Office of Regulatory Affairs

& Compliance

What to Expect During a

Compliance Review

Frank EstalaResearch Compliance Manager

Clara VorpahlSenior Research Compliance Specialist

Office of Regulatory

Affairs & Compliance

26

• Conducts compliance reviews in medical billing and research

• Oversees the Compliance Hotline

• Privacy Officer/HIPAA

• Report to the President’s Office

An Active Monitoring & Auditing Program is

Important For…

• Maintaining participant and staff safety

• Protecting the Institution and the Researchers

• Maintaining data quality

• Protecting funding

• Measuring compliance with regulatory requirements

• Educate

• Process Improvement

OCR Documentation

Standards

Section Document Requirement/Purpose

File

Location

Reference

(GCP and

Local)

Sponsor

Investigator IND/IDE

FDA

Regulated

Non-FDA

Regulated

Non-

Exempt

Human

Research Exempt

ED-1 Protocol

To document investigator and sponsor agreement to the

protocol, amendments and CRFs; and, to document revisions

of trial-related documents that take effect during trial:

• Initial version that the site was registered

• Amendments and Letters of Amendment

• Subsequent versions

• Investigator signature page

Regulatory

binder

• 21CFR312/812

• ICH Guidance:

E6 GCP,

Sections 1.44,

1.45, 4.5, 5.23,

6, 8.2.2, 8.3.2

X X xForm C or

Protocol

IRB

Exempt

Application

ED-2

Protocol

Training

(Training

Log)

Documentation that trial procedures were reviewed with the

investigator and investigator’s trial staff:

• Summary of start-up calls

• Training meetings (Initiation, Implementation, Investigator

Meeting, Teleconference, List of Training Attendees)

Regulatory

binder

• 21CFR312/812

• ICH Guidance:

E6 GCP,

Sections 4.5,

5.23, 8.2.20

AAHRPP Element:

III.2.A; I.1.D;

UTHSCSA IRB

Investigator’s

Handbook

X X x

ED-3

Delegation

Log/

Signature

Log (IRB B-2

Form)

1. To document the signatures of individuals using initials in

place of a full signature to sign CRFs and source documents.

2. To document the signatures and initials of all persons

authorized to make entries and/or corrections on CRFs.

Include all site staff engaged in research,

such as:

• Clinicians

• Physicians

• Pharmacists

• Data personnel

• Any other individuals authorized to make entries and/or

corrections on CRFs.

3. Key/log must include:

• Initials

• Printed Signature

• Legal Signature, including first and last name

• Credentials (if appropriate)

4. To document Principal Investigator delegation of study-

related task to staff. To outline the roles and responsibilities

delegated by the PI to each team member.

Regulatory

binder

• ICH Guidance:

E6

GCP, Section

8.3.24

AAHRPP

Elements: III.2.A;

III.2.B; VHA Policy

Memo 151-07-07;

VHA Handbook

1200.05 62c;

Handbook of

Operating

Procedures ,

Section 5.8.12

X X X X IRB Form

Internal Compliance

Reviews

25

ALL active human research studies are subject to reviews

Why Me?

• Risk-Based*

• At the request of the IRB

• Voluntary

• Triggered by an event or

complaint

28

*Risk Variables• Risks to the Subject

• Risks to the Institution

• The tool is divided into 5 sections

– Protocol Risks

– FDA Risks

– Budget/Billing Risk

– IRB Risks

– PI Risks

30

Protocol Risks

• Trial Phase

• Sponsor Investigator

• Locally Developed Plan

• IRB Risk

• Recruitment Status

• External Monitoring

• Radiation

• Disclosure Outside Covered Entity

• Sensitive Nature of Study

FDA Risk

• Use of an FDA regulated article

Budget Billing Risk

• Billing Medicare or Private Insurance

• Funding

• Subject Payments

IRB Risks

• Vulnerable Populations

• UPIRSO/AE Reporting

• Deviations

• Waivers of Informed Consent

• Use External IRB

• External Reporting (OHRP, FDA)

