@pikaa-ai/pikaa 0.2.4 → 0.3.0

package/skills/clinical-reports/references/privacy_and_deidentification.md

@@ -0,0 +1,84 @@
+# Privacy and De-identification
+
+This reference documents a review process. It is not legal advice, a technical de-identification service, or evidence of HIPAA compliance.
+
+## HHS framework
+
+HHS guidance under 45 CFR 164.514(b) describes two methods:
+
+1. **Expert Determination** — a person with appropriate knowledge and experience applies generally accepted statistical and scientific principles and documents that re-identification risk is very small under the anticipated conditions.
+2. **Safe Harbor** — specified identifiers are removed and the covered entity has no actual knowledge that remaining information could identify an individual.
+
+A local script cannot perform Expert Determination, establish “no actual knowledge,” or decide whether an organization is a covered entity or business associate.
+
+## Safe Harbor identifier categories
+
+The responsible privacy professional must review the exact regulation and HHS guidance. The categories include:
+
+1. names;
+2. geographic subdivisions smaller than a state, subject to the specific ZIP-code rule;
+3. date elements more specific than year directly related to an individual, plus the age rule for persons over 89;
+4. telephone numbers;
+5. fax numbers;
+6. email addresses;
+7. Social Security numbers;
+8. medical record numbers;
+9. health-plan beneficiary numbers;
+10. account numbers;
+11. certificate or license numbers;
+12. vehicle identifiers and serial numbers;
+13. device identifiers and serial numbers;
+14. URLs;
+15. IP addresses;
+16. biometric identifiers;
+17. full-face photographs and comparable images;
+18. other unique identifying numbers, characteristics, or codes.
+
+Removal of obvious patterns is insufficient. Initials, partial identifiers, metadata, free text, rare events, small cells, unusual dates, images, and combined quasi-identifiers may still identify a person.
+
+## Minimum necessary
+
+HHS states that covered entities generally take reasonable steps to limit uses, disclosures, and requests for PHI to the minimum necessary for the purpose. HHS also lists exceptions, including certain treatment disclosures, disclosures to the individual, authorized uses/disclosures, uses/disclosures required for HIPAA administration, HHS enforcement, and uses/disclosures required by law.
+
+Do not apply the phrase mechanically. The responsible privacy/legal reviewer determines scope, exceptions, authorization, waiver, limited-data-set rules, and any more protective law or policy.
+
+## Local process
+
+1. Define purpose, recipient, authority, jurisdiction, and data class.
+2. Exclude fields not needed for the purpose.
+3. Keep source records in the authorized system; use field-path references and hashes in the draft workspace.
+4. Select Safe Harbor, Expert Determination, or a documented synthetic/aggregate-data rationale through the responsible reviewer.
+5. Review structured fields, free text, attachments, images, headers, filenames, metadata, and linked data.
+6. Review combinations and small-cell/rare-case risk.
+7. Record actual-knowledge review or Expert Determination documentation as applicable.
+8. Verify access controls, storage, transmission, retention, and deletion under organizational policy.
+9. Obtain privacy/legal/institutional approval for the intended disclosure.
+10. Re-review after every content, recipient, or purpose change.
+
+## What the checklist does
+
+`assets/deidentification_process_checklist.json` and `scripts/check_deidentification.py` verify that required process fields are documented. They deliberately:
+
+- do not scan patient free text;
+- do not output detected identifiers;
+- do not label a document `COMPLIANT`, `SAFE`, or `DEIDENTIFIED`;
+- do not substitute for Expert Determination or legal review;
+- remain blocked when required human review is missing.
+
+The strongest successful result is `PROCESS_DOCUMENTED_REVIEW_REQUIRED`.
+
+## Consent and authorization
+
+Publication consent, research consent, HIPAA authorization, IRB/Privacy Board waiver, and permission to use an image are distinct. Do not infer one from another or generate a stock assertion.
