Protecting patient privacy

As an important move towards greater transparency in the life science sector, plans by the European Medicines Agency (EMA) to create a public database of clinical research findings stem from a two-fold aim - to enable secondary analysis by other researches, and to increase public trust by allowing them unprecedented access to the clinical trial data.

EMA Policy 0070 was established to provide guidelines and processes for this, with a strong focus on how life science companies should protect the privacy of trial participants. With the EU’s new General Data Protection Regulation (GDPR) now imminent, the impetus for life science firms to cement their data management strategies has further increased. Initiatives by other regions such as North America around the external publication of clinical findings provide an additional driver for improving approaches to managing outward-facing information.

Lessons learnt

Early attempts by companies to fulfil Policy 0070 requirements have left a lot to be desired. Firms have commonly defaulted to redacting public-facing content - where any clues to people’s identities are simply blocked out. Yet the value of a heavily redacted clinical study report (CSR) is questionable.

In the main, redaction is a laborious and largely manual process too. With other anonymisation methods, several priorities can be addressed simultaneously:

• The delivery of higher-value output
• Strong measures to protect patient privacy (information is simply hidden in plain sight)
• Accurate risk measurement
• Support for process automation.

Indeed, EMA is encouraging companies to move away from document redaction towards other data anonymisation approaches.

Effective approaches

Drawing on our work with an extensive range of pharmaceutical companies, while preparing more than 20 Policy 0070-compliant submissions, Kinapse has discerned some optimal compliance approaches that others can
learn from.

1.  Understand where this is going

Policy 0070 is an evolving requirement, so the most effective strategies will be those that take into account longer-term requirements - as well as what is being demanded of firms now.

Policy 0070 was first introduced in January 2015, with guidance on CSR anonymisation published in March 2016, and the first submission made public that October. Phase 2 of Policy 0070, which will require that life science companies provide anonymised copies of all of their clinical trial data, is coming down the line, albeit that currently there isn’t a known timeline for this next stage. It is something companies should prepare for nonetheless, as it will require a more systematic and repeatable process than most companies have in place currently.

2.  Buy yourself time

Don’t wait to start planning how to tackle document anonymisation. Once companies submit a marketing authorisation application to EMA, the guidance specifies that they should ideally take no more than 180 days to provide the equivalent anonymised content for the designated EMA portal, where anyone can look at it. Four and a half months might sound like a long time, but it isn’t really. While there are about 100 different ways we can address a company’s anonymisation needs for a given submission package, those options are reduced the closer firms are to the public submission’s deadline. The tightest time frame Kinapse has worked to so far has been two months - although we still delivered as planned, this was far from ideal.

3. Be realistic about the scale of the task and what will be required

Life science companies of all sizes have quickly realised that EMA Policy 0070 compliance is not something they can easily manage themselves. The requirements are still very new, so expertise and experience is hard to come by.  It’s also easy to underestimate the need for communication  and collaboration between  different stakeholders to arrive  at what’s needed.

Where firms have tried to fulfil their own requirements internally, they have generally become unstuck - forced to rely on manual redaction, without any quantitative risk assessment or way of measuring and demonstrating success. The entire process is slow and cumbersome, and for each new document they must start from scratch. Ensuring consistency is an additional challenge. And as EMA encourages more sophisticated forms of anonymisation, companies could find themselves having to justify why they have defaulted to the lowest-value option in terms of preserving data utility.

It is likely that ultimately the majority of Policy 0070 compliance work will be outsourced to specialist service providers, because it will make no sense for companies to try to do it themselves.

Using a specialist service provider offers greater efficiency and reliability, not least through the chance to centralise activities. It is probably also the best route to accessing enabling technology and tools - including smart algorithms/machine learning, which over time produce faster and more accurate results by building on each anonymisation cycle.

Anonymisation methods geared to de-identification generally rely on IT to maintain data integrity, measure and manage risk, and provide auditable evidence of measures that have been taken. These techniques can deliver benefits starting at 60% improvements in time and cost efficiency compared to non-technology-enabled anonymisation processes.

Managed service providers will also keep abreast of data security as they process documents, keeping companies compliant with GDPR and other data safeguarding measures. For clinical trial sponsors, this all adds up to the lowest risk and most efficient option for managing compliance.

4. Don’t view redaction as the definitive solution

Other than in exceptional cases, defaulting to redaction as a strategy is a false economy. It is not in the spirit of clinical data transparency and it adds the least value for everyone concerned. As international requirements dovetail with EMA’s ambitions, and as Policy 0070 enters its next phase, redaction’s limitations will be exposed. This will mean that any money spent on redaction processes and work now will not count, and companies will have to invest afresh in alternative anonymisation strategies.

Keep in mind that EMA has now established a dedicated anonymisation taskforce to help sponsors come up with ideal methods and techniques for maintaining data utility.

5. Choose your compliance  partner carefully

Once companies have accepted the need for professional help, they will need to decide what kind of outsourced service is appropriate for their requirements. Some service providers offer advisory services, but not the practical operational delivery - and vice versa. Some are light on technology; others focus too much on technology, to the detriment of human quality control. So there is
a balance to be struck.

The optimum combination is likely to be an end-to-end service that can take companies on the whole journey, and ensure nothing
is left to chance.

Stay focused

Undoubtedly, the demands of EMA Policy 0070 are considerable. But putting off the inevitable or cutting corners is not recommended. The costs and pain will merely end up being greater. A better strategy is to retain a clear sense of purpose - that greater goal of transparency, increased public trust and accelerated clinical breakthroughs - which key stakeholders can
buy into.