs and meeting their statutory responsibilities.

Expedited AE reports and annual AE summary reports should not have patient-identifiable material in them. Each report, however, should have a study identification number or some other unique identifying number that can be used by the investigator, but not outside individuals, to identify the patient.


Current Regulations on Annual Reporting of AEs

The IRB requirements are based on the local interpretation of the following regulations:

1. The regulations at 45 CFR 46.103(b)(4), which state, in pertinent part, that an IRB must follow written procedures "(i) for conducting its initial and continuing review of research and for reporting its findings and actions to the investigator and the institution; (ii) for determining which projects require review more often than annually and which projects need verification from sources other than the investigators that no material changes have occurred since previous IRB review; and (iii) for ensuring prompt reporting to the IRB of proposed changes in a research activity, and for ensuring that such changes in approved research, during the period for which IRB approval has already been given, may not be initiated without IRB review and approval except when necessary to eliminate apparent immediate hazards to the subject."

2. The regulations at 45 CFR 46.115(a), which require an institution (or IRB) to "prepare and maintain adequate documentation of IRB activities, including the following: (1)...reports of injuries to subjects...(3) records of continuing review activities, [and] (4) copies of all correspondence between the IRB and the investigators." These records must be retained for at least three years after completion of the research. 45 CFR 46.115(b).

The FDA requirements are found in CFR Part 312, Subpart B "Investigational New Drug Application," Section 312.33 "Annual Reports." The relevant portion is 312.33.b "Summary information" 1-4.

"(b) Summary information. Information obtained during the previous year's clinical and nonclinical investigations, including:

1. A narrative or tabular summary showing the most frequent and most serious adverse experiences by body system.

2. A summary of all IND safety reports submitted during the past year.

3. A list of subjects who died during participation in the investigation, with the cause of death for each subject.

4. A list of subjects who dropped out during the course of the investigation in association with any adverse experience, whether or not thought to be drug related."

As described in Guidance on Reporting Adverse Events to Institutional Review Boards for NIH-Supported Multicenter Clinical Trials, the data and safety summary reports from data and safety monitoring boards (DSMBs) for multicenter, NIH-sponsored trials must be forwarded to the IRB at each institution involved in the study.

The committee recommends that the GAC should establish a procedure to review the annual summary of AE for all protocols. The GAC may request a copy of the annual report of AE information provided to the IRB or FDA or both as applicable.

The committee recommends that each GAC develop a mechanism to ensure that GCRC staff is educated on the regulations involving AE reporting.

IX. Security/Privacy

Database Encryption

In 1996, Congress passed the Health Insurance Portability and Accountability Act (HIPAA). The proposed Standards for Privacy of Individually Identifiable Health Information are based on the 1997 recommendations of the Secretary of Health and Human Services to Congress: Protecting the Confidentiality of Individually Identifiable Health Information.

GCRCs often have on-line databases or Web sites. The committee recommends that GCRC databases have password protection. All data sent over the Internet should be encrypted. A secure socket layer can be used to secure information being viewed at a Web site. The secure socket layer is a low-level transportation vehicle that secures information moving from one computer to another. Individuals (investigators, GAC members) should not be given unrestricted access to GCRC databases but instead should have access "as needed." Individuals accessing GCRC databases should not be able to alter the data or directly view all of it without specific cause. GCRC bioinformatics managers should know what the current regulations are in this area. As the regulations evolve, the bioinformatics managers may need to change security mechanisms at their center.

For information on the Health Privacy Rule, U.S. Department of Health and Human Services, please see the following:

• 7/6/2001 - First Guidance on the Final Privacy Rule

• You can still look at the rule: Preamble (in 4 parts) / Regulation Text

• HHS Fact Sheet on Final Privacy Rule


E-mail Security

The GCRC staff and investigators should be aware that all E-mail must be encrypted or password protected if it has patient-identifiable information in it.


Tissue Banking

On November 7, 1997, the Office for Protection from Research Risks published Issues to Consider in the Research Use of Stored Data or Tissues. This information should be studied carefully by any investigator considering or involved in tissue banking. Additionally, information is available from the National Bioethics Advisory Commission.


Other Issues to be Considered

Documentation that the sample was obtained with informed consent—using a form approved by an IRB under OHRP—may need to be on file at the tissue bank if subject-identifying information is included with the specimen. Alternatively, there needs to be assurance that the investigator has such documentation.