+
+Record only the status and local documentation reference verified by the responsible human. Never store a signed consent form or direct identifier in this skill’s assets, tests, or example manifests.
+
+## Incident handling
+
+If real PHI is unexpectedly present:
+
+1. stop processing;
+2. do not echo, copy, transform, or upload it;
+3. preserve only the minimum operational information needed under policy;
+4. notify the authorized privacy/security contact through the institution’s process;
+5. do not independently determine breach status or notification duties.

package/skills/clinical-reports/references/professional_review.md

@@ -0,0 +1,78 @@
+# Professional, Ethical, and Human Review
+
+## Accountability
+
+Automation may organize verified facts but cannot assume professional accountability. A named, qualified human must review each domain and take responsibility in the authorized system.
+
+The ICMJE Recommendations, updated January 2026, retain four authorship criteria: substantive contribution; drafting or critical review; final approval; and accountability for accuracy and integrity. Writing assistance alone does not confer authorship. An AI system cannot be an author or approve a manuscript.
+
+## Research ethics
+
+The World Medical Association states that the **2024 Declaration of Helsinki** is the current official version. It applies to medical research involving human participants, including identifiable material or data, and emphasizes:
+
+- participant rights and interests over research goals;
+- privacy and confidentiality;
+- scientific validity and a documented protocol;
+- independent research-ethics review;
+- informed consent;
+- transparency and reporting.
+
+This skill neither performs ethics review nor determines whether an activity is research, exempt, or authorized.
+
+## Clinical-record confidentiality
+
+AMA Code of Medical Ethics Opinion 3.3.2 states that information recorded in patient care is confidential regardless of form and identifies access restriction, audit capability, security/integrity, retrieval, sharing, third-party access, and disposition as responsibilities for electronic records.
+
+Use institution-controlled systems for real clinical records. Local draft manifests should contain source locators and hashes rather than PHI.
+
+## Required reviewers by artifact
+
+| Domain | Reviewer responsibility |
+|---|---|
+| Clinical case facts | Qualified clinician verifies facts, uncertainty, chronology, and interpretation |
+| Radiology | Qualified radiologist authors findings/impression and communication status |
+| Pathology | Qualified pathologist selects protocol/version and authors diagnosis |
+| Laboratory | Authorized laboratory professional verifies released result, method, status, and corrections |
+| Statistics | Qualified statistician verifies analysis set, estimand, method, denominator, missingness, and output |
+| Safety | Qualified safety professional verifies coding, seriousness, severity, causality, expectedness, and reportability |
+| Privacy/legal | Authorized reviewer verifies data use, consent/authorization, disclosure, de-identification method, and jurisdiction |
+| Regulatory | Qualified professional verifies adopted guidance, regional requirements, format, and submission process |
+| Publication | All accountable authors verify content and current journal instructions |
+
+## Review record
+
+Record:
+
+- reviewer role, not a fabricated name;
+- scope reviewed;
+- source version and data cut;
+- unresolved conflicts and limitations;
+- review date;
+- decision in the authorized workflow;
+- reference to the real sign-off record.
+
+Do not place a signature, license number, direct contact detail, or copied approval document in a synthetic asset.
+
+## Prohibited claims
+
+Never state that a script or checklist proves:
+
+- clinical correctness;
+- HIPAA compliance or de-identification;
+- GCP compliance;
+- CARE, CONSORT, SPIRIT, ICH, ACR, CAP, or CLIA compliance;
+- ethics approval or informed consent;
+- regulatory reportability;
+- readiness for signature, filing, publication, or submission.
+
+Permitted script language is limited to structural findings such as `BLOCKED`, `STRUCTURE_COMPLETE_REVIEW_REQUIRED`, or `PROCESS_DOCUMENTED_REVIEW_REQUIRED`.
+
+## Corrections and conflicts
+
+- Never overwrite a source fact.
+- Keep original and corrected versions linked.
+- Expose conflicting sources and stop dependent claims.
