[sheet: Overview]

Field	Detail
Document Title	Regulatory Compliance Checklist — Anti-Kickback Statute, Physician Payments Sunshine Act (Open Payments), HIPAA, 21 CFR Part 54
Prepared By	Christopher Aiken, Associate, Calderwood & Harkness LLP
Reviewed By	Sean Morrissey, Associate; Miriam Calloway, Partner
Date Prepared	April 3, 2023
Matter Number	1018-00004
Client	Penterra Pharmaceuticals Corp. (PPC)
Client Address	200 Biopharma Boulevard, Suite 1400, Princeton, NJ 08540
Counterparty	Veridian Health Research Network, Inc. (VHRN)
Counterparty Address	750 Research Parkway, 8th Floor, Philadelphia, PA 19104
Agreement	Master Clinical Trial Agreement (MCTA) between Penterra and Veridian
Protocol	PPC-4871-III (CLARION — Clinical Assessment of Response with Longitudinal Investigation in ONcology)
Investigational Product	Penterafenib (PPC-4871), oral multi-kinase inhibitor
Indication	Advanced hepatocellular carcinoma (HCC), second-line after prior systemic therapy
IND Number	IND 157823
ClinicalTrials.gov Identifier	NCT05928174
Phase	Phase III, randomized, double-blind, placebo-controlled
Planned Enrollment	1,200 subjects (800 treatment : 400 placebo)
Number of Sites	38 Veridian Network sites across 14 states
Total Deal Value	$80,000,000
Global Principal Investigator	Dr. Catherine Aldridge, M.D., Ph.D., Graystone University Medical Center
Co-Principal Investigator	Dr. Howard Matsuoka, M.D., Lakemont Medical Center
CRO	Meridian Contract Research Organization, Inc.
Regulatory Counsel	Castleton & Hargrove LLP (Dr. Priya Sundaram, Esq.)
Governing Law	State of New York

Purpose of Checklist

[sheet: Anti-Kickback Statute]

Item No.	Requirement / Obligation	Statutory / Regulatory Citation	Applicable MCTA Provision	Responsible Party	Compliance Action Required	Status	Due Date	Notes / Comments
AKS-01	All payments to investigators and sites must reflect fair market value (FMV) for services rendered	42 U.S.C. § 1320a-7b(b); OIG Guidance	Exhibit H — Regulatory Compliance Representations and Covenants; Exhibit B — Budget and Payment Schedule	Penterra (Samantha Novak, Director, Clinical Contracts); Calderwood & Harkness	Obtain independent FMV assessment of per-patient fees ($52,000/subject) and investigator grants ($1,500,000 total); document in Fair Market Value Memorandum	In Progress	Prior to MCTA execution	Per-patient fee of $52,000 covers screen-to-completion across 4 milestones ($13,000 each at randomization, Week 12, Week 24, study completion). FMV memo under preparation by Sean Morrissey.
AKS-02	Investigator compensation must not be tied to enrollment volume in a manner that constitutes inducement for referrals	42 U.S.C. § 1320a-7b(b)(1)-(2)	PI Agreement (Dr. Catherine Aldridge); Co-PI Agreement (Dr. Howard Matsuoka); Exhibit B	Penterra (Rebecca Liang, Esq.); Calderwood & Harkness	Confirm payment milestones are based on legitimate clinical activities, not enrollment incentives; ensure no bonus or premium for exceeding enrollment targets	Pending	Prior to MCTA execution	Milestone payments structured as 25%/25%/25%/25% per patient at defined clinical time points — compliant structure
AKS-03	Personal services and management contracts safe harbor compliance	42 C.F.R. § 1001.952(d)	MCTA Sections on scope of services, term, compensation	Calderwood & Harkness (Christopher Aiken)	Verify MCTA satisfies all elements: (i) written agreement signed by parties; (ii) term of at least one year; (iii) services specified in advance; (iv) aggregate compensation set in advance, consistent with FMV, and not determined in manner taking into account volume or value of referrals	In Progress	Prior to MCTA execution	MCTA term covers projected 60-month study duration. Aggregate compensation of $80,000,000 specified in Exhibit B.
