Initial commit

skills/clinical-reports/references/regulatory_compliance.md

@@ -0,0 +1,577 @@
+# Regulatory Compliance for Clinical Reports
+
+## HIPAA (Health Insurance Portability and Accountability Act)
+
+### Overview
+
+HIPAA Privacy Rule protects individually identifiable health information (Protected Health Information, PHI). All clinical reports must comply with HIPAA requirements for privacy and security.
+
+### Protected Health Information (PHI)
+
+**Definition:** Individually identifiable health information held or transmitted by covered entities or business associates in any form or medium.
+
+**Covered Entities:**
+- Healthcare providers
+- Health plans
+- Healthcare clearinghouses
+
+**Business Associates:**
+- Third parties providing services involving PHI
+- Require Business Associate Agreement (BAA)
+
+### 18 HIPAA Identifiers
+
+These identifiers must be removed for Safe Harbor de-identification:
+
+1. **Names**
+2. **Geographic subdivisions smaller than state** (except first 3 digits of ZIP if >20,000 people)
+3. **Dates** (except year) - birth, admission, discharge, death
+4. **Telephone numbers**
+5. **Fax numbers**
+6. **Email addresses**
+7. **Social Security numbers**
+8. **Medical record numbers**
+9. **Health plan beneficiary numbers**
+10. **Account numbers**
+11. **Certificate/license numbers**
+12. **Vehicle identifiers and serial numbers**
+13. **Device identifiers and serial numbers**
+14. **Web URLs**
+15. **IP addresses**
+16. **Biometric identifiers** (fingerprints, voiceprints)
+17. **Full-face photographs and comparable images**
+18. **Any other unique identifying characteristic or code**
+
+### De-identification Methods
+
+#### Method 1: Safe Harbor
+
+Remove all 18 identifiers AND have no actual knowledge that remaining information could be used to identify the individual.
+
+**Implementation:**
+- Remove/redact all 18 identifiers
+- Ages over 89 must be aggregated to "90 or older"
+- Dates can keep year only
+- Geographic areas can include state only
+- Documentation that no identifying information remains
+
+#### Method 2: Expert Determination
+
+Statistical/scientific analysis demonstrating that risk of re-identification is very small.
+
+**Requirements:**
+- Performed by qualified statistician or expert
+- Documented analysis methods
+- Conclusion that re-identification risk is very small
+- Maintained documentation
+
+### HIPAA Minimum Necessary Standard
+
+**Principle:** Use, disclose, and request only the minimum PHI necessary to accomplish purpose.
+
+**Exceptions:**
+- Treatment purposes (providers need full information)
+- Patient-authorized disclosures
+- Required by law
+
+**Implementation:**
+- Role-based access controls
+- Purpose-specific disclosures
+- Limited data sets when feasible
+
+### Patient Authorization
+
+**When required:**
+- Uses/disclosures beyond treatment, payment, operations (TPO)
+- Marketing purposes
+- Sale of PHI
+- Psychotherapy notes
+- Research (unless waiver obtained)
+
+**Required elements of authorization:**
+- Specific description of PHI to be used/disclosed
+- Person(s) authorized to make disclosure
+- Person(s) to receive information
+- Purpose of disclosure
+- Expiration date or event
+- Patient signature and date
+- Right to revoke
+- Potential for re-disclosure by recipient
+
+### HIPAA Security Rule (Electronic PHI)
+
+**Administrative Safeguards:**
+- Security management process
+- Workforce security
+- Information access management
+- Security awareness and training
+- Security incident procedures
+
+**Physical Safeguards:**
+- Facility access controls
+- Workstation use and security
+- Device and media controls
+
+**Technical Safeguards:**
+- Access control
+- Audit controls
+- Integrity controls
+- Transmission security
+
+### Breach Notification Rule
+
+**Breach definition:** Unauthorized acquisition, access, use, or disclosure of PHI that compromises security or privacy.
