ICH Revisions: What Sites Need to Know

David Vulcano, SCRS Honorary President, breaks down the recent ICH GCP R6 E3 revisions and explores their practical impact on clinical research sites. He discusses key topics such as the decentralization of trials, updated record retention guidelines, and the rising importance of digital health technologies and cybersecurity. David highlights that, although there’s considerable hype and some uncertainties, the new guidelines generally codify existing practices rather than overhaul them. The episode serves as a practical guide for sites to align their operations with both local regulatory requirements and the updated GCP standards while maintaining an open dialogue with sponsors and CROs.

Transcript

Jimmy Bechtel: 0:00

Hello, everyone. Welcome to the Society for Clinical Research Sites and SCRS Talks. I'm Jimmy Bechtel, the Vice President of Site Engagement with the Society and I'm joined today by David Vulcano, who serves as SCRS's Honorary President, and he is also in leadership position at HCA Healthcare. David often serves, for those of you that are unfamiliar, which I'm sure the list is short, as one of our go to individuals for regulatory updates and some of the things that come out of the FDA. David has a knack and a true talent for helping us understand and interpret these things, and I know many of you rely on David's expertise through the online community. And through some of the sessions at the site solutions summit to provide insight into you know, finance and the changing regulatory landscape. And that's exactly what we're here to do today. We want to talk a little bit and share David's knowledge and what we're able to ascertain from the recent ICH GCP R6 E3 revisions. I know there's been a lot of conversation around this. A lot of discussion and everyone seems to be providing updates here, but we just want to share a little bit of information on how this looks to or maybe will not be affecting and impacting the sites and maybe some of the ways that we might interpret there's a lot of a lot of worry and a lot of hype around this. But as we'll find today there's not much to be worried about. I think as long as we're aware and we know of the changes, right, David, I think we're going to be in good shape.

David Vulcano: 1:29

Yeah, I agree, Jimmy. You know, I think despite all the hype from the vendors that want to sell a lot of education on it, we can take a step and come down a little bit. The direction of this end was not as unanticipated. I mean, the things that the new revisions to the GCPs are directionally we were going in a lot of the stuff we were doing anyway. Now it codifies it in GCPs. Yes. And there will be anxiety. There will be some differing interpretations and things like that will cause some stress and anxiety. Don't get us wrong. It's not a panacea. You know, I don't like the way that it's written. A lot of it is very goal oriented instead of prescriptive and a lot of it is a little nebulous as to who's responsible for what, you know, the compliance walks out there always like to say this is responsible for this person. This is responsible for this activity as opposed to it kind of the more we're all in this together, but, but overall it's directionally in the same direction the industry has been going for a period of time and there should be very little surprises in anybody who actually reads it.

Jimmy Bechtel: 2:30

So thanks, David. Can you kind of dive into that a little bit and share you know, as you've gone through this, what are some of the more significant changes, I guess, if we want to hone in on some of those introduced in the E3 revisions and how those might differ from previous guidelines in terms of an impact, of course, particularly to our site audience.

David Vulcano: 2:49

Yeah, a lot of it is on the back end of sponsors on how to write protocols and risk based monitoring and things along those lines, things that we have seen before and carrying forward, but for the site community while a lot of this is heavily behind the scenes on sponsors, there's a lot of things that do trickle down to the sites. So, you know, first you get really jazzed when you see some of the principles, like, there's a new principle in there that says the sponsor should not place unnecessary burden on participants and investigators. And the sponsor should ensure that sufficient resources are available to appropriately conduct the study. And while we may sit there and applaud this and cite this back to sponsors and their CRO service providers. You know, this is always a struggle that we faced with every day. So it's great to have these lofty type principles, but when it gets down to brass tactics, we're still going to, in my expectation, fight the struggle to reduce unnecessary burden on the sites and fight to get sufficient resources to conduct the studies. So the principles are more outlined there, and maybe we can use that more as defense and advocating for ourselves as sites in getting those. But there's a few key areas that we see. And I don't know, Jimmy, if you want to just kind of shut up one by one. I mean, the three biggest areas I would see that's going to trickle down mostly to the sites is the first a little bit about the decentralization of trials and involving non traditional site partners or service providers into the investigator and site duties, or the decentralization, so to speak. The second is a lot about record retention, changes in that areas. And the third is about a lot of the electronics that are coming out the, so called E thingies or digital health technologies and, kind of part and parcel to all of these as an underlying thread is what I would consider a fourth area that site should be aware of, and that's the emerging importance of implementing cyber security stuff. So decentralized, record retention, digital technologies and cyber. So do you have a preference on where we go first?