AKS-04	Start-up fees must reflect actual costs and FMV of site activation services	42 U.S.C. § 1320a-7b(b); OIG Guidance	Exhibit B — Start-up fees: $75,000/site × 38 sites = $2,850,000	Penterra (Samantha Novak)	Confirm start-up fee of $75,000/site ($37,500 upon site activation, $37,500 upon first patient enrolled) reflects documented costs of site initiation activities	Pending	Prior to MCTA execution	Payment split into two installments mitigates inducement risk
AKS-05	Annual site maintenance fees must reflect FMV of ongoing site operational support	42 U.S.C. § 1320a-7b(b)	Exhibit B — Annual maintenance: $40,000/site × 38 sites × 3.5 avg years = $5,320,000	Penterra (Samantha Novak)	Document basis for $40,000/site/year maintenance fee; benchmark against industry comparables	Pending	Prior to MCTA execution	Paid annually in advance on each site-activation anniversary
AKS-06	Network coordination/administrative fee must reflect FMV of Veridian central administration services	42 U.S.C. § 1320a-7b(b)	Exhibit B — Network coordination fee: $300,000/quarter × 14 quarters = $4,200,000	Penterra (Rebecca Liang); Calderwood & Harkness	Assess Veridian central coordination services scope and confirm $4,200,000 fee is FMV; include in FMV memorandum	Pending	Prior to MCTA execution	Veridian is a 501(c)(3) tax-exempt research organization (EIN: 23-4178205); fee covers coordination across 38 sites in 14 states
AKS-07	Investigator grants for publication/academic support must be for legitimate purposes and at FMV	42 U.S.C. § 1320a-7b(b); OIG Compliance Program Guidance for Pharmaceutical Manufacturers	Exhibit B — Investigator grants: $1,500,000 lump sum	Penterra (Rebecca Liang); Calderwood & Harkness	Confirm grants are disbursed only upon acceptance of manuscripts for peer-reviewed publication and are not disguised referral payments	Pending	Prior to MCTA execution	Publication rights subject to Penterra 60-day review + up to 90-day patent delay per Exhibit G
AKS-08	No payments to investigators or sites conditioned on favorable study outcomes or positive data	42 U.S.C. § 1320a-7b(b)	MCTA; PI and Co-PI Agreements	Calderwood & Harkness	Review all payment provisions to confirm no outcome-based bonuses or data-contingent payments	In Progress	Prior to MCTA execution	Study is double-blind, placebo-controlled; milestone payments linked to procedural time points, not outcomes
AKS-09	Ensure MCTA includes express Anti-Kickback compliance representations and covenants	42 U.S.C. § 1320a-7b(b)	Exhibit H — Regulatory Compliance Representations and Covenants	Calderwood & Harkness (Sean Morrissey)	Draft and include in Exhibit H mutual representations that payments constitute FMV, are for legitimate services, and comply with all applicable federal and state anti-kickback laws	In Progress	Included in First Draft MCTA (April 7, 2023)
AKS-10	Review state anti-kickback and fee-splitting statutes in all 14 states where Veridian sites are located	Varies by state	MCTA; Individual Site Agreements	Calderwood & Harkness (Christopher Aiken)	Conduct 14-state survey of applicable state anti-kickback and self-referral statutes; identify any state-specific compliance requirements beyond federal AKS	Pending	Prior to MCTA execution	Sites span 14 states including PA, IL, MA, CO, GA and others
AKS-11	Prohibition on swapping — ensure MCTA payments do not constitute remuneration for referrals of federal health care program patients	42 U.S.C. § 1320a-7b(b); OIG Advisory Opinions	MCTA; PI Agreements; Co-PI Agreements	Calderwood & Harkness (Christopher Aiken); Penterra (Rebecca Liang)	Analyze whether any Veridian site investigators also prescribe Penterra commercial products; if so, assess swapping risk and document mitigation measures	Pending	Prior to MCTA execution	Penterra has two FDA-approved oncology products on market: Pentavex (penterafenib-adjacent) and Clariqor (CDK4/6 inhibitor)
AKS-12	Exclusion screening — verify no investigators or sites are excluded from federal health care programs	42 U.S.C. § 1320a-7; OIG List of Excluded Individuals/Entities (LEIE); GSA SAM.gov	Exhibit H — Regulatory Compliance Representations	Penterra (Samantha Novak); Meridian CRO	Run OIG LEIE and GSA SAM.gov exclusion screening on all investigators, sub-investigators, and key site personnel prior to site activation; repeat screening monthly during study	Pending	Prior to each site activation; ongoing monthly	Approximately 150+ individuals to screen across 38 sites
