This article first appeared on the website of the Healthcare and Life Sciences Law Committee of the Legal Practice Division of the International Bar Association, and is reproduced by kind permission of the International Bar Association, London, UK. © International Bar Association.
The spread of the COVID-19 epidemic has led to a rethink of many activities in various sectors. New systems of interaction are being designed that can minimise physical contact between people, favouring, where possible, the use of digital tools.
The field of clinical trials is no exception; indeed, the urge to adapt the regulations in force to the needs dictated by the coronavirus led the Italian Medicines Agency (Agenzia Italiana del Farmaco or AIFA) to provide specific indications for the management of clinical trials in Italy in addition to those relating to COVID-19, in the context of the health crisis (in a Communication published on 12 March 2020, and then updated on 7 April). These exceptional measures are closely linked to the state of emergency declared by the Council of Ministers and will be valid until further notice.
The indications of AIFA
As a general remark, AIFA stressed that the conduct of clinical trials must be managed according to common sense principles, ensuring maximum protection of the participants in the studies as well as adequate supervision by the principal investigators. Secondly, specific aspects of clinical trials were examined in depth to identify possible exceptions to the normal regime in order to ensure the possibility of submitting new trials (or substantial amendments) and to manage activities already underway while containing the risk of virus infection and spread.
Some of the indications provided by AIFA offer interesting ideas to partially rethink the current discipline of clinical trials under a digital perspective, even beyond the emergency context. Particular weight is given to:
- measures related to the relationship between the sponsor and the investigational centre for the monitoring of clinical trials; and
- measures applicable to the relationship with enrolled subjects.
With regard to the latter, AIFA allows the possibility of carrying out some procedures directly at the patient’s home (eg, clinical procedures that cannot be carried out otherwise or therapies that cannot be administered by the enrolled subjects themselves). It also permits using digital tools for remote communication with subjects and for issuing informed consent for both the trial and the processing of personal data.
Monitoring of clinical trials by the sponsor: exceptional measures and new perspectives
According to the Communication, visits by the sponsor for the in situ monitoring of clinical trials could pose a risk to all subjects involved in the trial, so the sponsor should draw up a risk evaluation plan and implement an action plan, taking into account the need to reduce unnecessary contact. In this sense, the Communication encourages the use of centralised monitoring – a system that provides remote evaluation of the data being accumulated, performed in a timely manner, supported by appropriately qualified and trained persons such as data managers, biostatisticians etc (ICH-GCP-6, point 5.18.3) in possession of the appropriate qualifications according to data protection regulations. This can be achieved through different levels of automation: data can be entered manually or through automatic links, and their analysis can be entrusted to advanced algorithms, including artificial intelligence.
If it is not possible to use this method or to postpone a local visit, AIFA allows the use of exceptional and alternative measures for the purpose of source data verification, such as telephone contacts or videoconferences with trial site staff. Temporary access to patient data contained in the electronic health records of the healthcare facility is also allowed, provided that:
- such a measure is justified in order to protect the rights and well-being of the trial subjects;
- a clear procedure is drawn up and agreed upon with all subjects involved; and
- the respective data protection officers are consulted in advance.
The use of remote source data verification to address emergency contingencies is also provided in the guidelines published by the European Medicine Agency (EMA) and the Food and Drug Administration (FDA) on how to conduct trials during the epidemic. In providing specific guidance on the implementation of such remote monitoring measures, the authorities highlighted some key issues, such as:
- the location and security of the IT resources used;
- the need to inform the subject involved in the study and to adequately train all those who will carry out the monitoring;
- the implementation of systems to ensure that the sponsor cannot make local copies of the documents subject to verification and, in particular, of electronic health records; and
- the identification of specific procedures that may vary depending on whether the monitoring includes the drafting by site staff of documents with pseudonymised data, a video verification process or remote access to electronic health records.
This push toward the use of telematic monitoring in an emergency context could encourage the choice of a digital approach to clinical trial risk oversight into the future. However, this requires significant effort in terms of study management and implementation of platforms capable of collecting, transmitting, and, where appropriate, analysing data accurately and securely.
