@synsci/cli-darwin-x64 1.1.97 → 1.1.99

package/bin/skills/clinical-reports/references/regulatory_compliance.md

@@ -1,577 +0,0 @@
-# Regulatory Compliance for Clinical Reports
-
-## HIPAA (Health Insurance Portability and Accountability Act)
-
-### Overview
-
-HIPAA Privacy Rule protects individually identifiable health information (Protected Health Information, PHI). All clinical reports must comply with HIPAA requirements for privacy and security.
-
-### Protected Health Information (PHI)
-
-**Definition:** Individually identifiable health information held or transmitted by covered entities or business associates in any form or medium.
-
-**Covered Entities:**
-- Healthcare providers
-- Health plans
-- Healthcare clearinghouses
-
-**Business Associates:**
-- Third parties providing services involving PHI
-- Require Business Associate Agreement (BAA)
-
-### 18 HIPAA Identifiers
-
-These identifiers must be removed for Safe Harbor de-identification:
-
-1. **Names**
-2. **Geographic subdivisions smaller than state** (except first 3 digits of ZIP if >20,000 people)
-3. **Dates** (except year) - birth, admission, discharge, death
-4. **Telephone numbers**
-5. **Fax numbers**
-6. **Email addresses**
-7. **Social Security numbers**
-8. **Medical record numbers**
-9. **Health plan beneficiary numbers**
-10. **Account numbers**
-11. **Certificate/license numbers**
-12. **Vehicle identifiers and serial numbers**
-13. **Device identifiers and serial numbers**
-14. **Web URLs**
-15. **IP addresses**
-16. **Biometric identifiers** (fingerprints, voiceprints)
-17. **Full-face photographs and comparable images**
-18. **Any other unique identifying characteristic or code**
-
-### De-identification Methods
-
-#### Method 1: Safe Harbor
-
-Remove all 18 identifiers AND have no actual knowledge that remaining information could be used to identify the individual.
-
-**Implementation:**
-- Remove/redact all 18 identifiers
-- Ages over 89 must be aggregated to "90 or older"
-- Dates can keep year only
-- Geographic areas can include state only
-- Documentation that no identifying information remains
-
-#### Method 2: Expert Determination
-
-Statistical/scientific analysis demonstrating that risk of re-identification is very small.
-
-**Requirements:**
-- Performed by qualified statistician or expert
-- Documented analysis methods
-- Conclusion that re-identification risk is very small
-- Maintained documentation
-
-### HIPAA Minimum Necessary Standard
-
-**Principle:** Use, disclose, and request only the minimum PHI necessary to accomplish purpose.
-
-**Exceptions:**
-- Treatment purposes (providers need full information)
-- Patient-authorized disclosures
-- Required by law
-
-**Implementation:**
-- Role-based access controls
-- Purpose-specific disclosures
-- Limited data sets when feasible
-
-### Patient Authorization
-
-**When required:**
-- Uses/disclosures beyond treatment, payment, operations (TPO)
-- Marketing purposes
-- Sale of PHI
-- Psychotherapy notes
-- Research (unless waiver obtained)
-
-**Required elements of authorization:**
-- Specific description of PHI to be used/disclosed
-- Person(s) authorized to make disclosure
-- Person(s) to receive information
-- Purpose of disclosure
-- Expiration date or event
-- Patient signature and date
-- Right to revoke
-- Potential for re-disclosure by recipient
-
-### HIPAA Security Rule (Electronic PHI)
-
-**Administrative Safeguards:**
-- Security management process
-- Workforce security
-- Information access management
-- Security awareness and training
-- Security incident procedures
-
-**Physical Safeguards:**
-- Facility access controls
-- Workstation use and security
-- Device and media controls
-
-**Technical Safeguards:**
-- Access control
-- Audit controls
-- Integrity controls
-- Transmission security
-
-### Breach Notification Rule
-
-**Breach definition:** Unauthorized acquisition, access, use, or disclosure of PHI that compromises security or privacy.