AKS-13	Compliance training — ensure all relevant Penterra and Veridian personnel receive Anti-Kickback training	42 U.S.C. § 1320a-7b(b); OIG Compliance Program Guidance	MCTA; Exhibit H	Penterra (Rebecca Liang); Veridian (Patricia Dunne, VP Compliance)	Conduct AKS compliance training for all Penterra clinical operations personnel involved in CLARION trial and ensure Veridian certifies equivalent training for its network compliance staff	Pending	Prior to MCTA execution; annually thereafter	Training records to be maintained for duration of study plus 6 years
AKS-14	Audit rights — MCTA must include sponsor audit rights to verify AKS compliance at sites	42 U.S.C. § 1320a-7b(b); OIG Guidance	MCTA Section — Audit and Inspection Rights	Calderwood & Harkness; Penterra (Samantha Novak)	Ensure MCTA grants Penterra right to audit Veridian and individual sites for AKS compliance, including review of financial records, payment flows, and investigator compensation documentation	In Progress	Included in First Draft MCTA (April 7, 2023)	Audit rights provision also covers HIPAA, GCP, and financial disclosure compliance
AKS-15	Documentation and record retention — maintain all AKS compliance documentation for minimum 10 years	42 U.S.C. § 1320a-7b(b); 31 U.S.C. § 3731 (FCA SOL considerations)	MCTA record retention provisions	Penterra (Samantha Novak); Calderwood & Harkness	Retain all FMV assessments, payment records, compliance certifications, training records, and audit reports for minimum 10 years from date of last payment under MCTA	Pending	Ongoing throughout study and post-study	MCTA general document retention period is 15 years post-study completion; AKS-specific retention of 10 years is subsumed

[sheet: Sunshine Act (Open Payments)]

Item No.	Requirement / Obligation	Statutory / Regulatory Citation	Applicable MCTA Provision	Responsible Party	Compliance Action Required	Status	Due Date	Notes / Comments
SA-01	Penterra must report all payments and transfers of value to covered recipients (physicians and teaching hospitals) to CMS via the Open Payments system	42 U.S.C. § 1320a-7h; 42 C.F.R. Part 403, Subpart I	Exhibit H — Regulatory Compliance Representations	Penterra (Samantha Novak; Rebecca Liang)	Establish tracking system for all payments to individual investigators (e.g., Dr. Catherine Aldridge, Dr. Howard Matsuoka) and to teaching hospitals within the Veridian Network	Pending	Prior to first payment under MCTA	Applicable manufacturers (including Penterra as Nasdaq-listed pharma company, ticker PTRA) must report annually by March 31 for prior calendar year
SA-02	Categorize reportable payments by nature of payment: research, consulting, food/beverage, travel, education, grant, etc.	42 C.F.R. § 403.904	Exhibit B; PI Agreement; Co-PI Agreement	Penterra (Samantha Novak)	Map each MCTA payment category to CMS Open Payments reporting categories; per-patient fees = research payments; investigator grants = research/grants; start-up and maintenance fees to institutions = research payments to teaching hospitals	In Progress	Prior to MCTA execution	Per-patient fees ($52,000/subject = $13,000 × 4 milestones); investigator grants ($1,500,000 total); start-up fees ($75,000/site); maintenance fees ($40,000/site/year)
SA-03	Identify all covered recipients among Veridian site investigators	42 U.S.C. § 1320a-7h(e)(6)	Schedule 1 — List of Participating Sites; PI/Co-PI Agreements	Penterra (Samantha Novak); Veridian (Patricia Dunne)	Obtain NPI numbers and covered recipient status for all principal investigators and sub-investigators at 38 sites; confirm teaching hospital status for each Veridian Network institution	Pending	Prior to first payment	Lead sites: Graystone University Medical Center (Site 001, Philadelphia, PA); Lakemont Medical Center (Site 002, Chicago, IL); plus Haverford Regional (Site 003, Boston, MA), Cedar Falls University Hospital (Site 004, Denver, CO), Weston Memorial (Site 005, Atlanta, GA), and 33 others
