IRB Review of Virtual Trial Technologies

Our webinar IRB Review of Decentralized Trial Technology proved so popular, we thought a deeper dive would be appropriate. In this post we explore some key issues IRBs face when reviewing research that includes virtual trial technology. Watch the entire webinar on-demand here.

IRB Responsibility

Before delving into IRB considerations, we should emphasize the regulatory criteria at 21 CFR 56.111 (FDA) and 45 CFR 46.111 (OHRP/Common Rule) which IRBs apply to determine if research can be approved. With this in mind, let’s highlight two approval criteria which bear particular importance when IRBs review research involving virtual trial technologies.

Will the Technology Produce Reliable Data?

21 CFR Part 56.111(a)(6) and 45 CFR Part 46. 111(a)(6) – “Where appropriate, the research plan makes adequate provision for monitoring the data collected to ensure the safety of subjects.” [emphasis added]

IRBs are charged under 111(a)(6) with “ensuring” participant safety. A tall order. The IRB must be able to fundamentally “trust” the data being monitored as part of the protocol’s data safety monitoring plan. These plans take many forms befitting the nature of the research, from simple study staff verification to full-blown independent data safety monitoring boards. However, all plans share an assumption that the measurement data is accurate and can be trusted. With virtual trial technology, the IRB  should ensure that how data is captured will not impact the accuracy of the data. Indeed, in some circumstances, data captured virtually may well be more reliable and accurate than data reported in a participant diary.

Consider blood pressure (BP) readings, a commonly collected data point and safety/outcome measure: Clinic-grade BP monitoring devices are FDA approved, routinely calibrated and inspected, and typically used by a trained operator in a controlled setting. They engender trust in the consistency and accuracy of the data they generate, and we rely on that data for safety monitoring. A blood pressure app on a smart phone might be similarly accurate. Yet having a participant buy a blood pressure machine and record the readings raises the risk of error from both a failure to correctly use the blood pressure cuff as well as record the readings.

IRBs should ask sufficient questions about the virtual trial technology to determine how it will produce reliable, consistent data that is fit for purpose.  Mobile medical applications (MMAs) and other measurement devices approved as medical devices by the FDA have a high confidence level. Software and devices which are “home grown” by the researcher without adequate testing or computer software validation may need more scrutiny or safeguards.

The IRB should review the technology through the lens of “adequate” per the regulations. What is “adequate” for measuring and monitoring BP in a study assessing outcomes of diet and exercise may be very different from a Phase III interventional drug study where BP is a critical outcome measure or adverse event criteria.

Are the Confidentiality Risks Known and Adequately Disclosed?

21 CFR Part 56.111(a)(7) and 45 CFR Part 46.111(a)(7) – “Where appropriate, there are adequate provisions to protect the privacy of subjects and to maintain the confidentiality of data.” [emphasis added]

Virtual cloud storage, encryption levels, data transmission protocols, back-up data locations, and privacy settings on the participant’s personal device all have an impact on the IRB’s required evaluation.  Unless the IRB understands these issues and receives sufficient information about the technology being utilized, it is difficult to evaluate protocols against the 111(a)(7) regulatory standard of “adequate provisions.”

Similar to how IRBs can rely on FDA approval of an MMA, IRBs can look to various industry certification standards to gain comfort that a particular virtual trial application has adequate provisions. Applications with HITRUST or ONC certification for instance should provide a high confidence level that privacy and confidentiality protections are integrated into the application. On the other hand, non-validated open-access data collection software may deserve more scrutiny. Also, virtual trial technologies that rely on the participant’s own device (e.g., bring your own device) may need additional provisions, as the participant’s device settings may inadvertently impact confidentiality.

In addition to determining the technology contains adequate provisions for privacy and confidentiality, the IRB must also ensure the technology’s reasonably foreseeable risks are appropriately disclosed in the consent (21 CFR 50.25[a][2]/45 CFR 46.116[a][2]). There may be increased risk associated with cloud data storage in other countries; for instance, IRBs must  ensure the consent discloses the extent to which confidentiality will be maintained (21 CFR 50.25[a][5]/45 CFR 46.116[a][5]). In the paper modality IRBs could rely on locked cabinets; with virtual trial technology the consent must explain complex concepts like encryption and cloud storage in terms a participant can understand.

How Can IRBs Prepare for Increased Use of Virtual Trial Technologies?

Simple — experts! Treat the evaluation of these technologies the same way you would approach scientific expertise on the IRB. Many organizations find the appropriate expertise in their information security officers. If your IRB does not have access to sufficient expertise to evaluate the risks associated with these rapidly expanding technologies, consider sending the review to an independent IRB that does.

Summary

COVID-19 is rapidly changing the way research is conducted. One of the biggest changes is the move from traditional face-to-face interactions toward remote visits, remote data collection, and other virtual trial approaches. It is critical for IRBs to understand how these technologies work, their risks, and how risks are communicated to participants. Virtual trial technology usage will increase as we accelerate the recovery, but the regulations governing IRB criteria for approval of research and the underlying ethical considerations have not changed.

Back to Resources