It also requires paying no small amount of attention to the processing of personal data of the subjects involved in the trial: the use of a third-party provider for the implementation and management of the platform requires careful assessment of both the data flow and the roles to be played by the different individuals involved in the processing. With regard to the latter point, the provider will tend to be the data processor; therefore, the sponsor will have to ensure that it is actually able to meet the requirements of Article 28 of the General Data Protection Regulation (GDPR), especially in relation to security measures, while taking into account the particularly sensitive type of data processed and the characteristics of the technology used. Once a suitable provider has been identified, it will be necessary to enter into a data processing agreement as expressly required by Article 28 of the GDPR in order to outline specifically the delegated processing and the obligations with bearing upon it.
Management of study participants: remote communications and telematic consent
In order to limit physical contact between the subjects enrolled in the trial and the staff in charge of managing it, telephone or video calls may be used, in accordance with the Communication, to allow the exchange of all the information that will no longer be provided in person.
A documented record must be kept of communications of any kind made by such means. The staff in charge could take written notes on the content of the communications, ensuring a balance between the need to record the information provided and the principle of data minimisation (Article 5 of the GDPR), especially in relation to exceptional measures implemented to respond to needs requiring immediate resolution.
Looking to the future, remote communication could be implemented as a routine mode (where clinically possible) as part of a broader digitisation program that allows for the design of a robust technological structure capable, for example, of recording conversations or even automatically identifying only relevant information by limiting the amount of data recorded. The implementation of such a system would require considerable technical effort given the large number of participants involved, the extension of the timeframe in which recordings will take place and the potential use of third party services to carry out this activity. Data protection implications will also have to be considered in terms of identifying the legal basis for processing, implementing the principle of privacy by design and the data retention duration.
The adoption of telematic procedures for the exchange of information with subjects involved in a study not only touches on the subject of periodic communication but also relates to a crucial step in the trial, namely obtaining informed consent. AIFA indicates the use of telephone contacts, followed by confirmation emails or validated electronic systems as alternative measures for the collection of consent, although the written consent of the enrolled subject must be obtained at the center once the health risk has subsided. In case of subjects in isolation, cameras or photographs of the documentation taken through isolation barriers may be used.
The Communication also mentions the possibility of collecting explicit consent for the processing of personal data by digital means, provided that the data controller implements appropriate measures to prove that valid consent has been obtained, such as a voice recording or email. The European Data Protection Board (EDPB) provides a more detailed overview of the possibilities for expressing valid explicit consent to the processing of personal data by digital means in the Guidelines on Consent under the GDPR, as updated on 4 May 2020. The data subject can make such a declaration by:
- filling out an electronic form;
- sending an email;
- uploading a scanned document with their signature; or
- using an electronic signature.
Reference is also made to the possibility of explicit consent obtained by telephone conversation, provided that the information about the choice is fair, intelligible, and clear. Specific confirmation from the data subject is still required.
Implementation of new digital tools for clinical trials
The measures envisaged in the Communication provide an opportunity to rethink certain organisational aspects of clinical trials not only in order to cope with the current emergency, but also to implement new technological systems to be used for the long term.
Clearly, the indications provided by AIFA are characterised by urgency and by the attempt to exploit the potential offered by technology to respond immediately to contingent needs, without including such tools in a large-scale digitisation program. However, the Communication has the merit of drawing attention to the possibility of making a digital leap in clinical trials by implementing projects solid and extensive enough to go beyond the emergency context.
From the point of view of the protection of personal data, it is always necessary to take into consideration a series of requirements and assessments whenever there is an intention to modify processing or introduce more processing, especially when technologically advanced tools are used to carry out the processing. In the case of clinical trials, the data processed will be mainly special categories of data, which require heightened protection and specific analysis.
The controller will have to assess the risk deriving from the processing, considering the means used and the type of data, as well as adapting the security measures already in place or implementing new ones. As a result of this assessment, the controller should also consider the appropriateness (if not the mandatory requirement) of carrying out a data protection impact assessment (DPIA) under Article 35 of the GDPR, or, as the case may be, of adapting a DPIA that has already been carried out. Changes to all aspects of the processing will have to be reflected in the processing record.
Concerning the digitisation of clinical trials themselves, the AIFA indications regarding informed consent obtained electronically are particularly interesting. Although the Communication provides a provision on derogation and exceptions associated with the request for written consent from enrolled subjects as soon as they do go to the centre, it could lead the way to a complete digitisation of the process (where considered appropriate on a case-by-case basis and in consideration of the patient’s condition). This would need to use a system sufficiently verified to guarantee the genuineness and validity of the consent given electronically without the need for further confirmation at the centre.