SA-04	Determine whether per-patient payments made to institutions (vs. individual physicians) are reportable	42 C.F.R. § 403.904(f)	Exhibit B; Individual Site Agreements	Calderwood & Harkness (Sean Morrissey)	Analyze payment flow: payments under MCTA flow to Veridian/sites (institutions); determine reporting obligation for pass-through payments to individual investigators	Pending	Prior to MCTA execution	Payments from Penterra to Veridian as central network entity, then allocated to individual sites
SA-05	Research payment context reporting — report associated research details including protocol name and ClinicalTrials.gov identifier	42 C.F.R. § 403.904(g)	Exhibit A — Protocol Synopsis	Penterra (Samantha Novak)	Include in all Open Payments reports: Protocol PPC-4871-III, CLARION, ClinicalTrials.gov ID NCT05928174, IND 157823, indication (advanced HCC)	Pending	At time of annual report filing	Research payment context documents allow delayed publication of payment details until FDA approval or 4 years after payment, whichever is earlier
SA-06	Delayed publication election for research payments	42 C.F.R. § 403.910	N/A — Penterra internal election	Penterra (Rebecca Liang; Samantha Novak)	Determine whether Penterra elects delayed publication for research payments under CLARION trial; requires ongoing clinical investigation (IND 157823 active)	Pending	At time of annual report filing	CLARION enrollment period: 42 months (target FPI August 14, 2023 through projected last patient in February 2027)
SA-07	Include Sunshine Act compliance representations in MCTA	42 U.S.C. § 1320a-7h	Exhibit H — Regulatory Compliance Representations	Calderwood & Harkness	Ensure MCTA Exhibit H includes mutual covenants to cooperate on Open Payments reporting and timely provision of payment data	In Progress	Included in First Draft MCTA (April 7, 2023)
SA-08	Track food, beverage, travel, and lodging provided to investigators in connection with CLARION trial activities	42 C.F.R. § 403.904(a)	MCTA; PI Agreements	Penterra (Jennifer Holt, VP Clinical Operations); Meridian CRO	Coordinate with Meridian CRO (Thomas Hartwell, CEO) to capture non-monetary transfers of value at investigator meetings, site initiation visits, and advisory board meetings	Pending	Ongoing throughout trial	Meridian CRO Master Services Agreement dated January 15, 2023 governs CRO responsibilities
SA-09	Annual attestation and data submission to CMS	42 C.F.R. § 403.908	N/A — Penterra internal process	Penterra (Samantha Novak)	Submit annual Open Payments report to CMS by March 31 for each preceding calendar year; first report covering 2023 payments due March 31, 2024	Pending	March 31, 2024 (first filing)
SA-10	Dispute resolution process for contested reported amounts with covered recipients	42 C.F.R. § 403.912	N/A	Penterra (Samantha Novak)	Establish internal process for addressing investigator disputes regarding reported payment amounts during the CMS review/dispute window	Pending	Prior to first filing
SA-11	Aggregate reporting thresholds — determine whether any payments fall below de minimis reporting threshold	42 C.F.R. § 403.904(a)(1)	Exhibit B	Penterra (Samantha Novak)	Review all payment categories against the current CMS de minimis threshold (currently $12.37/individual payment and $123.69/aggregate per covered recipient per year for non-research payments); note that research payments have no de minimis threshold	Pending	Prior to first filing	All CLARION payments substantially exceed de minimis thresholds; research payments reported regardless of amount
SA-12	Physician ownership and investment interest reporting	42 U.S.C. § 1320a-7h(a)(2)	Exhibit H; Financial Disclosure Certification Template	Penterra (Rebecca Liang); Calderwood & Harkness	Coordinate with 21 CFR Part 54 financial disclosure process to identify any investigators holding ownership or investment interests in Penterra (Nasdaq: PTRA); report as applicable under Open Payments ownership/investment category	Pending	Prior to first filing	Cross-reference with FD-02 and FD-08 on Financial Disclosure sheet

[sheet: HIPAA Compliance]

Item No.	Requirement / Obligation	Statutory / Regulatory Citation	Applicable MCTA Provision	Responsible Party	Compliance Action Required	Status	Due Date	Notes / Comments