Jimmy Bechtel: 4:58

I mean, yeah, whatever you want, David, dive in there. I think a lot of them they all share equal weight, I'm sure for a different sites. So yeah, wherever you want to dive in. Yeah.

David Vulcano: 5:07

Well, let's kind of go in order with it then. Let's talk about the decentralized trials. So obviously, you know, the years since they've been having more and more decentralized trials, there's always been this angst among clinical investigator sites and investigators themselves on oversight of these new team players or new members of our extended team. And key differentiation was a lot of the anxiety of oversight when it comes to a new member that is selected or chosen by the sponsor of the CRO in the study. Well, the GCPs kind of make this a little bit more clear in this it may not be to our liking on it, but it is at least more clear in that, you know, 2.3.1 talks about that if the sponsor is selecting a service provider, that's going to be acting on behalf of the investigator. So, they're selecting a service provider that's doing something that would traditionally be done by the research site, like participant visits or things along those lines. It's clear in 2.3.1 that says the investigator retains the final decision on whether the service provider is intended to support the investigator. So, and it's based on information provided by the sponsor. It's like, Hey sponsor, you got to tell me about this vendor or the service provider that you are hiring. Got to tell me all this stuff and I make the final determination whether I'm going to use them or not. So, great in theory very supportive of its item theories. Of course, it doesn't alleviate the things that many sites have been faced with in the past already of. Thou shalt use that vendor or you will not be allowed to do the study. But nevertheless, it does at least give something for the investigator to stand on and say, you know what? I do have some control on this. I may not be able to do the study, but if I'm doing the study, I can control a little bit about what this service provider is doing. So that's one key within that it talks about, specifically calls out one section 2. 10. 3 on investigational product management. So that's when you know, if the sponsor is taking on that, like direct to shipping of participants, that the investigator is still responsible for that aspects of it. And that was very similar, like in the FDA guidance on decentralized trials. It then goes on to a little bit about the service providers on their quality assurance and their quality management process. The section 3. 6. 10 references that their quality assurance, you know, so many service providers may not be clinical trial specific people. It may have other duties that they're doing or other businesses that they're in, but are called to help with trials and that their quality management process may not be designed specifically for GCP compliance. But it is fit for purpose in the context of the trial. And that term fit for purpose is something we see a lot in the new GCPs. We'll be hearing that term a lot. And then similar to that, they talk about the use of Healthcare practitioners. And we have the same problem in the GCPs as we did in the F. D. A. Draft guidance on whether or not these people are delegated authority or are they sub investigators or not? And at least in the new GCPs. Section 2.3.3 talks about in situations where the activities are performed as part of clinical practice, they don't need to be on any type of delegation documentation, but they don't define what clinical practice is. So it gets into that nebulous training that was so problematic with the FDA guidance on this as to, you know, if the protocol says you have to take the blood pressure from the right arm and your normal practices, you give them a choice. Is that a violation? Or, you know, if you normally give the patient a choice between getting the EKG first before the blood draw, but the protocol requires it. So it still gets into the little nebulous stuff there. And then the other part is the verifying of identities. And this is new where it talks about the investigators obligation. And this is in 2. 8. 1 E. That's when they are doing informed consent, whether in person or remotely. That's kind of a new obligation on the investigator to assure themselves of the identity of their participants or the legally authorized representative in accordance with whatever regulatory standards you might have on verifying identity. And that could vary from country to country, even state to state. So some of this decentralization is having some of those challenges.

Jimmy Bechtel: 9:26

Yeah, well it's interesting David because these are things that we've been talking about and have kind of had big question marks over the top of them for the last few years that it comes to decentralization and the oversight and really everything that you talked about, this idea right kind of piggybacking on the DHT guidance, digital health technologies guidance around that concept of what is clinical practice does not need to be delegated. It can just be conducted. So, it's obvious that the lines are still a little blurry here. It kind of just says, this is what it is, but it obviously is going to be left up to your interpretation by the sponsor and the site. But at least to me, it's a step in the right direction. Cause it does, like you said previously kind of ratify. Some of the things that we've been doing and some of the assumptions that we've been making and hopefully providing an additional little layer of clarity for investigators around their power and their ability to make those decisions and what is and what isn't. So I guess, If we were to tell sites anything about this and, kind of add on to this, David in this space here, it's form SOPs and opinions or positions on these interpretations and implement them consistently across your organization but also make sure that you're on the same page going into a trial with your sponsor or CRO based on those SOPs, which should of course always be based in ICH GCP. And that will probably set you up for success as a site as it pertains to these DCTs.