+
+**Notification requirements:**
+- **Individual notification:** Without unreasonable delay, no later than 60 days
+- **Media notification:** If breach affects >500 residents of a state or jurisdiction
+- **HHS notification:** Within 60 days if >500 individuals; annually if <500
+- **Business associate notification to covered entity:** Without unreasonable delay
+
+**Content of notification:**
+- Description of breach
+- Types of information involved
+- Steps individuals should take to protect themselves
+- What entity is doing to investigate/mitigate
+- Contact procedures for questions
+
+### Penalties for HIPAA Violations
+
+**Civil penalties (per violation):**
+- Tier 1: $100-$50,000 (unknowing)
+- Tier 2: $1,000-$50,000 (reasonable cause)
+- Tier 3: $10,000-$50,000 (willful neglect, corrected)
+- Tier 4: $50,000-$1.9M (willful neglect, not corrected)
+
+**Criminal penalties:**
+- Knowingly obtaining PHI: Up to $50,000 and/or 1 year
+- Under false pretenses: Up to $100,000 and/or 5 years
+- Intent to sell/transfer/use for commercial advantage: Up to $250,000 and/or 10 years
+
+### Research and HIPAA
+
+**HIPAA authorization for research:**
+- Specific to research study
+- Describes PHI to be used
+- States that PHI may not be necessary for treatment
+
+**Waiver of authorization:**
+- IRB or Privacy Board approval
+- Minimal risk to privacy
+- Research could not practically be conducted without waiver
+- Research could not practically be conducted without access to PHI
+- Plan to protect identifiers
+- Plan to destroy identifiers when appropriate
+- Written assurances
+
+**Limited data sets:**
+- Remove 16 of 18 identifiers (may keep dates and geographic subdivisions)
+- Data use agreement required
+- Only for research, public health, or healthcare operations
+
+## 21 CFR Part 11 (Electronic Records and Electronic Signatures)
+
+### Scope
+
+FDA regulation establishing criteria for electronic records and electronic signatures to be considered trustworthy, reliable, and equivalent to paper records.
+
+**Applies to:**
+- Clinical trial data
+- Regulatory submissions
+- Manufacturing records
+- Laboratory records
+- Any record required by FDA regulations
+
+### Electronic Records Requirements
+
+**System validation:**
+- Validation documentation
+- Accuracy, reliability, consistent performance
+- Ability to discern invalid or altered records
+
+**Audit trails:**
+- Secure, computer-generated, time-stamped audit trail
+- Record of:
+  - Date and time of entry/modification
+  - User making change
+  - Previous values changed
+- Cannot be modified or deleted by users
+- Retained for records retention period
+
+**Operational checks:**
+- Authority checks (user authorization)
+- Device checks (valid input devices)
+- Education and training
+- Confirmation of intent (e.g., "Are you sure?")
+
+**Record retention:**
+- Electronic copies as accurate as paper
+- Protection from loss (backups)
+- Protection from unauthorized access
+- Ability to produce readable copies for FDA inspection
+
+### Electronic Signatures Requirements
+
+**General requirements:**
+- Unique to one individual
+- Not reused or reassigned
+- Verification of identity before establishing
+- Certification to FDA that electronic signatures are legally binding
+
+**Components:**
+- Unique ID
+- Password or biometric
+- Two distinct components when executed
+
+**Controls:**
+- Session timeout for inactivity
+- Periodic password changes
+- Prevention of password reuse
+- Detection and reporting of unauthorized use
+- Secure storage of passwords
+- Unique electronic signatures (not shared)
+
+**Electronic signature manifestations:**
+Must include:
+- Printed name of signer
+- Date and time of signing
+- Meaning of signature (e.g., review, approval, authorship)
+
+### Closed vs. Open Systems
+
+**Closed system:**
+- Access limited to authorized individuals
+- Within a single organization
+- Less stringent requirements
+
+**Open system:**
+- Not controlled by persons responsible for content
+- Accessible to unauthorized persons
+- Requires additional measures:
+  - Encryption
+  - Digital signatures
+  - Other authentication/security measures
+
+### Hybrid Systems (Paper + Electronic)
+
+**Requirements:**
+- Clear procedures for hybrid system use
+- Maintain record integrity
+- Paper records linked to electronic
+- Cannot delete electronic records after printing
+- Must preserve audit trails
+
+### Legacy Systems
+
+**Grandfather clause:**
+- Systems in use before August 20, 1997 may be grandfathered
+- Must demonstrate trustworthiness without full Part 11 compliance
+- Must validate and document reliability
+- Should have migration plan to compliant system
+
+## ICH-GCP (Good Clinical Practice)
+
+### Overview
+
+International ethical and scientific quality standard for designing, conducting, recording, and reporting trials involving human subjects.