-
-**Notification requirements:**
-- **Individual notification:** Without unreasonable delay, no later than 60 days
-- **Media notification:** If breach affects >500 residents of a state or jurisdiction
-- **HHS notification:** Within 60 days if >500 individuals; annually if <500
-- **Business associate notification to covered entity:** Without unreasonable delay
-
-**Content of notification:**
-- Description of breach
-- Types of information involved
-- Steps individuals should take to protect themselves
-- What entity is doing to investigate/mitigate
-- Contact procedures for questions
-
-### Penalties for HIPAA Violations
-
-**Civil penalties (per violation):**
-- Tier 1: $100-$50,000 (unknowing)
-- Tier 2: $1,000-$50,000 (reasonable cause)
-- Tier 3: $10,000-$50,000 (willful neglect, corrected)
-- Tier 4: $50,000-$1.9M (willful neglect, not corrected)
-
-**Criminal penalties:**
-- Knowingly obtaining PHI: Up to $50,000 and/or 1 year
-- Under false pretenses: Up to $100,000 and/or 5 years
-- Intent to sell/transfer/use for commercial advantage: Up to $250,000 and/or 10 years
-
-### Research and HIPAA
-
-**HIPAA authorization for research:**
-- Specific to research study
-- Describes PHI to be used
-- States that PHI may not be necessary for treatment
-
-**Waiver of authorization:**
-- IRB or Privacy Board approval
-- Minimal risk to privacy
-- Research could not practically be conducted without waiver
-- Research could not practically be conducted without access to PHI
-- Plan to protect identifiers
-- Plan to destroy identifiers when appropriate
-- Written assurances
-
-**Limited data sets:**
-- Remove 16 of 18 identifiers (may keep dates and geographic subdivisions)
-- Data use agreement required
-- Only for research, public health, or healthcare operations
-
-## 21 CFR Part 11 (Electronic Records and Electronic Signatures)
-
-### Scope
-
-FDA regulation establishing criteria for electronic records and electronic signatures to be considered trustworthy, reliable, and equivalent to paper records.
-
-**Applies to:**
-- Clinical trial data
-- Regulatory submissions
-- Manufacturing records
-- Laboratory records
-- Any record required by FDA regulations
-
-### Electronic Records Requirements
-
-**System validation:**
-- Validation documentation
-- Accuracy, reliability, consistent performance
-- Ability to discern invalid or altered records
-
-**Audit trails:**
-- Secure, computer-generated, time-stamped audit trail
-- Record of:
-  - Date and time of entry/modification
-  - User making change
-  - Previous values changed
-- Cannot be modified or deleted by users
-- Retained for records retention period
-
-**Operational checks:**
-- Authority checks (user authorization)
-- Device checks (valid input devices)
-- Education and training
-- Confirmation of intent (e.g., "Are you sure?")
-
-**Record retention:**
-- Electronic copies as accurate as paper
-- Protection from loss (backups)
-- Protection from unauthorized access
-- Ability to produce readable copies for FDA inspection
-
-### Electronic Signatures Requirements
-
-**General requirements:**
-- Unique to one individual
-- Not reused or reassigned
-- Verification of identity before establishing
-- Certification to FDA that electronic signatures are legally binding
-
-**Components:**
-- Unique ID
-- Password or biometric
-- Two distinct components when executed
-
-**Controls:**
-- Session timeout for inactivity
-- Periodic password changes
-- Prevention of password reuse
-- Detection and reporting of unauthorized use
-- Secure storage of passwords
-- Unique electronic signatures (not shared)
-
-**Electronic signature manifestations:**
-Must include:
-- Printed name of signer
-- Date and time of signing
-- Meaning of signature (e.g., review, approval, authorship)
-
-### Closed vs. Open Systems
-
-**Closed system:**
-- Access limited to authorized individuals
-- Within a single organization
-- Less stringent requirements
-
-**Open system:**
-- Not controlled by persons responsible for content
-- Accessible to unauthorized persons
-- Requires additional measures:
-  - Encryption
-  - Digital signatures
-  - Other authentication/security measures
-
-### Hybrid Systems (Paper + Electronic)
-
-**Requirements:**
-- Clear procedures for hybrid system use
-- Maintain record integrity
-- Paper records linked to electronic
-- Cannot delete electronic records after printing
-- Must preserve audit trails
-
-### Legacy Systems
-
-**Grandfather clause:**
-- Systems in use before August 20, 1997 may be grandfathered
-- Must demonstrate trustworthiness without full Part 11 compliance
-- Must validate and document reliability
-- Should have migration plan to compliant system
-
-## ICH-GCP (Good Clinical Practice)
-
-### Overview
-
-International ethical and scientific quality standard for designing, conducting, recording, and reporting trials involving human subjects.