David Vulcano: 10:54

Yeah, yeah. So definitely focus on those sections and recognize your obligation as a site and an investigator. If you're in the trial, it shows that you do have a little bit of control on this, but you have to be in the trial. And if the stance of the sponsors of CROs are, you know, I mean, many sites use the word that they're bullied into using this particular service. You can't use this if you want to be in the trial, you have to use this, well, the new GCPs doesn't make that concept go away, but what it does do in theory, empower the investigator once they're in the trial that they do have a little bit more autonomy with it.

Jimmy Bechtel: 11:28

That's great. Would you want to jump to the next one then david?

David Vulcano: 11:32

Yeah, sure record retention and as you know, Jimmy

Jimmy Bechtel: 11:35

An area of passion for you.

David Vulcano: 11:37

Yeah, it has been and as a society we've been gathering data on this because this is something that is just getting more and more problematic for sites because especially with the shift from paper to electronic records you know, we're not record archivists, we're not in this business and it's vastly more complicated than throwing a whole bunch of paper in a box and shipping it to a third party vendor and essentially forgetting about it. But yeah, so a little bit of whirly gigs in the record retention. I mean, first and foremost, the original R2 of GCPs was talking about for, we'll talk about the duration the record retention first, and then we'll talk about the new challenges in this new environment, which the GCPs are calling out. So the duration was one thing. I mean, R2 was talking about the floating two year thing of, two years after approval or withdrawal, et cetera, among any of GCP abiding countries. Well, they did away with that. And they're basically now saying that you will keep the records per your local applicable regulatory requirements. So if you're U.S. You keep for FDA. If you're in Canada, you keep for Health Canada. If you're in EU, you keep for EMA regulations. That is the core and it's not trying to say that you have to keep for you know based off of every regulations. If EU is 25 years well that no longer kind of applies to me as the site because it's talking about your applicable regulatory requirements. So I was celebrating reading that but then unfortunately they kept the second caveat, which basically says, and this is in 2. 12. 12. Required record retention, in accordance, with applicable regulatory requirements or until the sponsor informs the investigator that these records are no longer needed, whichever is the longest and that's been creating so much of the anxiety with the sites. I mean, as you know, based on our surveys slightly over two-thirds of the sites do not want to be in the record record archiving business. Only a third are wanting to explore that this is a value add to to the customers, but two thirds don't want to be in this. We'll keep per regulatory obligations, but we don't want to get longer and it's getting more complicated. So that new sentence there is interesting because it's basically puts it in the market forces. So the other sections of the new GCPs require an agreement at 3. 6. 3 says the sponsor must have an agreement. In the agreement about the record retention period per regulatory requirements or longer, if informed by the sponsor. We're still faced with the core problem, but it does at least give the sites a little bit more grounding, I would say, in going back to sponsors and saying, look, we're keeping per our regulatory requirements for our local institution. So you can't really impose other regulatory requirements, but if we're going to enter into the business of record archiving you know, address it now in the contract. If we're not going to do it, let's not leave it open ended. But if we are going to do it, then let's understand what we have to do. So let's go to that second part for the sites that want to be in the record archiving business. Very carefully read these sections in the GCPs Because it talks a lot about the obligations of the site especially, and we'll talk a little bit about the cyber security stuff too. But, read out and call out that you have to understand. So the, I'll mention some of this. So, the sites are supposed to notify. So the essential records collection of and this is in 4. 2. 7. The trial data and relevant metadata should be archived in a way that allows for retrieval and readability and should be protected from unauthorized access and alterations throughout the retention period. And when we talk about cybersecurity, you're going to learn a little bit more about what that entails. So it's going to be still some negotiations between the sites and the sponsors on this. I mean, the good news is that we don't have a, global mongerer of the global record retention requirements. But nevertheless, this is part of it. So like the sponsor, in addition to getting this into an agreement and making sure it's addressing agreement, which it almost already is, they added a new sponsor requirement that the sponsors monitors have to confirm the arrangement for the retention of the essential records during the site closeout activity. So that's something if it hasn't been done that we can expect to sites that they will do. And that's a great time to bring it up to the sponsors and say, we're not capable of doing this. Ideally, it's in the beginning, but at the closeout visit, it could be saying we're not capable of doing this. We don't have the hardware degradation plans in place. We don't have the software obsolescence management and things along those lines. A little bit of a positive here doesn't fully alleviate the challenge. But nevertheless, I think this is a great opportunity with these new GCPs to really enhance our discussions with sponsors and CROs applaud the ones that are taking this monkey off of the site's burden when they want the records for their business needs after the site's regulatory obligations are done, you know, we're seeing more and more of those sponsors. Take on those obligations, but for the ones who aren't and believe that the sites should be the ones. To be their record archivist after the site's regulatory allegations are over, I think this is going to be a great resource to have those discussions and ground these discussions into reality.