+- Require the responsible reviewer to resolve conflicts in the authorized system.
+- Re-run structural and consistency checks after any correction.
+
+No local script signs, timestamps an approval, files, transmits, or submits an artifact.

package/skills/clinical-reports/references/report_type_routing.md

@@ -0,0 +1,57 @@
+# Report-Type Routing
+
+Select one route before opening a template. Do not merge routes merely because artifacts share clinical data.
+
+## Decision sequence
+
+1. Is the artifact a patient-care record?
+   Stop. This skill does not create SOAP notes, H&Ps, consultation notes, discharge summaries, prescriptions, orders, triage instructions, or signed diagnostic reports.
+2. Is it a single clinical case intended for publication?
+   Use CARE.
+3. Is it a diagnostic-report scaffold controlled by a clinical service?
+   Use ACR, the current specimen-specific CAP protocol, or CLIA as applicable.
+4. Is it a randomized-trial protocol?
+   Use SPIRIT 2025 and applicable extensions.
+5. Is it a randomized-trial results manuscript?
+   Use CONSORT 2025 and applicable extensions.
+6. Is it an integrated report of one clinical study for regulatory review?
+   Use ICH E3 plus E3 Q&A, with ICH E6(R3) and regional requirements as applicable.
+7. Is it individual pre-approval safety information?
+   Route to ICH E2A, E2B(R3), protocol/sponsor procedures, and regional requirements. Do not automate the reportability decision.
+8. Is it individual post-approval safety information?
+   Route to ICH E2D(R1), E2B(R3), marketing-authorisation-holder procedures, and regional requirements. Do not automate.
+9. Is it an aggregate safety table?
+   Use the protocol/SAP, ICH E3, CONSORT Harms when applicable, and the relevant regional aggregate-analysis guidance.
+10. Is it an aggregate research summary?
+    Use the reporting guideline for the actual design and the verified protocol/SAP. Do not imply clinical applicability.
+
+## Route matrix
+
+| Artifact | Base source | Add-ons | Do not substitute |
+|---|---|---|---|
+| Case report | CARE 2013 | CARE 2017 explanation; target journal | CONSORT, CSR, or diagnostic-report rules |
+| Radiology scaffold | ACR 2025 communication parameter | Current modality/program standard and local policy | A generic impression generator |
+| Cancer pathology scaffold | Current CAP protocol for exact organ/specimen | Current biomarker protocol and local policy | A static generic TNM checklist |
+| Laboratory scaffold | 42 CFR 493.1291 for applicable US nonwaived testing | Method, specialty, state, accreditor, and laboratory policy | Hardcoded reference or critical ranges |
+| Trial protocol | SPIRIT 2025 | Current design/data/intervention extensions | CONSORT results checklist |
+| Randomized results | CONSORT 2025 | Current design/data/intervention extensions; CONSORT Harms | SPIRIT protocol checklist |
+| CSR | ICH E3 and E3 Q&A | E6(R3), protocol, SAP, regional submission rules | CONSORT alone |
+| Pre-approval ICSR | ICH E2A and E2B(R3) | Regional law/guidance and sponsor procedure | Aggregate formatter |
+| Post-approval ICSR | ICH E2D(R1) and E2B(R3) | Regional law/guidance and MAH procedure | Pre-approval timing rules |
+| Periodic aggregate safety | ICH E2C(R2), where applicable | Regional periodic-report rules | E2B message schema |
+
+## CONSORT/SPIRIT extension selection
+
+The base statements address standard randomized trials. Check the live official extension catalogue for:
+
+- design: adaptive, cluster, cluster-crossover, crossover, dose-finding, factorial, multi-arm, non-inferiority/equivalence, N-of-1, pilot/feasibility, pragmatic, stepped-wedge, routine-data, or within-person;
+- data: abstracts, harms, outcomes, patient-reported outcomes, surrogate outcomes, equity, and pathology;
+- intervention/population: non-pharmacological, AI, social/psychological, children/adolescents, or other specialty extensions.