HIPAA-01	Research authorization — obtain valid HIPAA authorization from each trial subject for use/disclosure of PHI for research purposes	45 C.F.R. § 164.508(b)(1); 45 C.F.R. § 164.512(i)	Exhibit F — Confidentiality and Data Protection Provisions	Veridian sites (investigators/coordinators); Penterra (Jennifer Holt)	Ensure informed consent forms include HIPAA-compliant research authorization; review ICF template for compliance with 45 C.F.R. § 164.508 core elements	In Progress	Prior to first patient enrollment (target FPI: August 14, 2023)	1,200 subjects planned for enrollment across 38 sites; authorization must be obtained from each subject prior to access to PHI
HIPAA-02	Determine whether waiver or alteration of authorization is applicable for any study activities (e.g., screening, registry review)	45 C.F.R. § 164.512(i)(1)(i); 45 C.F.R. § 164.512(i)(2)	Exhibit F	Calderwood & Harkness; site IRBs (Graystone IRB — IRB00012847; Veridian Central IRB)	Analyze whether any pre-screening or registry-based activities require IRB/Privacy Board waiver of authorization; document analysis	Pending	Prior to IRB submissions	IRB reliance structure: Graystone IRB for PA sites; Veridian Central IRB for non-PA sites across remaining states
HIPAA-03	Minimum necessary standard — limit PHI disclosed to Penterra and Meridian CRO to minimum necessary for research purposes	45 C.F.R. § 164.502(b); 45 C.F.R. § 164.514(d)	Exhibit F; MCTA data transfer provisions	Veridian sites; Penterra; Meridian CRO	Define data elements to be collected in EDC (Pinnacle Data Solutions platform) and ensure only minimum necessary PHI is transmitted; use coded/de-identified data where possible	Pending	Prior to EDC system configuration	EDC vendor: Pinnacle Data Solutions, Inc., 6000 Clearwater Drive, San Diego, CA 92121; Central lab: Northbridge Bioanalytical Laboratories, Inc., 2900 Commerce Way, Baltimore, MD 21224
HIPAA-04	Business Associate Agreements (BAAs) — execute BAAs with all entities receiving PHI on behalf of covered entities	45 C.F.R. § 164.502(e); 45 C.F.R. § 164.504(e)	Exhibit F; Exhibit K — Approved Subcontractors List	Penterra (Rebecca Liang); Calderwood & Harkness	Confirm BAAs in place between: (i) Veridian sites and Penterra; (ii) Penterra and Meridian CRO; (iii) Penterra and Pinnacle Data Solutions; (iv) Penterra/sites and Northbridge Bioanalytical Laboratories. Ensure MCTA itself constitutes or incorporates a BAA.	Pending	Prior to MCTA execution / data transfer	Approved subcontractors per Exhibit K: Meridian CRO, Pinnacle Data Solutions, Northbridge Bioanalytical Laboratories
HIPAA-05	De-identification standards — ensure any data shared externally (publications, regulatory submissions) is properly de-identified	45 C.F.R. § 164.514(a)-(c)	Exhibit F; Exhibit G — IP and Publication Rights	Penterra (Dr. Marcus Yun, SVP Clinical Development); investigators	Establish de-identification procedures for publication datasets and regulatory submissions; either expert determination or safe harbor method	Pending	Prior to any data sharing/publication	Penterra retains exclusive ownership of all clinical trial data per Exhibit G
HIPAA-06	Data security safeguards — implement administrative, physical, and technical safeguards for electronic PHI (ePHI)	45 C.F.R. § 164.302-318 (Security Rule)	Exhibit F	All parties handling ePHI: Veridian sites, Penterra, Meridian CRO, Pinnacle Data Solutions	Confirm all parties maintain HIPAA Security Rule-compliant safeguards; include security representations in MCTA Exhibit F; verify Pinnacle EDC platform security certifications	In Progress	Prior to MCTA execution	21 C.F.R. Part 11 electronic records requirements also applicable (see Additional Regulatory sheet)
HIPAA-07	Breach notification obligations	45 C.F.R. §§ 164.400-414	Exhibit F	All parties handling PHI	Include breach notification obligations in MCTA and BAAs; specify notification timelines (without unreasonable delay, no later than 60 days from discovery) and coordination procedures among Penterra, Veridian, and subcontractors	Pending	Prior to MCTA execution	Coordinate with MCTA confidentiality provisions (10-year confidentiality term)