PI Risks

• PI Research Experience at

UTHSCSA

• PI History of Noncompliance

• PI workload

Collaborative Review Process• Notification letter to PI with review tool

• Entrance meeting/Survey

• Site Visit (usually 2 business days)

• Summarize findings during site visit

• Email follow-up

• Five days to address issues

• Exit meeting with PI to discuss remaining findings in draft report

• Final report of ORA&C Observations

• PI response to findings (sent to IRB)

29

Preparation for Site Visit

ORA&C

• Obtain IRB History

• Review Protocol and Related Docs

• Select Subject Charts for SV

• Location Convenient to PI/Staff

• Work Independently

IRB History

IRB ApprovalsDate of Approval

Approval Type

ICF English Version Approvals

ICF Spanish Version Approvals

Summary of Approval/Amendments Protocol

Investigator Brochure Reconsent

Advertisement Sites

Initial IRB Submission Conditional Approval 29-Jul-14 FB N/A N/A

Initial IRB submission conditional approval. N/A N/A N/A N/A N/A

Initial IRB Submission Final Approval 15-Aug-14 Exp 15-Aug-14 N/A Initial IRB submission final approval.

Dtd 4/23/14

Edition 3.1 Dtd 2/25/14 N/A N/A

UTHSCSA, UHS

Amendment 1 Dtd 9/25/14 1-Oct-14 Exp 1-Oct-14 N/A

Study title updated ZS description to "sodium zirconium cyclosilicate" to be consistent with the US adopted name; increase enrollment from 120 to 200 due to a US FDA request for a less sensitive analysis which necessitated a larger sample size to maintain statistical power; modified the dose stopping rule; removed testing for plasma fasting glucose; administrative changes to correct version and amendment dates. No subjects enrolled to date.

Amendment 1 Dtd 6/27/14 N/A No N/A N/A

Amendment 2 Dtd 10/21/14 27-Oct-14 Exp 27-Oct-14 27-Oct-14

Reduces i-STAT potassium value and provides updates to animal toxicology data; addition of Spanish translated consent form.

Amendment 2 Dtd 10/16/14 N/A No N/A N/A

Amendment 3 Dtd 11/25/14 19-Dec-14 AA N/A 19-Dec-14 Spanish translation. N/A N/A No N/A N/A

PI/Study Team Preparation

• Review OCR Study Doc Standards Policy

• Review ORA&C Tool

• Review Your Records

• Workspace

• Records Readily Available

• Enrollment Logs

• Regulatory Binders (edocs or paper)

• Subject Charts (separate vs together)

• Occasional Check-in

• Schedule Pharmacy Visit

• Promptly Respond to Findings

• Maintain Communication

• Consult with Research Departments

Notification

Entrance Meeting/Survey

Entrance Meeting/Survey

Entrance Meeting/Survey

Site Visit Regulatory Binders

• Sponsor Protocol

• Investigator Brochure

• Form 1572/1571

• Financial Disclosures

• Delegation of Authority Logs

• Initial Protocol/Amendment Training

• Special Procedures Training

• Current CVs & Licenses

• IRB Training/Scopes of Practice

SV Regulatory Binder

Cont.• All IRB Action Letters

– Initial/Contingent Approval

– Amendments

– Progress Reports

– Non-compliance

– UPIRSOs

– Administrative Actions

• Stamped Consent Forms

• Affiliate Approval Letter (UHS, VA)

SV Regulatory Binder Cont.

• Screening/Enrollment Logs

• Investigational Product

Accountability & Temperature Logs

• Labs/Specimens Shipment Records

• Sponsor Safety Reports

• Monitoring Log & Reports

• Case Report Form Templates

• SOP/Manual of Operation

SV Subject Charts

• Signed Consent Form/Reconsents

• Inclusion/Exclusion Checklist

• Laboratory Results

• Test Results (ECG)

• Completed Data Collection Tools

• Medical Records

• Progress Notes

SV Subject Charts Cont.

• Concomitant Medication Logs

• Adverse Event Log

• Deviation Log

• Note to File Explaining

Discrepancies

• Documentation of Payment

What Happens After SV?