Jimmy Bechtel: 16:50

That's exactly right, David. And that's the important takeaway that I get from this is, you know, as a site again. Similar to what we talked about with the DCT related guidances there and technology use on clinical trials is as a site, know what your regulations are, know what your local regulatory obligation is and design your SOPs around that and at trial startup, make sure that the sponsors and CROs are aware of that. And if there's any pushback on that or they're requiring anything outside of that, then it's up to the site to decide whether or not they want to. I guess facilitate that and enable that additional requirement. However, that should also be compensated appropriately at the site level. If it's going to be something above and beyond regulatory requirements, one can make the argument that all of that needs to be paid for, which I would be in support of, but at minimum, the site can say, this is our SOP. It's based on what the GCP guidance says. Current GCP guidance says this is what our regulatory obligation is for our X state in X country, and therefore this is what we'll be doing. And if you have anything outside of that it's up for interpretation and negotiation at the site level.

David Vulcano: 17:57

And this revision kind of probably not intentionally, but nevertheless appropriately puts that in the realm of business terms so that it's no longer, oh, well, GCP requires it for all these regions and EU is this and that, and Japan is this and that. It's you know, local regulatory requirements, which you should know. And then after that, put it in the business terms. within it. So I don't think it was intentionally done that way, but it does at least put it back into the business terms between the site.

Jimmy Bechtel: 18:26

That's perfect. Yeah, I couldn't agree more. Well, David do you want to jump to the cybersecurity aspect of it then?

David Vulcano: 18:32

Yeah. So, you know, a lot of the electronic stuff we've been used to moving over to it's the one thing in deploying the technology, I mean, before we jump to that cyber, we want to talk about deploying the technology and the new revisions of the GCPs does do it's appreciated that they do call out a little differentiating obligations between whether that technology is deployed by the investigator or institution or whether that technology is deployed by the sponsor and essentially calling out that, he or she who deploys the technology is the one responsible for making that technology meets all the new standards that of data and data integrity that the new R3 of the GCP is put forth. I mean, those of you that know this, there's a whole new section about data integrity in this R3 and, you know, sites that are deploying their own technology need to understand those. So that could be one of the bigger impacts, at least initially on the sites to make sure that they have determined that the technology that they deploy is fit for purpose based off of these new GCP standards, which are all in essentially section four of the new GCPs. It talks about you know, the provided to trial participants by the investigator. That's the participants, whether it's deployed by the sponsor or the investigator institution that the participants that it's traceable and that they're provided with appropriate training. And, things along those lines. So fit for purpose is used multiple times in this, whether it's sponsored deployed tech, investigator avoid, tech used by the participants, or just general supportive technology, not applied specifically for a trial, but something that is used in general, like say, electronic medical records is what they call out, that it is assessed for fitness of purpose. And the new GCPs talks about in, section 316. 1 subpart six, talks about The tech that's used to deploy by the investigator that the sponsor has some obligation to assess whether such systems are fit for purpose. So that's kind of a new exchange that we'll have to see how sponsors get with this. Now jump into the, one last thing on that section 437 A. Talks about, well, you know, if there are technology, it says there should be mechanisms such as help desk support in place to document, evaluate, and manage the issues when computerized systems are used and periodic review of these issues. So if sponsors are deploying to tech, they're responsible for this section four and they're responsible for the help desk support. If the sites are deploying to tech, same principles apply. Now, the cyber issue key, and we're pleased to say that we had authored and published out a site manager's non technical guide to cybersecurity on a budget for some of the smaller sites out there that are not part of a large system with a lot of cybersecurity resources. But nevertheless, when you're thinking about deploying technology or retaining records during or even after your regulatory support, you know, read this It's it's going to be scary for people when you look at this about mitigating security breachers, user authentication, password management, Antivirus software, security patching, system monitoring, penetration testing, backup of the data, Disaster recovery. All of these things that you know, your average site may not be savvy enough. So you know, cyber security is not an IT Issue. It's everybody's issue of which IT is one component. I think sites over the next couple of years are going to be very awakened as to how serious everything is on cyber security.