HIPAA-08	Subject rights — access, amendment, accounting of disclosures for research uses of PHI	45 C.F.R. §§ 164.524, 164.526, 164.528	Exhibit F; ICF/authorization	Veridian sites (as covered entities)	Establish procedures at each site for responding to subject requests for access, amendment, and accounting of disclosures of PHI used in CLARION trial	Pending	Prior to first patient enrollment	Site staff training required at all 38 sites
HIPAA-09	State privacy law preemption analysis — identify state laws more stringent than HIPAA in the 14 states where sites operate	45 C.F.R. § 160.203	Exhibit F; Schedule 1 — Participating Sites	Calderwood & Harkness (Christopher Aiken)	Conduct 14-state survey of state health privacy laws (e.g., state genetic privacy, substance abuse, mental health record protections) that may impose requirements more stringent than HIPAA	Pending	Prior to MCTA execution	Sites located in 14 states
HIPAA-10	Accounting of disclosures for treatment, payment, and health care operations vs. research disclosures	45 C.F.R. § 164.528(a)(2)	Exhibit F	Veridian sites	Confirm sites maintain accounting of research-related PHI disclosures to Penterra, Meridian CRO, and other recipients for required 6-year period	Pending	Ongoing throughout trial	Study duration: 60 months total (42-month enrollment + 18-month follow-up)
HIPAA-11	Limited data set agreements — determine whether any study data transmissions qualify as limited data sets under HIPAA	45 C.F.R. § 164.514(e)	Exhibit F	Calderwood & Harkness; Penterra (Dr. Marcus Yun)	Analyze whether any data flows (e.g., aggregate safety data, interim analysis datasets) may be structured as limited data sets with corresponding data use agreements rather than full PHI transmissions	Pending	Prior to EDC configuration	Limited data sets exclude direct identifiers but may include dates, geographic information
HIPAA-12	Training — HIPAA Privacy and Security training for all site personnel with access to PHI	45 C.F.R. § 164.530(b); 45 C.F.R. § 164.308(a)(5)	Exhibit F; MCTA training provisions	Veridian (Patricia Dunne); site investigators	Ensure all site personnel (investigators, coordinators, study nurses, data entry staff) complete HIPAA Privacy and Security training prior to accessing CLARION trial PHI; document training completion	Pending	Prior to first patient enrollment at each site	Training certification to be maintained in site regulatory binder
HIPAA-13	Data transfer mechanisms — ensure secure transmission of PHI between sites, EDC, central lab, and sponsor	45 C.F.R. § 164.312(e)(1)	Exhibit F; Exhibit K	Penterra (IT Security); Pinnacle Data Solutions; Northbridge Bioanalytical Laboratories	Validate encryption standards (AES-256 or equivalent) for all PHI transmissions; confirm SFTP/VPN protocols for data transfers between sites and EDC; verify central lab specimen chain-of-custody procedures minimize PHI exposure	Pending	Prior to EDC system go-live	Central lab specimens shipped with coded identifiers only; linking key maintained separately at sites
HIPAA-14	Risk assessment — conduct HIPAA Security Rule risk assessment for CLARION trial data flows	45 C.F.R. § 164.308(a)(1)(ii)(A)	Exhibit F	Penterra (IT Security); Meridian CRO	Perform comprehensive risk assessment of all CLARION trial PHI data flows, storage systems, and access controls; document findings and remediation plan	Pending	Prior to MCTA execution	Risk assessment to cover Pinnacle EDC, Meridian CRO CTMS, Northbridge LIMS, and all site systems

[sheet: 21 CFR Part 54 — Financial Disc]

Item No.	Requirement / Obligation	Statutory / Regulatory Citation	Applicable MCTA Provision	Responsible Party	Compliance Action Required	Status	Due Date	Notes / Comments
FD-01	Collect financial disclosure information from all clinical investigators (Form FDA 3454 or 3455) prior to study participation	21 C.F.R. § 54.4(a)	Exhibit H — Regulatory Compliance Representations; Exhibit I — Form of Investigator Undertaking	Penterra (Samantha Novak; Dr. Marcus Yun); Meridian CRO	Distribute Financial Disclosure Certification Template to all PIs and sub-investigators at 38 Veridian sites; collect completed certifications prior to site activation	In Progress	Prior to each site activation	Template prepared by Calderwood & Harkness (see Financial Disclosure Certification Template doc). Global PI: Dr. Catherine Aldridge (Graystone). Co-PI: Dr. Howard Matsuoka (Lakemont).