-
-**Purpose:**
-- Protect rights, safety, and well-being of trial subjects
-- Ensure credibility of clinical trial data
-
-**Regulatory adoption:**
-- FDA recognizes ICH-GCP (E6)
-- Required for studies supporting regulatory submissions
-
-### Principles of ICH-GCP
-
-**1. Ethics:** Clinical trials should be conducted in accordance with ethical principles (Declaration of Helsinki, local laws)
-
-**2. Risk-benefit:** Trials should be scientifically sound with favorable risk-benefit ratio
-
-**3. Rights and welfare:** Rights, safety, and well-being of subjects take precedence over science and society
-
-**4. Available information:** Trials should use available nonclinical and clinical information
-
-**5. Quality:** Trials should be scientifically sound and described in clear, detailed protocol
-
-**6. Compliance:** Trials should comply with approved protocol
-
-**7. Qualified personnel:** Trials should be conducted by qualified individuals
-
-**8. Informed consent:** Freely given informed consent should be obtained from each subject
-
-**9. Privacy:** Confidentiality of subject records must be protected
-
-**10. Quality assurance:** Systems with procedures ensuring quality of data generated
-
-**11. Investigational products:** Manufactured, handled, and stored per GMP; used per approved protocol
-
-**12. Documentation:** Documentation systems should allow accurate reporting, interpretation, and verification
-
-**13. Quality management:** Sponsor should implement quality management system
-
-### Essential Documents
-
-**Before trial initiation:**
-- Investigator's Brochure
-- Protocol and amendments
-- Sample CRF
-- IRB/IEC approval
-- Informed consent forms
-- Financial disclosure
-- Curriculum vitae of investigators
-- Normal laboratory values
-- Certifications (lab, equipment)
-- Decoding procedures for blinded trials
-- Monitoring plan
-- Sample labels
-- Instructions for handling investigational products
-
-**During trial:**
-- Updates to investigator's brochure
-- Protocol amendments and approvals
-- Continuing IRB review
-- Informed consent updates
-- Curriculum vitae updates
-- Monitoring visit reports
-- Source documents
-- Signed/dated consent forms
-- CRFs
-- Correspondence with regulatory authorities
-
-**After trial:**
-- Final report
-- Documentation of investigational product destruction
-- Samples of labels and labeling
-- Post-study access to investigational product (if applicable)
-
-### Investigator Responsibilities
-
-**Qualifications:**
-- Qualified by education, training, and experience
-- Has adequate resources
-- Has adequate time
-- Has access to subjects
-
-**Compliance:**
-- Conduct trial per protocol
-- Obtain IRB approval before trial
-- Obtain informed consent
-- Report adverse events
-- Maintain essential documents
-- Allow monitoring and auditing
-- Retain records
-
-**Safety reporting:**
-- Immediately report SAEs to sponsor
-- Report to IRB per requirements
-- Report to regulatory authority per requirements
-
-### Source Documentation
-
-**Source documents:**
-- Original documents, data, and records
-- Examples: hospital records, clinical charts, laboratory notes, ECGs, pharmacy records
-- Must support data in CRFs
-
-**Source data verification (SDV):**
-- Comparison of CRF data to source documents
-- Required by monitors
-- Can be 100% or risk-based sampling
-
-**Good documentation practice:**
-- Contemporaneous (record in real-time or soon after)
-- Legible
-- Indelible
-- Original (or certified copy)
-- Accurate
-- Complete
-- Attributable (signed/initialed and dated)
-- Not retrospectively changed without documentation
-
-**Corrections to source:**
-- Single line through error
-- Reason for change
-- Date and initials
-- Original entry still legible
-- Never use correction fluid/whiteout
-- Never obliterate original entry
-
-### Record Retention
-
-**Minimum retention:**
-- 2 years after last approval of marketing application (US)
-- At least 2 years after formal discontinuation of clinical development
-- Longer if required by local regulations
-- 25 years for some countries (e.g., Japan for new drugs)
-
-**Documents to retain:**
-- Protocols and amendments
-- CRFs
-- Source documents
-- Signed informed consents
-- IRB correspondence
-- Monitoring reports
-- Audit certificates
-- Regulatory correspondence
-- Final study report
-
-## FDA Regulations
-
-### 21 CFR Part 50 (Informed Consent)
-
-**Elements of informed consent:**
-1. Statement that study involves research
-2. Description of purpose, duration, procedures
-3. Experimental procedures identified
-4. Reasonably foreseeable risks or discomforts
-5. Benefits to subject or others