Jimmy Bechtel: 22:10

Oh, that's exactly right, David. And I appreciate you mentioning the guide that we had provided to, which I hope a lot of sites that are concerned about this. Or even if you don't think you're concerned about it should be concerned. And really take this into attention do something about it. And for the sake of time, David I'd like to kind of close us out with a sharing of what sites should do and then how sponsors and CROs can support sites in implementing these revisions. So that we continue to be collaborative and we continue to be seamless. And for me, my big takeaway from the conversation was as sites, Take some of these things as well as some of the other things that we've mentioned and that others are mentioning and make sure that you have the appropriate SOPs and procedures and policies in place that support GCP and support your site, enabling that GCP and stick to those and have that open line of communication with the sponsors and CROs at study inception so that we know when these things come to a head, that we're not scrambling to put them in place or not trying to create something on the fly and build these SLPs in and then sponsors and CROs. It's reciprocal, right? We have to be able to accept these things and say, okay, yeah, that's great. That is in conformity with GCP. And we've also done our work to not overextend or overburden the site, and we're accepting the interpretations of GCP and other regulatory necessities, but not putting anything extra on top of it, I think is the really big thing, right? Record retention is a great example of something where, you know, we've met our regulatory requirements. Maybe we've met a few extra requirements that the sponsor has as applicable and as paid for, but, if the regulatory say two years, why does it need to be 15 years for that? Right. For that particular country. That's because the sponsor wants it that way. So let's, let's get away from those practices of overextending and overburdening the sites because a sponsor or a CRO wants something a particular way that is way beyond the needs of regulatory and GCP. Those would be my two.

David Vulcano: 24:05

It would be consistent with the new principles. I mean, you know, section 2 7. 4, the sponsor should not place unnecessary burden on participants and investigators. And section 3. 2, the sponsor should assure that sufficient resources are available to appropriately conduct a study. And I'm going to, I'm going to call up two last things, Jimmy, before we part one is on training. I mean, obviously there's all sorts of third party vendors going out there for training now that are either charging or free. I know we have Our initiative on trying to right size site training under the banner cut 25 and 25. But I think this is a perfect opportunity for collaborations with our sponsors and CROs on this so that we right size this out the gate. I mean, everybody is going to want to be, you know, are the sites updated on training and clearly we need to send a message out that I don't want to have to take every sponsor and every CROs training that's repetitive over and over again, just so I check the box and take their training. So I think this is a great opportunity with the collaborations that we're doing on site training and right sizing site training to make sure that the sponsors and CROs are not just coming out with check the box. Or duplicative training that if a site is trained on the new GCPs, they don't have to take one for every sponsor or CRO out there. So I hope that we can get there and the second thing i'll say is that, there's going to be, there already is and there's going to be a lot of myths about GCPs. We're starting to see chatter on a lot of site boards about oh the new GCP says this or that. And my encouragement is to the sites is if you've read these and you understand them and you are faced with a sponsor or CRO or somebody saying, well, the new GCP say this, just ask them to cite it. So gosh, well, that's great. You know, I didn't catch that. Can you cite the section that says this or show me the section and don't just accept, Oh, it's in the new GCPs. We had chatter about, Oh, brackets are not allowed in source documents. You can't use brackets. Oh, that's, that's GCP. It's like, well, we've searched R2, we've searched R3 and nowhere does it even use the word bracket or parentheses for that matter. So I think that in this time of stabilization, that's if you have something and it's cited as required by the new GCPs and you're just not familiar with it to definitely ask for the citation. And if they can't provide that citation, then handle it in an appropriate and respectful manner certainly calling out the citation of 2. 7. 4 the sponsor should not place unnecessary burden.

Jimmy Bechtel: 26:30

Excellent, David. Yeah, I couldn't agree more. And I think that's a really great place for us to end our conversation here. Thank you, David, as always for your insights. Tremendously valuable. And I hope well, I know that our site audience as well as I hope our sponsor and CRO audience have been able to take some things away from this. Areas to investigate further and develop their own practices and policies slash procedures on and go forward. So again, thank you for your time today. And for those listening definitely check out my SCRS. org for some of the resources that David had mentioned on the call today as well as the regular mainstay topics surrounding some of these areas like cybersecurity and digital health technology implementation on clinical trials throughout our various publications. And of course, at our site solution summit, where these topics are regularly discussed. So thank you everyone for tuning in and listening and until next time.

David Vulcano: 27:21

Thank you.