Patient privacy regulations and Part 11: How do they relate?
In the world of clinical trials, we are constantly reminded of national privacy regulations and 21 CFR Part 11 restrictions when using electronic means to submit medical imaging data. National regulations (NRs) include the European Union Directive on Data Privacy, The Canadian Personal Information Protection and Electronic Documents Act (PIPEDA), HIPAA, OECD and their equivalents in other parts of the world.
Typically NRs have focused on ensuring that patient information is consistent within health records, and that identifying information remains private and protected when documents are transferred between healthcare providers. When it comes to imaging, the DICOM format and its transfer protocol, were both carefully defined to ensure that individual patient’s information is unique, that the record remains consistent across transfers, and that the data cannot be easily altered.
Part 11 and all its predicate rules, as well as other similar regulations, are, in a way, more drastic in the way they direct the management of subject information. Some of the rules are explicitly stated in the regulation, and others are based on specific interpretations. One of the ways in which NRs and Part 11 differ is in the depth of detail at which they each address the problem. Specifically, while NRs define the do’s and don’ts, giving users significant latitude in the way they are implemented, Part 11 is significantly more detailed. The regulation not only defines what is permissible, but it also establishes how constraints must be implemented.
There’s another way to think about it. NRs clearly define the consequences of violating the rules, while in addition to the consequences, Part 11 stipulates key elements of how systems must be built to minimize or eliminate the possibility of violations. Anyone working in clinical trials is well-acquainted with concepts such as trace matrices, design documents, test scripts, validation states and critical/major/minor findings. We all expect and indeed host dozens of routine audits throughout the year, and all our engineering and support activities pivot around the need to maintain a robust quality system in place. The requirements to de-identify not just DICOM tags but also any image pixels that spell out patient identifying information, makes image collection and QA systems significantly more complex.
There is no question that a violation of NRs is a grave infraction with far reaching consequences to the patient(s) whose data was wrongfully released. At the same time, a Part 11 violation may have serious consequences to entire patient populations, who may be exposed to compounds whose true effectiveness may have been compromised by the way in which clinical trial data was handled.