-6. Alternative procedures or treatments
-7. Confidentiality protections
-8. Compensation and treatments for injury (if >minimal risk)
-9. Who to contact for questions
-10. Statement that participation is voluntary
-11. Statement that refusal will involve no penalty or loss of benefits
-12. Statement that subject may discontinue at any time
-
-**Additional elements (when appropriate):**
-- Unforeseeable risks to subject or embryo/fetus
-- Circumstances of study termination by investigator
-- Additional costs to subject
-- Consequences of withdrawal
-- New findings that may affect willingness to participate
-- Approximate number of subjects
-
-**Documentation:**
-- Written consent required (unless waived)
-- Copy provided to subject
-- Subject or legally authorized representative must sign
-- Person obtaining consent must sign
-- Date of consent
-
-**Vulnerable populations:**
-- Children: Parental permission + assent (if capable)
-- Prisoners: Additional protections
-- Pregnant women: Additional protections for fetus
-- Cognitively impaired: Legal representative consent
-
-### 21 CFR Part 56 (IRB Standards)
-
-**IRB composition:**
-- At least 5 members
-- Varying backgrounds
-- At least one scientist
-- At least one non-scientist
-- At least one member not affiliated with institution
-- No member may participate in review of study in which member has conflicting interest
-
-**IRB review criteria:**
-- Risks minimized
-- Risks reasonable in relation to benefits
-- Selection of subjects equitable
-- Informed consent obtained and documented
-- Data monitoring when appropriate
-- Privacy and confidentiality protected
-- Additional safeguards for vulnerable populations
-
-**IRB review types:**
-- Full board review
-- Expedited review (certain categories of minimal risk)
-- Exempt (certain categories)
-
-**Continuing review:**
-- At least annually
-- More frequent if determined by IRB
-- Review of progress, new information, consent process
-
-**Documentation:**
-- Written procedures
-- Meeting minutes
-- Review determinations
-- Correspondence
-- Retention of records for 3 years
-
-### 21 CFR Part 312 (IND Regulations)
-
-**IND requirements:**
-- Investigator's Brochure
-- Protocol(s)
-- Chemistry, manufacturing, and controls information
-- Pharmacology and toxicology information
-- Previous human experience
-- Additional information (if applicable)
-
-**IND amendments:**
-- Protocol amendments
-- Information amendments
-- Safety reports
-- Annual reports
-
-**Safety reporting:**
-- IND safety reports (7-day and 15-day)
-- Fatal or life-threatening unexpected: 7 days (preliminary), 15 days (complete)
-- Other serious unexpected: 15 days
-- Annual safety reports
-
-**General investigational plan:**
-- Rationale for drug or study
-- Indications to be studied
-- Approach to evaluating drug
-- Kinds of trials planned (Phase 1, 2, 3)
-- Estimated duration of study
-
-## EU Clinical Trials Regulation (CTR)
-
-**EU CTR 536/2014** (replaced Clinical Trials Directive 2001/20/EC)
-
-**Key requirements:**
-- Single submission portal (CTIS - Clinical Trials Information System)
-- Single assessment by multiple member states
-- Transparency requirements (EudraCT database)
-- Public disclosure of clinical trial results
-- Layperson summary of results required
-
-**Timelines:**
-- Assessment: 60 days (Part I), additional time for Part II
-- Substantial modifications: 38 days
-- Safety reporting: Within specified timelines to EudraVigilance
-
-## Good Documentation Practice (GDP)
-
-### Principles
-
-**ALCOA-CCEA:**
-- **A**ttributable: Who performed action and when
-- **L**egible: Readable and permanent
-- **C**ontemporaneous: Recorded when performed
-- **O**riginal: First capture of information (or certified copy)
-- **A**ccurate: Correct and truthful
-
-Additional:
-- **C**omplete: All data captured
-- **C**onsistent: Chronological sequence, no discrepancies
-- **E**nduring: Durable throughout retention period
-- **A**vailable: Accessible for review when needed
-
-### Data Integrity
-
-**MHRA (UK) data integrity guidance:**
-- Data governance (ownership, quality)
-- Risk assessment
-- Change management
-- Training
-- Regular audit
-
-**Common data integrity issues:**
-- Back-dating of records
-- Deletion or hiding of data
-- Repeat testing without documentation
-- Transcription errors
-- Missing metadata
-- Inadequate audit trails
-
----
-
-This reference provides comprehensive guidance for regulatory compliance in clinical reports and clinical trials, including HIPAA, FDA regulations, ICH-GCP, and EU requirements. Ensure all clinical documentation adheres to applicable regulations.
-