+
+Some current extensions were developed against CONSORT 2010 or SPIRIT 2013. Use the current extension with the 2025 base statement, document any conflict, and have a qualified methodologist resolve it. Do not silently renumber or reinterpret extension items.
+
+## Jurisdiction and role gate
+
+ICH Step 4 adoption does not itself prove implementation in a jurisdiction. FDA guidance is generally nonbinding but regulations are legally operative within scope. Institutional policy, protocol, contracts, ethics determinations, and sponsor procedures may add or change duties.
+
+Record the jurisdiction, regulated-product category, responsible role, source version/date, and reviewer before drafting. If any is unknown, mark the route `BLOCKED_UNRESOLVED`.

package/skills/clinical-reports/references/safety_reporting.md

@@ -0,0 +1,109 @@
+# Safety Reporting Boundaries
+
+Safety reporting is role-, product-, phase-, source-, jurisdiction-, and time-dependent. This skill formats verified aggregate counts only. It does not determine seriousness, severity, causality, expectedness, reportability, clock start, destination, format, or follow-up.
+
+## Core distinctions
+
+- **Adverse event (AE)**: an untoward medical occurrence temporally associated with a medicinal product; causality is not required.
+- **Adverse reaction / suspected adverse reaction**: a causal relationship is at least reasonably possible or otherwise meets the applicable regional definition.
+- **Seriousness**: outcome or regulatory criterion such as death, life-threatening experience at the time, hospitalization, disability/incapacity, congenital anomaly, or another medically important event.
+- **Severity**: intensity. A severe event is not automatically serious; a serious event need not be severe in intensity.
+- **Expectedness**: comparison with the applicable reference safety information under the governing procedure.
+
+Only an authorized qualified safety professional may make or approve these assessments.
+
+## ICH routes
+
+### E2A — pre-approval expedited reporting
+
+ICH E2A (Step 4, 27 October 1994) defines standards for expedited reporting during clinical development. It describes minimum information for an initial report and the distinction among serious, unexpected, and suspected reactions.
+
+Do not apply E2A as a universal post-approval rule or encode its timelines without the current regional requirement and sponsor procedure.
+
+### E2B(R3) — ICSR electronic data and message specification
+
+E2B(R3) defines data elements and electronic transmission for individual case safety reports. It covers pre- and post-approval ICSRs within scope. It does not:
+
+- decide whether a case is reportable;
+- define an aggregate safety table;
+- replace E2A, E2D(R1), or regional rules;
+- validate clinical coding or narrative accuracy.
+
+The ICH index listed E2B(R3) Q&As at Step 5 dated 18 July 2025 when checked. Use the current implementation guide, Q&As, code lists, regional implementation guide, and receiving-system rules.
+
+### E2D(R1) — post-approval individual cases
+
+ICH adopted E2D(R1), **Post-Approval Safety Data: Definitions and Standards for Management and Reporting of Individual Case Safety Reports**, on 15 September 2025.
+
+It addresses post-approval ICSR sources and case management, including organized data collection systems, literature, digital platforms, and patient-support programs. It explicitly directs users to:
+
+- E2B for ICSR structure/format/data elements;
+- E2C for periodic aggregate safety reporting;
+- regional/local requirements where they differ.
+
+Do not use the aggregate formatter for an ICSR or use E2D(R1) to invent missing case data.
+
+### E2C(R2) — periodic aggregate reporting
+
+Where applicable, E2C(R2) addresses periodic benefit-risk evaluation reporting. Applicability and regional format require qualified review. Aggregate tables in this skill are display aids, not periodic reports.
+
+## FDA IND safety reporting
+
+For applicable US IND studies, 21 CFR 312.32 controls sponsor IND safety reporting. FDA issued final sponsor and investigator safety-reporting guidances in December 2025. The sponsor guidance includes aggregate-data assessment considerations; the investigator guidance clarifies investigator-to-sponsor and IRB responsibilities.