The tissue bank should consider limiting access to the computer data files to personnel on a "need-to-know" basis.

Database security is important. Passwords should be used and changed periodically. The tissue bank may want to establish an "audit log" to record all users' actions.

Written procedures may be used when investigators apply for access to research samples.

Use of samples for secondary purposes must have consent of the subject if there is any identifying information associated with the sample when it is transferred to an investigator or site that was not specifically approved by name in the original protocol and on the informed consent form.

Written procedures regarding regulations for selling or distributing samples should be part of any agreement with recipient collaborators.

The informed consent document should indicate whether or not the subject will receive any financial benefit from future developments achieved through the use of the tissue.

X. Medical Records Confidentiality and Research Consent Forms/Data

State Regulations

Some states may require that the informed consent document be placed in the medical record for all therapeutic research studies that are relevant to good medical management. The state regulations for each GCRC should be available to investigators.

The Joint Commission on Accreditation of Healthcare Organizations (JCAHO) requires documentation in the medical chart that a number of elements of the informed consent process were completed. Please refer to the JCAHO Accreditation Manual for Hospitals.

The following elements of the informed consent process are required in the medical chart as described in the "Patient rights and organization ethics" chapter.

RI.1.2 Patients are involved in all aspects of their care.

RI.1.2.1 Informed consent is obtained.

RI.1.2.1.1 All patients asked to participate in a research project are given a description of the expected benefits.

RI.1.2.1.2 All patients asked to participate in a research project are given a description of the potential discomforts and risks.

RI.1.2.1.3 All patients asked to participate in a research project are given a description of alternative services that might also prove advantageous to them.

RI.1.2.1.4 All patients asked to participate in a research project are given a full explanation of the procedures to be followed, especially those that are experimental in nature.

RI.1.2.1.5 All patients asked to participate in a research project are told that they may refuse to participate, and that their refusal will not compromise their access to services.

The following information about the protocol must be in the medical chart as required by the "Management of Information" chapter.

IM.3.2.1 Medical records are reviewed on an ongoing basis for completeness and timeliness of information, and action is taken to improve the quality and timeliness of documentation that impacts patient care.

This section includes requirements for history and physical, evidence of appropriate informed consent, diagnostic orders, progress notes, etc.

IM.7.2 The medical record contains sufficient information to identify the patient, support the diagnosis, justify the treatment, document the course and results, and promote continuity of care among health care providers.

To comply with the JCAHO regulations, the committee recommends the following:


1. For inpatient studies and for outpatient studies that have above-minimal risk, the investigator should place the Informed Consent Document in the medical chart. For minimal-risk outpatient studies, the investigator is not required by the JCAHO or OHRP to put a copy of the informed consent document in the hospital chart.
   
   
2. For any study with risk above minimal risk, the research subject should be requested to inform his or her personal physician of participation in the study.
   
   
3. If the informed consent document will be placed in the medical record, this should be indicated in the informed consent document. In addition, the research subject should also be informed if a medical record will be created because of participation in a research study.
   
   
4. If confidentiality precludes the informed consent document from being included in the hospital chart, the investigator should place a written statement in the chart indicating the subject's participation in research. This statement should explain that JCAHO requirements for consent have been met, and it should include contact information. If the research protocol may impact the research subject's health, the statement in the chart must include an adequate description of the intervention required by other health care professionals to deal with any potential medical problems.


Veterans Administration Regulations

National regulations under the Veterans Administration closely follow the JCAHO regulations.


Hospital Regulations

Local hospitals may have additional regulations on this issue.


Certificate of Confidentiality

For research studies in which sensitivity to confidentiality is high, and when disclosure would put subjects at legal risk, the PI may request a Certificate of Confidentiality from DHHS. See: Privacy Protection for Research Subjects "Certificates of Confidentiality."

Contact information for obtaining a Certificate of Confidentiality can be obtained online.

Certificates of Confidentiality, although important, are of limited usefulness. They protect PIs from being compelled to release identifiable research data through subpoena, but they do not provide increased confidentiality for the medical record.