• Receive email with issues

• Five business days

• >Five days – issues on draft report

• Coordinate exit meeting

• Post draft report on meeting invite

• Discuss issues during exit meeting

• Receive final signed report via email

• Follow-up with IRB

The Final Report

• PI/Research Coordinator

• IRB (Dr. Kim Summers)

• AVPR (Dr. Joseph Schmelz)

• Affiliate (UHS Research Office, VA

R&D, VA Compliance)

• Department Chair (if warranted)

• Compliance Committee

• UT System

Reviewed Departments

Scope and Number of Observations of Studies Reviewed Degree of Observations Clinical Trial Billing

Regulatory

and

Essential

Documents

Participant

Files/

Informed

Consents

Protocol

Procedures

Study/Source

Documentation

-Case Report

Forms

Pharmacy/

Drug

Accountability

Study/Safety

Monitoring-

Reportable

Events-

UPIRSOs and

Adverse

Events Other

Number

of

Critical

Number

of

Major

Number of

Minor

Total PI/Dept.

Observations

Number of

Studies

Reviewed

Percent

Exception

Rate

Requiring

Refund/Rebil

l

Dept A 1 1 0 0 0 0 0 0 0 2

2

N/A N/A

Dept B 0 0 0 2 0 1 0 0 0 3

3

N/A N/A

Research Observations

Reviewed Department

Regulatory

and Essential

Documents

Participant Files/

Informed Consents

Reportable

Events-

UPIRSOs and

Protocol

Deviations

Study/Source

Documentation-

Case Report

Forms

Pharmacy/Drug

Accountability

Study/Safety

Monitoring-

Reporting Other

Degree of

Observation

Dept A

Legal Authoritive Representative

was not specified on the

Informed ConsentMinor

Dept A

Required sponsor

training was not

documented for

approved study

staff

Minor

Dept B

Adverse Events were

not assessed for Clinical

Significance by the

Principal Investigator

Minor

Dept B

CRF/Study worksheets

were not signed by the

person obtaining the

study informationMinor

Dept B

Inappropriate

corrections were made

to the CRF/Study

worksheets

Minor

Data Trends

Consequences of

Non-compliance

• Safety risk to participants

• Jeopardize reliability of study data

• Negative Publicity

• Fines & penalties

• Legal fees & settlement costs

• Loss of public trust in clinical research

• Suspend research for PI or whole

institution

Consequences of

Non-compliance

24

Focus Areas

&

Common Findings

31

Regulatory Documents

• Submit progress reports to IRB on

time to prevent lapse in approval

• Check progress report for errors

• Comply with reporting requirements

for protocol deviations/adverse

events/UPIRSOs

34

• Check IRB stamp for most current

consent version date

• Fill in signatures & time (AM/PM)

• Obtained by a person approved by IRB

• Evaluate the need for translation

• Document consent process in a

progress note

Informed Consent

35

• Follow your protocol/plan

• Document eligibility for

participation (i.e. use a check list for

inclusion/exclusion criteria)

36

Inclusion/Exclusion

Criteria

Protocol

Compliance

• Follow your protocol/plan

• Visit/Survey Frequency, Study Forms,

Scope of Data, Sites/Locations

• Submit any amendments to the IRB

• Track/document deviations or

missing data

37

Documentation

• Correct data appropriately

• Sign and date forms

• Check for transcription errors from

source documents to database or

case report forms (CRFs) to sponsor

• Keep electronic files on a secure

server and paper documents in a

secure location

38

Investigational Product

Accountability

• Drug dispensing/accountability log

• Maintain temperature/storage log

• Dispense by a person approved by IRB

• Have documentation of instructions for Investigational Product use (dispensing, returning & disposal)

PI Oversight of Study

• Local policies

• Conduct the study as

approved by sponsor and IRB

• Ensure staff is qualified and trained

• Review adverse events and

deviations

• Be ready for monitoring/inspections

40

SELF ASSESSMENT

Practicing Good Clinical

Practice

41

Things change. Be inspection ready!