+
+FDA’s IND safety-reporting page, current 23 June 2026 when checked, states:
+
+- sponsors report qualifying potential serious risks under 21 CFR 312.32;
+- unexpected fatal or life-threatening suspected adverse reactions have a 7-calendar-day outer limit after the relevant sponsor determination/receipt described by the regulation;
+- other qualifying reports generally use the applicable 15-calendar-day requirement;
+- as of 1 April 2026, commercial IND reports under 21 CFR 312.32(c)(1)(i) use FDA AEMS with E2B(R3), with stated exemptions for noncommercial INDs;
+- other categories described on the page use the applicable eCTD route.
+
+This summary is not a reporting clock or filing instruction. The responsible sponsor, investigator, IRB/IEC, and regulatory professionals must consult the current regulation, guidance, protocol, and procedures for each event.
+
+## Aggregate formatter input
+
+`format_adverse_events.py` accepts only aggregate rows:
+
+- analysis set;
+- treatment group;
+- MedDRA version;
+- system organ class;
+- preferred term;
+- subjects affected;
+- event count;
+- denominator.
+
+It also requires a populated `clinical_trial_safety_aggregate_template.json` sidecar
+that records authorization, protocol/SAP/data-cut references, analysis set, counting
+and threshold rules, MedDRA version/language, provenance, and pending human reviews.
+
+It rejects row-level identifiers, verbatim narratives, case IDs, and onset dates. It checks arithmetic and group consistency but does not verify:
+
+- MedDRA term/code validity;
+- coding quality or hierarchy placement;
+- treatment relatedness;
+- seriousness or fatality;
+- analysis-set correctness;
+- deduplication;
+- whether a subject appears in multiple terms or SOCs;
+- statistical inference.
+
+## MedDRA caveats
+
+MedDRA 29.0 (March 2026; transition date 4 May 2026) was current when this skill was refreshed. A report must use the study/sponsor-authorized dictionary version, not automatically the newest version.
+
+State the exact version and language. Terms can change currency, names, or hierarchy across releases; codes can persist through renames. Use licensed official files and MedDRA Points to Consider. A syntax checker cannot validate coding.
+
+## Required handoff
+
+Every aggregate table must disclose:
+
+- analysis set and denominator per group;
+- whether values are subjects, events, or both;
+- MedDRA version and language;
+- counting rules and threshold supplied by the protocol/SAP;
+- missing or suppressed cells;
+- no inferential claim unless separately verified;
+- qualified safety and statistical review required;
+- not suitable for individual-case submission.

package/skills/clinical-reports/references/sources.md

@@ -0,0 +1,75 @@
+# Official Source Ledger
+
+**Research cutoff and access date:** 2026-07-23
+**Method:** targeted `parallel-cli search` restricted to official or primary-source domains, followed by review of returned primary-source excerpts.
+**Use:** source routing and version awareness only. Always verify the live source, jurisdictional adoption, and local requirements before real-world use.
