As consumers of medical care, we depend on the ability of public health regulators to create an environment in which companies are properly incentivized to develop safe and effective products. In the United States, the Food and Drug Administration (FDA) is the regulatory body with primary responsibility for ensuring that only safe and effective prescription drugs and medical devices are permitted entry into commerce. FDA’s premarket approval or review processes can be burdensome, but overall, US healthcare providers, patients, and insurers all depend on the integrity of that review process. That is why the issue of data integrity – both in the context of clinical trial data collected to support evidence of product safety and efficacy, and in the context of manufacturing data, collected to support evidence of strength, purity, and quality (and thus also safety and efficacy) – continues to be a focus of FDA inspections and enforcement. Increasingly, plaintiffs lawyers, state attorneys general, and even the Department of Justice, are focusing on data integrity problems in actions based on product liability, false claims, or false or misleading marketing practices. A common emerging theme in such controversies is the premise that the trial sponsor ignored negative safety or effectiveness signals, or manipulated statistical analyses, leading to a suppression of information about product limitations. In some instances, allegations have been raised about whether products or specific indications should even have been approved by FDA in the first place.

Clinical data integrity is certainly not a new topic, but it is one that has become critical for product manufacturers, vendors who support clinical trials (such as Contract Research Organizations or "CROs"), and clinical researchers themselves. Human clinical research continues to be the most expensive part of drug and device development and as a result, manufacturers are relying on increasingly internationalized and decentralized networks of researchers and trial subjects in an attempt to collect data in the most cost-effective and expedient manner. Developing healthcare markets can offer treatment-naïve subjects which can help more readily show separation between placebo effects and study treatment benefit. Such markets also often have lower overhead costs — research institutions, their employees, and local labs and other necessary providers generally charge lower rates than their counterparts in the US and Europe. Further, in some of these markets the profit motive and ethical motive can align. In some cases, research subjects in these markets can later benefit from access to new and more advanced therapies than may previously have been available to them, assuming the research is successful. However, from a regulatory compliance standpoint, this move towards "internationalization" of research compounds risks that were already present in the domestic US or European research markets.

FDA regulations make clear that clinical trial sponsors need not conduct all aspects of a trial themselves. This regulatory flexibility is what makes it possible for many companies, large and small, to muster the resources to conduct time-consuming, highly technical, and expensive interventional research without operating their own research centers and employing their own research staff. The sponsor may delegate almost every aspect of trial conduct to contracted institutions, researchers, and CROs. That same research sponsor entity may be – and often is – the subsequent regulatory sponsor of a marketing authorization application to FDA based, in part, on the data collected through such research. Ultimate responsibility for the quality of the data – including assurance that the data are collected in compliance with current Good Clinical Practices (cGCPs) – falls on the regulatory sponsor, even if that entity properly delegated the conduct of the supporting clinical research to other parties. So too can regulatory liability if delegations are not properly executed and overseen. Through a series of complex contractual relationships and site monitoring, most established companies have developed a blueprint of best practices for clinical trials in the US and Europe. However, as globalization becomes a cost-saving necessity – as discussed earlier – the decentralization of investigators, subjects, and vendors themselves introduces new data quality and regulatory compliance challenges. This article identifies three of those challenges and provides some practical tips on how to manage those challenges.

The integrity of the data generated from a clinical trial depends on consistent, accurate, and reliable conduct at each clinical trial research site, consistent with the protocol, study plan, and cGCPs. Increasingly sponsors are relying on CROs or other vendors to handle study site management, including site selection, site contracting, patient enrollment, site oversight, and aspects of data management. This is particularly true for companies that may not have "boots on the ground" in the markets where they are conducting their trials – e.g., India, China, Eastern Europe, Latin America, etc. While such outsourcing is permitted by FDA regulations, sponsors must understand the regulatory and compliance risks that arise from such activity. For example, does the CRO contract create sufficient incentives for CRO staff to prioritize oversight and management of your particular study? Are payment milestones tied not only to speed and enrollment metrics but also quality? Does the sponsor perform audits of the CRO’s data flow – essentially, monitoring the monitor – or is the sponsor relying on the CRO to show it what is important?