Used with permission from Don Mayne. Wretched Mess Research Cartoons(2009)

Self Assessment

Basic Questions to Ask:

1. Is it research? Do I need IRB

approval? http://research.uthscsa.edu/irb/forms_NewResearch.shtml

2. What regulations and policies

apply?

3. Am I following the IRB approved

protocol/study plan?

42

Self Assessment

• Request copy of compliance

review tool

• Review the OCR’s Documentation

Standards

• Principal Investigators - Check

participant charts and consent

forms

43

“Quality means doing it right when no one is looking ”

Henry Ford

Good Clinical Practice

• Keep enrollment log up to date

• Maintain regulatory binder/file

• Document, document, document!

• Maintain adverse event and

protocol deviation tracking logs http://research.uthscsa.edu/irb/miscforms.shtml

• Promptly report non-compliance

and UPIRSOs to the IRB

44

• Failure to follow the protocol

• Inadequate and inaccurate records

• Failure to report adverse events

• Failure to report concomitant therapy

• Inadequate drug/device accountability

• Lack of training/qualifications records

• Informed consent issues

• IRB problems (approvals)

Common Findings

9

Regulations & Policies

• FDA Regulations (Title 21 Parts 11,

50, 54, 56, 312, 812)

• The Common Rule (Title 45 Part 46)

• Good Clinical Practice (GCP)

• Sponsor Policies (Industry, HHS)

• IRB / Institutional Policies

• AAHRPP

• HIPAA

3

Privacy & HIPAA – What do

you need to know?

Kathy James

Assistant Compliance Officer

Assistant Privacy Officer

HIPAA Incidents

• Notification to the Privacy Office

(ORAC) of any incident

• IRB will request overview of CAPA

by the Privacy Office

• Information Management Services

will assist in review of data storage

HIPAA Incidents

• Accessing a patient record without

the need to know for your job

(FairWarning audit trail)

• Discussing subject identity in open

areas

• Sensitive study advertisements with

contact email not a “uthscsa” email

domain

• Sending subject identifying data

external in unencrypted email

HIPAA Incidents

• Mobile devices being used to store

subject data not encrypted

– All laptops need encryption-no

university data on personal laptops

– Cell phones with university emails

need to be password protected and

registered with IMS (MDM-Mobile

Device Management)

44

HIPAA Incidents

• Posting subject/patient information

on social media sites, i.e., Twitter,

Facebook, SnapChat, Instagram,

etc.

– More of the 18 identifiers posted than

you think

– Lose of confidence with our subjects

– Reflects badly on the university

HIPAA Incidents

• Storing research data with

subject/patient information on

clouds, i.e., DropBox.

– Clouds not approved by IMS are not

secure

– No automatic back-up and data could

be lost

– Data is not easily retrievable if needed

(no administrator)

Use of Social

Security Numbers

• Required Notices for Disclosure –http://uthscsa.edu/compliance/RequiredNoticeSSN.asp

• Handbook of Operating Procedures –

Section 2.2.7

• Approved Notices for Disclosure –http://uthscsa.edu/compliance/RequiredNoticeSSN.asp

Utilize Resources

• Attend IRB Forums

• Visit IRB, CTO (New Clinical Trial

Office) and OCR websites for

updates, forms, and policies:

http://research.uthscsa.edu/ocr/index.shtml

http://research.uthscsa.edu/irb/

http://research.uthscsa.edu/cto/index.shtml

http://research.uthscsa.edu/ocr/1%203%201%

20Documentation%20and%20Data%20Mngt

%20v2.1%20w%20Matrix.pdf

45

Office of Regulatory

Affairs & Compliance

ORAC Office: (210) 567-2014

Anonymous Compliance Line

1-877-507-7317

http://www.uthscsa.edu/compliance/

Gail Madison-Brown, madison-brown@uthscsa.edu

Kathy James, jameskd@uthscsa.edu

Frank Estala, estala@uthscsa.edu

Clara Vorpahl, vorpahlc@uthscsa.edu

46

Used with permission from Don Mayne. Wretched Mess Research Cartoons(2009)