+
+## Case reports
+
+- **CARE Case Report Guidelines — home and current toolkit.** Identifies the 2013 checklist and 2017 explanation. <https://www.care-statement.org/>
+- **2013 CARE Checklist.** Thirteen main reporting items. <https://www.care-statement.org/checklist>
+- **CARE publications.** Primary 2013 statement and 2017 explanation/elaboration references. <https://www.care-statement.org/publications>
+
+## Randomized-trial protocols and results
+
+- **SPIRIT–CONSORT official site.** SPIRIT 2025: 34-item protocol checklist and figure. CONSORT 2025: 30-item results checklist and flow diagram. <https://www.consort-spirit.org/>
+- **CONSORT/SPIRIT extension catalogue.** Current design, data, intervention, and population extensions; catalogue notes which base statement each extension used. <https://www.consort-spirit.org/extensions>
+- **CONSORT 2025 primary statement.** Published 2025-04-14. <https://www.bmj.com/content/389/bmj-2024-081123>
+- **SPIRIT 2025 primary statement.** Published 2025-04-28; states that SPIRIT 2025 supersedes SPIRIT 2013. <https://www.bmj.com/content/389/bmj-2024-081477>
+- **SPIRIT 2025 explanation and elaboration.** Published 2025-04-28. <https://www.bmj.com/content/389/bmj-2024-081660>
+
+## ICH clinical-study and GCP guidance
+
+- **ICH E3 — Structure and Content of Clinical Study Reports.** Step 4, 1995-11-30. <https://database.ich.org/sites/default/files/E3_Guideline.pdf>
+- **ICH E3 Questions & Answers (R1).** Current version dated 2012-07-06; clarifies that E3 is adaptable guidance, not a rigid template. <https://database.ich.org/sites/default/files/E3_Q%26As_R1_Q%26As.pdf>
+- **ICH E6(R3) consolidated final guideline.** Principles, Annex 1, and Annex 2; adopted 2026-06-16. <https://database.ich.org/sites/default/files/ICH%20E6%28R3%29_Step4_FinalConsolidatedGuideline_2026_0616_.pdf>
+- **ICH E6(R3) Annex 2 final.** Adopted 2026-06-03. <https://database.ich.org/sites/default/files/ICH_E6%28R3%29_Annex%202_Guideline_Step%204_2026_0603_0.pdf>
+- **FDA ICH guidance index.** FDA’s current US ICH guidance entry point; verify regional adoption here. Content current 2026-04-16 when checked. <https://www.fda.gov/science-research/clinical-trials-and-human-subject-protection/ich-guidance-documents>
+
+## Safety reporting
+
+- **ICH E2A — Clinical Safety Data Management: Definitions and Standards for Expedited Reporting.** Step 4, 1994-10-27. <https://database.ich.org/sites/default/files/E2A_Guideline.pdf>
+- **ICH E2B(R3) ICSR specification and related files.** Current implementation-guide, Q&A, code-list, and alignment entry point. <https://www.ich.org/page/e2br3-individual-case-safety-report-icsr-specification-and-related-files>
+- **ICH guideline index.** Listed E2B(R3) Q&As at Step 5 dated 2025-07-18 and E2D(R1) at Step 5 dated 2025-09-15 when checked. <https://www.ich.org/page/search-index-ich-guidelines>
+- **ICH E2D(R1) — Post-Approval Safety Data: Definitions and Standards for Management and Reporting of Individual Case Safety Reports.** Adopted 2025-09-15. <https://database.ich.org/sites/default/files/ICH_E2D%28R1%29_Step4_FinalGuideline_2025_0819.pdf>
+- **21 CFR 312.32 — IND safety reporting.** Current eCFR text; verify current effective text and official annual CFR. <https://www.ecfr.gov/current/title-21/chapter-I/subchapter-D/part-312/subpart-B/section-312.32>
+- **FDA IND Application Reporting: IND Safety Reports.** Content current 2026-06-23; includes AEMS/E2B(R3) electronic route effective 2026-04-01 within stated scope. <https://www.fda.gov/drugs/investigational-new-drug-ind-application/ind-application-reporting-ind-safety-reports>
+- **FDA Sponsor Responsibilities — Safety Reporting Requirements and Safety Assessment for IND and BA/BE Studies.** Final guidance, December 2025. <https://www.fda.gov/regulatory-information/search-fda-guidance-documents/sponsor-responsibilities-safety-reporting-requirements-and-safety-assessment-ind-and>
+- **FDA Investigator Responsibilities — Safety Reporting for Investigational Drugs and Devices.** Final guidance, December 2025. <https://www.fda.gov/regulatory-information/search-fda-guidance-documents/investigator-responsibilities-safety-reporting-investigational-drugs-and-devices>