+
+**Purpose:**
+- Protect rights, safety, and well-being of trial subjects
+- Ensure credibility of clinical trial data
+
+**Regulatory adoption:**
+- FDA recognizes ICH-GCP (E6)
+- Required for studies supporting regulatory submissions
+
+### Principles of ICH-GCP
+
+**1. Ethics:** Clinical trials should be conducted in accordance with ethical principles (Declaration of Helsinki, local laws)
+
+**2. Risk-benefit:** Trials should be scientifically sound with favorable risk-benefit ratio
+
+**3. Rights and welfare:** Rights, safety, and well-being of subjects take precedence over science and society
+
+**4. Available information:** Trials should use available nonclinical and clinical information
+
+**5. Quality:** Trials should be scientifically sound and described in clear, detailed protocol
+
+**6. Compliance:** Trials should comply with approved protocol
+
+**7. Qualified personnel:** Trials should be conducted by qualified individuals
+
+**8. Informed consent:** Freely given informed consent should be obtained from each subject
+
+**9. Privacy:** Confidentiality of subject records must be protected
+
+**10. Quality assurance:** Systems with procedures ensuring quality of data generated
+
+**11. Investigational products:** Manufactured, handled, and stored per GMP; used per approved protocol
+
+**12. Documentation:** Documentation systems should allow accurate reporting, interpretation, and verification
+
+**13. Quality management:** Sponsor should implement quality management system
+
+### Essential Documents
+
+**Before trial initiation:**
+- Investigator's Brochure
+- Protocol and amendments
+- Sample CRF
+- IRB/IEC approval
+- Informed consent forms
+- Financial disclosure
+- Curriculum vitae of investigators
+- Normal laboratory values
+- Certifications (lab, equipment)
+- Decoding procedures for blinded trials
+- Monitoring plan
+- Sample labels
+- Instructions for handling investigational products
+
+**During trial:**
+- Updates to investigator's brochure
+- Protocol amendments and approvals
+- Continuing IRB review
+- Informed consent updates
+- Curriculum vitae updates
+- Monitoring visit reports
+- Source documents
+- Signed/dated consent forms
+- CRFs
+- Correspondence with regulatory authorities
+
+**After trial:**
+- Final report
+- Documentation of investigational product destruction
+- Samples of labels and labeling
+- Post-study access to investigational product (if applicable)
+
+### Investigator Responsibilities
+
+**Qualifications:**
+- Qualified by education, training, and experience
+- Has adequate resources
+- Has adequate time
+- Has access to subjects
+
+**Compliance:**
+- Conduct trial per protocol
+- Obtain IRB approval before trial
+- Obtain informed consent
+- Report adverse events
+- Maintain essential documents
+- Allow monitoring and auditing
+- Retain records
+
+**Safety reporting:**
+- Immediately report SAEs to sponsor
+- Report to IRB per requirements
+- Report to regulatory authority per requirements
+
+### Source Documentation
+
+**Source documents:**
+- Original documents, data, and records
+- Examples: hospital records, clinical charts, laboratory notes, ECGs, pharmacy records
+- Must support data in CRFs
+
+**Source data verification (SDV):**
+- Comparison of CRF data to source documents
+- Required by monitors
+- Can be 100% or risk-based sampling
+
+**Good documentation practice:**
+- Contemporaneous (record in real-time or soon after)
+- Legible
+- Indelible
+- Original (or certified copy)
+- Accurate
+- Complete
+- Attributable (signed/initialed and dated)
+- Not retrospectively changed without documentation
+
+**Corrections to source:**
+- Single line through error
+- Reason for change
+- Date and initials
+- Original entry still legible
+- Never use correction fluid/whiteout
+- Never obliterate original entry
+
+### Record Retention
+
+**Minimum retention:**
+- 2 years after last approval of marketing application (US)
+- At least 2 years after formal discontinuation of clinical development
+- Longer if required by local regulations
+- 25 years for some countries (e.g., Japan for new drugs)
+
+**Documents to retain:**
+- Protocols and amendments
+- CRFs
+- Source documents
+- Signed informed consents
+- IRB correspondence
+- Monitoring reports
+- Audit certificates
+- Regulatory correspondence
+- Final study report
+
+## FDA Regulations
+
+### 21 CFR Part 50 (Informed Consent)
+
+**Elements of informed consent:**
+1. Statement that study involves research
+2. Description of purpose, duration, procedures
+3. Experimental procedures identified
+4. Reasonably foreseeable risks or discomforts
+5. Benefits to subject or others
