Compliance Today - October 2021

Ongoing monitoring program

Not all research compliance programs are going to consist of all the elements discussed here, although the vast majority of them will, or should, have an ongoing monitoring program. This program can be presented as a quality assurance review of ongoing human subject research, or it can be presented as an audit program. In our experience, the monitoring program is received much more positively when it is presented as a quality review process that is intended to be collaborative and educational between research compliance, the investigators, and study teams. Using terminology like “auditing” can seem punitive and create a defensive posture from all parties involved.

Quality review programs for human subject research should evaluate the institution’s research against good clinical practice principles^[2] to ensure the safety and well-being of human subjects and research finance/billing compliance to determine whether the research procedures are being properly billed to the sponsor, subject’s insurance, or government payers.^[3] Quality review visits can be a complete review of a research protocol, or it can focus on one specific element such as informed consent, eligibility, or billing.

Your ongoing monitoring plan will change over time, but it will serve as a solid go-to plan. When developing your monitoring plan, there are several things to consider. Since you are not going to be able to monitor all studies in your portfolio, you will want to evaluate a good mix of your ongoing studies to get a handle on your overall compliance picture. Some of the criteria to consider when choosing studies for your monitoring plan are: 1) studies with the highest risk; 2) investigators with a track record of noncompliance; and 3) protocols with a high likelihood of being audited by federal or other external agencies, such as protocols with high enrollment, a previous unsuccessful audit, or a high-profile national study.

Operations buy-in (for monitoring program)

When the research compliance team is ready for the initial review on the research program, we recommend having a discussion with the research operations/clinical leaders to determine the investigator, study, or site to complete a validation review. By engaging the clinical team prior to engaging the principal investigator, the operations and compliance team will be able to eliminate any kinks in the review. The research clinical team is a valuable resource to assist with understanding institutional culture and empowers this team to be able to address any questions that the principal investigator has during a review, therefore building a relationship of trust and partnership. The reviews are a joint effort to build a strong program, not searching for a laundry list of punitive marks.

Conflict of interest

The research compliance program should be identifying and managing conflicts of interest (COIs) of investigators and study staff as well as the institution. COIs can manifest as equity in or compensation from industry sponsors. Policies and procedures should clearly indicate the thresholds set by the institution for such interests and ensure they are in line with regulatory agencies’ requirements.^[4] Some institutions allow separate thresholds for various regulatory agencies, others set the bar at the most conservative requirement for all research, and yet others have a zero tolerance for conflicts and require disclosure for conflicting interests of any amount. In addition to equity and compensation, there are also conflicts of commitment. In addition to the research compliance office, conflicts of commitment may also need to be managed by the medical staff office, dean’s office, or human resources.

Research compliance should have a process to develop and monitor management plans for investigators who have conflicting interests. This process is typically separate from the annual disclosure required by most universities and healthcare systems. Some institutions use software systems to manage research COIs, while some track these conflicts using a spreadsheet that gets updated frequently. Many institutions also assign a COI officer and/or a COI management committee that will make decisions about the management of COIs.

In addition to investigator and study team COIs, there is also institutional COI. Institutional COI can come in the form of start-up companies supported by the institution or financial interests related to patents, tech transfer, license agreements, investments in companies conducting research at the institution, or gifts to the organization when the donor has an interest in the research. The COI officer/committee will need to be kept up to date with institutional interests to identify and manage these types of interests.

Scientific misconduct

If your institution is receiving federal grant(s) for research, the Public Health Service regulations require that you have policies and procedures for management of scientific misconduct that meets their requirements.^[5] The Office of Research Integrity offers templates for these policies and procedures on its website.^[6] These policies and procedures must include a process to deal with allegations of misconduct, a process to conduct an inquiry, and a process for a formal investigation. Annual reporting of scientific misconduct to the Office of Research Integrity is required from any institution that is a direct awardee or a subawardee of federal grant funds.

Privacy and security

As with any medical encounter or procedure, research procedures are subject to HIPAA Privacy and Security rules, and there are special considerations when research is involved.^[7] A privacy board must review requests for waivers of HIPAA authorization when a protocol calls for the capture of private health information without the subject’s consent. While some institutions have a separate privacy board, most institutions have the institutional review board, whether internal or external, serve as the privacy board. Other considerations include the use of limited data sets and data use agreements.

Research compliance will need to ensure that the standards of the Security Rule are met, which includes administrative safeguards (policies and procedures, education and training, disciplinary procedures, audits and monitoring); physical safeguards (barriers, computer and physical protections, encrypted files, locked files and doors); and technical safeguards (account provisioning, passwords, logging out, information services audits). Much of this can be reviewed for compliance during a quality review visit.

Biosafety

The biosafety program manages the risks associated with: 1) infectious agents and toxins from natural sources or clinical isolates, 2) biological toxins manufactured for clinical or research purposes, 3) recombinant and synthetic nucleic acid molecules, 4) genetically modified microbes or animals, and 5) human gene transfer products.^[8] Some institutions have their own biosafety program and committee, while others outsource this responsibility to an external committee.

Research compliance should ensure that the institution either has policies and procedures and an adequate program for this area or a documented plan to outsource this responsibility.

Export controls

Institutions that conduct or collaborate in research with foreign individuals/entities must comply with export control regulations. This includes export of oral, written, electronic, or visual disclosure or shipment, transfer, or transmission of goods, technology, services, or information to anyone outside of the US, a non-US entity, or a non-US individual (regardless of location).^[9] Export controls apply not only to the shipping or personal delivery of technology, information, or funds outside of the US, but also to the deemed export or disclosure of technology or information to a foreign entity or foreign national on US soil. Examples of “deemed exports” include: 1) tours of laboratory spaces, 2) research involvement, 3) hosting observers or other types of visitors in laboratory or research space, or 4) through discussions or lectures of sensitive research.

Export controls are governed by the U.S. Department of Commerce’s Export Administration Regulations,^[10] U.S. Department of State’s International Traffic in Arms Regulations,^[11] and U.S. Department of the Treasury Office of Foreign Assets Control.^[12]

Research compliance should ensure that the institution has adequate policies, procedures, and processes to manage compliance with export control regulations.

Animal research

Institutions that have an animal research program are governed by four main laws/requirements: 1) U.S. Government Principles for the Utilization and Care of Vertebrate Animals Used in Testing, Research, and Training,^[13] 2) Animal Welfare Act,^[14] 3) Public Health Service Policy on Humane Care and Use of Laboratory Animals,^[15] and 4) Guide for the Care and Use of Laboratory Animals.^[16] Institutions that conduct animal research must have an institutional animal care and use committee. This is the committee that reviews and approves, or denies, animal research protocols submitted for review.

Research compliance should ensure that the institution has an adequate program for the review and conduct of animal research protocols and that all facilities and procedures meet the regulatory requirements for animal research.