IRB Issues (Common Rule and FDA Regulations)

Research consent forms generally promise confidentiality to subjects, but the status of being a patient is not usually confidential. As GCRC patients are also subjects, there is potential for conflict between JCAHO medical recordkeeping requirements and research confidentiality concerns. Several steps should be taken in considering and addressing these concerns.

GCRCs and their IRBs should examine the standard confidentiality promises in the IRB's model consent form to ensure that it informs patient-subjects that consent forms may be placed in their medical records when necessary for effective patient care.

GCRCs and their IRBs should determine how to proceed when there is no patient-care-related reason for including the consent form in the medical record. In such cases, the consent form may be replaced by a statement that indicates the subject's participation in research and conformance to JCAHO requirements—without including details about the study (e.g., a statement that the IRB has approved the study and that the subject's consent form is on file with the investigator). Alternatively, the consent form could inform all potential subjects that consent forms will always be placed in the hospital medical record, and standard medical confidentiality protections will apply.

When subjects are involved in sensitive research—disclosure about which would be embarrassing or upsetting, placing them at risk of discrimination or prosecution, or otherwise be potentially harmful to them—GCRCs and IRBs should develop standard procedures to replace the consent form with a statement such as the one previously described. Furthermore, in cases like this, some basic information (e.g., the study title) may need to be omitted from the medical record.

Similarly, the inclusion of study data in the medical record (e.g., genetic testing for disease susceptibility) can have unanticipated consequences for subjects. The information could affect their insurance status but would not have been available to insurers except for research participation. IRBs and GCRCs should be aware of this risk to subjects. In some instances, IRBs and GCRCs should ensure that this risk is disclosed to potential subjects; in other instances, it may be preferable to provide certain data to the subject or the subject's primary physician rather than automatically including it in the medical record.

The GAC should consult with the hospital legal counsel to determine official hospital policy on creation of medical record numbers for all patients. Some hospitals require that a medical record be created for all inpatients and outpatients, including healthy volunteer outpatients in GCRC studies. If this is the policy at the GCRC hospital, patients should be informed that a medical record will be created because of their participation in the study.

XI. Compliance with Clinical Laboratory Improvement Act (CLIA)

Regulations

The CLIA requires certification of laboratories involved with patient samples. The following excerpt is from Subpart A of the regulations under 42 CFR 493.2.

"Laboratory means a facility for the biological, microbiological, serological, chemical, immunohematological, hematological, biophysical, cytological, pathological, or other examination of materials derived from the human body for the purpose of providing information for the diagnosis, prevention, or treatment of any disease or impairment of, or the assessment of the health of, human beings. These examinations also include procedures to determine, measure, or otherwise describe the presence or absence of various substances or organisms in the body. Facilities only collecting or preparing specimens (or both) or only serving as a mailing service and not performing testing are not considered laboratories."

Section 493.3 relates to what laboratories must be certified. The following is excerpted directly from the regulations:

"(a) Basic rule. Except as specified in paragraph (b) of this section, a laboratory will be cited as out of compliance with section 353 of the Public Health Service Act unless it:

1. Has a current, unrevoked or unsuspended certificate of waiver, a registration certificate, a certificate, or a certificate of accreditation issued by DHHS applicable to the category of examinations or procedures performed by the laboratory; or
   
   
2. Is CLIA-exempt.

(b) Exception. These rules do not apply to components or functions of:



1. Any facility or component of a facility that only performs testing for forensic purposes;
   
   
2. Research laboratories that test human specimens but do not report patient specific results for the diagnosis, prevention or treatment of any disease or impairment of, or the assessment of the health of individual patients; or
   
   
3. Laboratories certified by the National Institutes on Drug Abuse (NIDA), in which drug testing is performed which meets NIDA guidelines and regulations. However, all other testing conducted by a NIDA-certified laboratory is subject to this rule."

The CLIA program is run by the Centers for Disease Control (CDC). Consult the CDC's Division of Laboratory Systems (DLS) and CLIANet for additional information.

Researchers should be aware that individuals from the CDC interpret the CLIA regulations to mean that research laboratories must be CLIA certified if any data from research or other testing on research patients are shared with physicians, counselors, the patient, or patient's family. These data also cannot be acted upon to change patient therapy if the laboratory is not CLIA certified.