+6. Alternative procedures or treatments
+7. Confidentiality protections
+8. Compensation and treatments for injury (if >minimal risk)
+9. Who to contact for questions
+10. Statement that participation is voluntary
+11. Statement that refusal will involve no penalty or loss of benefits
+12. Statement that subject may discontinue at any time
+
+**Additional elements (when appropriate):**
+- Unforeseeable risks to subject or embryo/fetus
+- Circumstances of study termination by investigator
+- Additional costs to subject
+- Consequences of withdrawal
+- New findings that may affect willingness to participate
+- Approximate number of subjects
+
+**Documentation:**
+- Written consent required (unless waived)
+- Copy provided to subject
+- Subject or legally authorized representative must sign
+- Person obtaining consent must sign
+- Date of consent
+
+**Vulnerable populations:**
+- Children: Parental permission + assent (if capable)
+- Prisoners: Additional protections
+- Pregnant women: Additional protections for fetus
+- Cognitively impaired: Legal representative consent
+
+### 21 CFR Part 56 (IRB Standards)
+
+**IRB composition:**
+- At least 5 members
+- Varying backgrounds
+- At least one scientist
+- At least one non-scientist
+- At least one member not affiliated with institution
+- No member may participate in review of study in which member has conflicting interest
+
+**IRB review criteria:**
+- Risks minimized
+- Risks reasonable in relation to benefits
+- Selection of subjects equitable
+- Informed consent obtained and documented
+- Data monitoring when appropriate
+- Privacy and confidentiality protected
+- Additional safeguards for vulnerable populations
+
+**IRB review types:**
+- Full board review
+- Expedited review (certain categories of minimal risk)
+- Exempt (certain categories)
+
+**Continuing review:**
+- At least annually
+- More frequent if determined by IRB
+- Review of progress, new information, consent process
+
+**Documentation:**
+- Written procedures
+- Meeting minutes
+- Review determinations
+- Correspondence
+- Retention of records for 3 years
+
+### 21 CFR Part 312 (IND Regulations)
+
+**IND requirements:**
+- Investigator's Brochure
+- Protocol(s)
+- Chemistry, manufacturing, and controls information
+- Pharmacology and toxicology information
+- Previous human experience
+- Additional information (if applicable)
+
+**IND amendments:**
+- Protocol amendments
+- Information amendments
+- Safety reports
+- Annual reports
+
+**Safety reporting:**
+- IND safety reports (7-day and 15-day)
+- Fatal or life-threatening unexpected: 7 days (preliminary), 15 days (complete)
+- Other serious unexpected: 15 days
+- Annual safety reports
+
+**General investigational plan:**
+- Rationale for drug or study
+- Indications to be studied
+- Approach to evaluating drug
+- Kinds of trials planned (Phase 1, 2, 3)
+- Estimated duration of study
+
+## EU Clinical Trials Regulation (CTR)
+
+**EU CTR 536/2014** (replaced Clinical Trials Directive 2001/20/EC)
+
+**Key requirements:**
+- Single submission portal (CTIS - Clinical Trials Information System)
+- Single assessment by multiple member states
+- Transparency requirements (EudraCT database)
+- Public disclosure of clinical trial results
+- Layperson summary of results required
+
+**Timelines:**
+- Assessment: 60 days (Part I), additional time for Part II
+- Substantial modifications: 38 days
+- Safety reporting: Within specified timelines to EudraVigilance
+
+## Good Documentation Practice (GDP)
+
+### Principles
+
+**ALCOA-CCEA:**
+- **A**ttributable: Who performed action and when
+- **L**egible: Readable and permanent
+- **C**ontemporaneous: Recorded when performed
+- **O**riginal: First capture of information (or certified copy)
+- **A**ccurate: Correct and truthful
+
+Additional:
+- **C**omplete: All data captured
+- **C**onsistent: Chronological sequence, no discrepancies
+- **E**nduring: Durable throughout retention period
+- **A**vailable: Accessible for review when needed
+
+### Data Integrity
+
+**MHRA (UK) data integrity guidance:**
+- Data governance (ownership, quality)
+- Risk assessment
+- Change management
+- Training
+- Regular audit
+
+**Common data integrity issues:**
+- Back-dating of records
+- Deletion or hiding of data
+- Repeat testing without documentation
+- Transcription errors
+- Missing metadata
+- Inadequate audit trails
+
+---
+
+This reference provides comprehensive guidance for regulatory compliance in clinical reports and clinical trials, including HIPAA, FDA regulations, ICH-GCP, and EU requirements. Ensure all clinical documentation adheres to applicable regulations.
+