Many common cGCP deficiencies relate to recordkeeping – these generally can be remedied by the sponsor if they are caught in time. Unfortunately, certain types of recordkeeping issues, such as document falsification, cannot be caught unless there is real-time monitoring of a site, and sufficient knowledge of each site’s practices. In some instances, sponsors may not even realize there is a significant issue with a site until it is uncovered by an FDA inspection, which can lead to a harder submission review process by FDA. There is no substitute for real-time data analysis, and recent FDA guidance has made clear that risk-based monitoring approaches must evolve and adapt to the data integrity and cGCP risks in a particular trial. More than even 100 percent site monitoring, sponsors must ensure they have a risk-based monitoring plan in place, and sufficient understanding of the FDA regulations to know what corrective measures need to be taken if there are deviations that require a rethinking of the plan. For this reason, both the CRO contract, and the contract with each study site must be carefully reviewed by regulatory experts to ensure that incentives align with quality based on the risks that the sponsor has identified in that particular study. Templated or generic monitoring plans can be a roadmap for disaster.

Effective data management is also critical to successful and compliant data collection. In recent FDA Complete Response letters, the Agency has cited sponsor data management deficiencies as the basis for exclusion of certain safety or effectiveness data, or denial of an application. The data management plan should be viewed not only as a practical method for mapping the flow of data from the site to the sponsor and CRO but also as a method for demonstrating compliance with FDA standards for cGCPs and data integrity. For example, in the event there is a question about the data collected from a particular site, a sponsor will want to be in a position to demonstrate that it created clear expectations for data collection quality by communicating data management roles and responsibilities to all relevant participants in a trial (e.g., company statisticians, clinical operations teams, CROs, other vendors, PIs, etc.). Because data integrity issues sometimes do not arise until after a trial is completed – at which point it is often too late to correct a problem – the data management plan creates a contemporaneous record of compliance expectations that can be shared with FDA if questions come up during a New Drug Application review. For this reason, sponsors should make sure that the data management plan, like the protocol, is clearly written, defines roles and responsibilities in a pragmatic way, and is updated to reflect the actual practice among the stakeholders involved in the trial. Sponsors’ compliance personnel should also be attuned to data management issues in their internal auditing activities.

Finally, for studies with potentially significant safety risks, sponsors are looking to data monitoring committees (DMCs) to catch safety signals before they jeopardize an entire trial or the asset being studied. The value of the DMC comes from its independence. However, as a practical matter, the DMC needs to have access to data – often on a rolling or interim basis – to be able to act as an effective reviewer of potential safety signals. This can lead to the very practical challenge of managing data flow in a way that data comes from the site to the DMC without introducing bias into the study. In guidance, FDA has made clear that irreversible bias can occur when a sponsor’s trial statistician is the one who is responsible for collecting and sharing unblended data with the DMC. Can the statistician ever "unknow" what she has seen when it comes time to analyze the final locked data from the study? Remember that the burden of providing data from "adequate and well-controlled" studies includes the requirement that data collection and analysis methodologies were designed to minimize bias. As a result, the protocol, study plan, and the data management plan for a study with a DMC must be developed to anticipate these challenges. The statistician and other staff "exposed" to interim or rolling data from a trial must be properly segregated from those sponsor staff who are involved in the conduct and post-lock analysis of the trial data. The DMC charter should make clear which sponsor or CRO staff are the DMC’s points of contact, to avoid inadvertent disclosures that could add bias into the study.

The challenge of ensuring the integrity and quality of data from a clinical study is one that sponsors have been dealing with for decades. However, as human drug and device trials become more complex, and the conduct of the actual trial becomes several steps separated from sponsors, it is incumbent upon sponsors to review their trial and CRO oversight practices, their management of data flow, and their procedures governing DMCs, to ensure that they are discharging their responsibilities in a compliant manner. A failure to do so can lead to significant reputational consequences, including loss of a valuable asset, and even regulatory and enforcement risks. This is particularly true for companies that are preparing to enter the US market for the first time, or for companies that are using data from trial sites in developing countries where they intend to rely heavily on CROs as their "eyes and ears."


*Mahnu Davar is a Partner at the law firm of Arnold & Porter LLP