Note: The Centers for Medicare and Medicaid Services (formerly the Health Care Financing Administration) enforces CLIA. It contracts with the states to provide the application forms and inspect laboratories. There may be some variation of regulations from state to state.

The committee recommends that the GCRC inform all investigators of the requirement (as interpreted by the CDC) for CLIA certification for all laboratories, including research laboratories, which generate data that are shared with patients or physicians. The GAC should not approve protocols violating the CDC interpretation of CLIA regulations.

The committee recognizes that it will take some effort for laboratories to become CLIA certified if they had not been aware of this regulation. GACs may wish to specify a period (e.g., from 6 to 9 months) during which laboratories must be brought into compliance. In the meantime, investigators should be reminded that until CLIA certification is attained, results linked to specific patients should not be released to patients or any individuals outside of the research team.

XII. Drugs or Biologics Given to Patients

Investigators at many medical centers prepare drugs or biologics for administration to research subjects. These may be prepared under the auspices of an IND application to the FDA or guidance from other national organizations. It is important that these materials be prepared under appropriate standards such as the FDA GMP. There are a number of standards that are stipulated for biologic reagents. These include Blood Banking Rules (21 CFR Part 606) for certain modified human erythrocytes or leukocytes and Current Good Tissue Practice (cGTP) for manufacturers of human cellular and tissue-based products. This issue does not refer to compounding of a product by a research pharmacy.

The documents describing IND regulations (21 CFR 312), GMP (21 CFR 210), and general biological products standards (21 CFR 610) are available from the FDA.

A sampling of the GMP regulations follow: The GMP facility should have controlled access. There must be a separate gowning and degowning room. All equipment must be inspected periodically. Meticulous records must be kept, including the lot release specifications of all cell lots—in particular those given to research subjects. All procedures must follow Standard Operating Procedures (SOPs). The investigator should refer to 21 CFR for the current regulations. Other regulations may be applicable for tissue or blood products as mentioned above.

Regarding human cells, tissues, and cellular and tissue-based products, the FDA requires registration of facilities. The final rule is found in the Federal Register, Vol. 66, No. 13, Friday, January 19, 2001. Laboratories preparing these products are registered using FDA Form 3356, 7/31/2004 edition.

The committee recommends that if a GCRC investigator requests to administer biologics or drugs not approved by the FDA, the GAC should review the oversight of laboratory procedures. In particular, GMP or other relevant guidelines should be followed. The GAC may recommend that audits be performed by an independent third party.

Most of what is proposed for safety and protocol compliance monitoring is required by JCAHO. The JCAHO regulations that apply are:

RI.3 - The hospital protects patients and respects the rights during research, investigation, and clinical trials involving human subjects.

TX3.4 - Preparing and dispensing medication(s) adhere to law, regulation, licensure, and professional standards of practice.

PI.3 - Data are collected to monitor the stability of existing processes, identify opportunities for improvement, identify changes that will lead to improvement, and sustain improvement.

PI.3.1 - The organization collects data to monitor its performance. [Monitoring for Adverse Events is understood to be a part of this process].

LD.2.7 - Directors maintain appropriate quality control programs.

JCAHO regulations may change - this should be closely followed.

XIII. Summary of Committee Recommendations

Investigators

The committee recommends that the PI be located onsite at the host institution in order to assure that he/she can discharge oversight functions on a day-to-day basis. If the PI relocates to another institution, a new PI must be appointed at the host institution. That individual assumes primary responsibility for the day-to-day conduct and oversight of the study. The previous PI can remain on the project as a co-investigator.


Training of Investigators in the Protection of Human Research Participants

The committee recommends that the Program Director ensures that all key personnel—for protocols submitted after December 1, 2000—have received training.


Data and Safety Monitoring

The committee recommends that all GCRC protocols (not only Phase I and Phase II) have a data and safety monitoring plan, which includes periodic review and reporting as appropriate for each study. These plans should be approved by the GAC prior to the initiation of the study.

The minimum required content includes the following:
• AE grading and attribution scale
• Plan for unanticipated AE reporting
• Plan for annual reporting of AEs
• Plan for safety review - by whom and at what frequency

The content will include additional information as determined by the GAC as appropriate for the protocol. Examples may include:

Safety review questions:
• What was the reason for dropouts?
• Are AEs too frequent or severe for protocol to continue?
Enrollment numbers and protocol violations:
• Did all enrolled patients meet entry criteria?
Plan for ongoing review of results (if appropriate):
• No risk is justified if the hypothesis has been disproved.