+- **FDA Postmarketing Adverse Event Reporting Compliance Program.** Content current 2025-12-19 when checked. <https://www.fda.gov/drugs/surveillance-post-drug-approval-activities/postmarketing-adverse-event-reporting-compliance-program>
+
+## Privacy and de-identification
+
+- **HHS Guidance Regarding Methods for De-identification of PHI.** Safe Harbor and Expert Determination under 45 CFR 164.514(b); page reviewed 2026-03-20. <https://www.hhs.gov/hipaa/for-professionals/privacy/special-topics/de-identification/index.html>
+- **HHS Minimum Necessary Requirement.** 45 CFR 164.502(b) and 164.514(d), scope and exceptions. <https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/minimum-necessary-requirement/index.html>
+
+## Diagnostic reporting
+
+- **ACR Practice Parameter for Communication of Diagnostic Imaging Findings.** Revised 2025 (Resolution 9). <https://gravitas.acr.org/PPTS/GetDocumentView?docId=74>
+- **ACR Practice Parameters & Technical Standards portal.** Current modality- and program-specific source. <https://gravitas.acr.org/PPTS>
+- **CAP Cancer Protocol Templates.** Current protocol downloads and 2026 change notices; page showed updates through 2026-06-24 when checked. <https://www.cap.org/protocols-and-guidelines/cancer-reporting-tools/cancer-protocol-templates>
+- **CAP Cancer Protocols.** Current scope and synoptic-reporting entry point. <https://www.cap.org/protocols-and-guidelines/cancer-reporting-tools/cancer-protocols>
+- **42 CFR 493.1291 — Test report.** CLIA postanalytic report requirements for applicable testing, including corrected-report handling. <https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-G/part-493/subpart-K/subject-group-ECFR9482366886d579f/section-493.1291>
+- **42 CFR 493.1105 — Retention requirements.** Includes original, preliminary, final, and corrected-report retention provisions within scope. <https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-G/part-493/subpart-J/section-493.1105>
+
+## Terminology
+
+- **ICH MedDRA.** Governance, purpose, and Points to Consider. <https://www.ich.org/page/meddra>
+- **MedDRA English support documentation.** Lists MedDRA 29.0 (March 2026), transition date 2026-05-04, and versioned support documents. <https://www.meddra.org/how-to-use/support-documentation/english/welcome>
+- **MedDRA 29.0 Introductory Guide.** March 2026 hierarchy and version context. <https://alt.meddra.org/files_acrobat/intguide_29_0_English.pdf>
+- **LOINC.** Version 2.82 released 2026-02-24; next release listed for August 2026 when checked. <https://loinc.org/>
+- **SNOMED International licensing.** Member/non-member use and licensing conditions. <https://www.snomed.org/licensing>
+- **NLM SNOMED CT licensing.** US distribution and licensing entry point. <https://www.nlm.nih.gov/healthit/snomedct/snomed_licensing.html>
+
+## Ethics and professional publication guidance
+
+- **WMA Declaration of Helsinki.** Current official version adopted October 2024; previous versions superseded for current use. <https://www.wma.net/policies-post/wma-declaration-of-helsinki>
+- **ICMJE Recommendations.** Updated January 2026; authorship, accountability, participant protection, privacy, and publication practices. <https://www.icmje.org/icmje-recommendations.pdf>
+- **AMA Code of Medical Ethics Opinion 3.3.2 — Confidentiality & Electronic Medical Records.** Electronic-record confidentiality, access, audit, security, integrity, sharing, and disposition. <https://code-medical-ethics.ama-assn.org/ethics-opinions/confidentiality-electronic-medical-records>
+
+## Known source limitations
+
+- eCFR is continuously updated but identifies itself as an unofficial online edition; use the current official annual CFR and legal review when status matters.
+- ICH Step 4 documents require regional adoption/implementation review.
+- Controlled terminologies and professional standards can change after this ledger date.
+- Journal instructions, local policies, protocols, SAPs, contracts, and ethics determinations are not captured here.