The committee recommends that NCRR allow GACs to review the DSMPs prior to review by the IRB (not only after approval by the IRB). For the most efficient review of protocols, parallel review by the IRB and GAC is often desirable.


Reporting of Unanticipated Adverse Events

Regarding studies not conducted under an IND, the committee recommends that the investigator copy expedited AE reports (being sent to the funding institute and local IRB) to the local GCRC. Optimally, these should be received by the local GCRC office no later than 15 calendar days after the event.

Regarding studies conducted under an IND, the local GCRC office should receive expedited AE reports no later than 15 calendar days after the event. If such an event occurs during a multicenter or industry-sponsored study that is being conducted—totally or partially—at the GCRC, the committee recommends that the PI of record—at the local GCRC where the event occurred—sends a copy of the report (the original of which is sent to the FDA and IRB) to the local GCRC administrative office. The investigator should provide a copy of the report sent to the FDA; if the report cannot be made available within 15 calendar days of the event, the PI should send a summary of the event to the GCRC within this period. A copy of the report that was sent to the FDA should then be provided to the GCRC as soon as it is available from the sponsor.

The committee recommends that for multicenter studies, any serious SAE that leads to the study being put on hold should be reported to each GCRC. This responsibility lies with the investigators at the local GCRCs who receive the SAE information from the study sponsor. They must forward it to the local GCRC.

The committee recommends that each GAC establish a procedure to review the expedited reports of "unanticipated problems involving risks to subjects" as these reports are received.

The committee recommends that the GAC should establish a procedure to review the annual summary of AE for all protocols. The GAC may request a copy of the annual AE report provided to the IRB, FDA, or both as applicable.

The committee recommends that each GAC develop a mechanism to ensure that GCRC staff are educated on the regulations involving AE reporting.


Security/Privacy

The committee recommends that GCRC databases have password protection.

To comply with the JCAHO regulations, the committee recommends the following:


1. For inpatient studies and for outpatient studies that have above-minimal risk, the investigator should place the Informed Consent Document in the medical chart. For minimal-risk outpatient studies, the investigator is not required by the JCAHO or OHRP to put a copy of the informed consent document in the hospital chart.
   
   
2. For any study with risk above minimal risk, the research subject should be requested to inform his or her personal physician of participation in the study.
   
   
3. If the informed consent document will be placed in the medical record, this should be indicated in the informed consent document. In addition, the research subject should also be informed if a medical record will be created because of participation in a research study.
   
   
4. If confidentiality precludes the informed consent document from being included in the hospital chart, the investigator should place a written statement in the chart indicating the subject's participation in research. This statement should explain that JCAHO requirements for consent have been met, and it should include contact information. If the research protocol may impact the research subject's health, the statement in the chart must include an adequate description of the intervention required by other health care professionals to deal with any potential medical problems.


CLIA

The committee recommends that the GCRC inform all investigators of the requirement (as interpreted by the CDC) for CLIA certification for all laboratories, including research laboratories, which generate data that are shared with patients or physicians or that are used to affect therapy. The GAC should not approve protocols violating the CDC interpretation of CLIA regulations.

The committee recognizes that it will take some effort for laboratories to become CLIA certified if they had not been aware of this regulation. GACs may wish to specify a period (e.g., from 6 to 9 months) during which laboratories must be brought into compliance. In the meantime, investigators should be reminded that until CLIA certification is attained, results linked to specific patients should not be released to patients or any individuals outside of the research team.


Preparation of Drugs or Biologics

The committee recommends that if a GCRC investigator requests to administer biologics or drugs not approved by the FDA, the GAC should review the oversight of laboratory procedures. In particular, GMP or other relevant guidelines should be followed. The GAC may recommend that audits be performed by an independent third party.

 
 

For further information, contact:
Director, Division for Clinical Research Resources
National Center for Research Resources
National Institutes of Health
One Democracy Plaza, Room 906
6701 Democracy Boulevard, MSC 4874
Bethesda, Maryland 20892-4874
Telephone: 301-435-0790
Fax: 301-480-3661
E-mail: CRADIR@mail.nih.gov