FD-02	Financial interests requiring disclosure: compensation affected by study outcome; proprietary interest in product; significant equity in sponsor; significant payments (>$25,000) from sponsor	21 C.F.R. § 54.2(a)-(f)	Exhibit H; Financial Disclosure Certification Template	All investigators at Veridian sites	Each investigator must certify presence or absence of: (i) compensation affected by outcome of study; (ii) proprietary interest in penterafenib (PPC-4871); (iii) significant equity interest in Penterra (Nasdaq: PTRA, market cap ~$4.2 billion); (iv) significant payments from Penterra exceeding $25,000 (other than study-related costs)	Pending	Prior to each investigator's participation	Penterra is publicly traded on Nasdaq; investigators must disclose equity holdings in PTRA
FD-03	Sponsor (IND holder) obligation to collect, certify, and submit financial disclosures to FDA	21 C.F.R. § 54.4(a)-(b)	MCTA; Exhibit H	Penterra (as IND holder — IND 157823); Castleton & Hargrove LLP (Dr. Priya Sundaram, Esq., regulatory counsel)	Penterra must submit either Form FDA 3454 (certification of no disclosable financial interests) or Form FDA 3455 (disclosure of financial interests) for each investigator as part of the marketing application (NDA/BLA)	Pending	At time of marketing application submission	Coordinate with Castleton & Hargrove LLP on FDA submission strategy; IND maintenance ongoing
FD-04	Include MCTA covenant requiring investigators to update financial disclosures during study and for one year after completion	21 C.F.R. § 54.4(a)(2)	Exhibit H; Exhibit I — Form of Investigator Undertaking; PI/Co-PI Agreements	Calderwood & Harkness; Penterra (Rebecca Liang)	Draft and include in MCTA Exhibit H and Exhibit I a covenant requiring investigators to promptly notify Penterra of any changes in financial interests during the study and for one year following study completion (projected study completion: August 2028)	In Progress	Included in First Draft MCTA (April 7, 2023)	Update obligation extends one year post-study completion to approximately August 2029
FD-05	Maintain records of financial disclosures for required retention period	21 C.F.R. § 54.6	MCTA record retention provisions	Penterra (Samantha Novak)	Retain all financial disclosure forms and certifications for 2 years after FDA approval of marketing application or, if not approved, 2 years after investigation is discontinued and FDA notified	Pending	Ongoing	MCTA site records retention: 15 years post-study completion; financial disclosure retention per 21 CFR 54.6 may be shorter but MCTA retention period governs as longer
FD-06	If disclosable financial interests exist, sponsor must describe steps taken to minimize potential bias	21 C.F.R. § 54.4(b)	Exhibit H	Penterra; Castleton & Hargrove LLP	Develop protocols for managing identified financial conflicts, including potential measures such as excluding investigator from certain study activities, independent monitoring, or statistical analysis sensitivity testing	Pending	As needed upon receipt of disclosures	CLARION is double-blind, placebo-controlled — blinding provides inherent bias mitigation
FD-07	Coordinate Form 1572 collection with financial disclosure collection for all investigators	21 C.F.R. § 312.53(c); 21 C.F.R. Part 54	MCTA; Form 1572 Preparation Memorandum	Penterra (Jennifer Holt, VP Clinical Operations); Meridian CRO	Ensure Form FDA 1572 (Statement of Investigator) and financial disclosure certification are collected concurrently from each investigator at all 38 sites; maintain coordinated tracking system	Pending	Prior to each site activation	Form 1572 guidance memorandum prepared by Calderwood & Harkness
FD-08	Veridian Network institutional financial interests — assess whether any Veridian member institution holds equity or financial interest in Penterra	21 C.F.R. § 54.2(e)-(f)	Exhibit H; MCTA representations	Penterra (Rebecca Liang); Veridian (Gregory Callahan, Esq.)	Request certification from Veridian and each member institution regarding institutional financial interests in Penterra or penterafenib; Veridian is a 501(c)(3) tax-exempt organization — verify investment portfolio does not include PTRA holdings	Pending	Prior to MCTA execution	Veridian EIN: 23-4178205; Graystone and Lakemont are nonprofit corporations
FD-09	Sub-investigator financial disclosures — ensure disclosures obtained from all sub-investigators, not just PIs	21 C.F.R. § 54.2(d)	Exhibit H; Exhibit I	Penterra (Samantha Novak); Meridian CRO	Identify all sub-investigators listed on Form 1572 at each of 38 sites; distribute and collect financial disclosure certifications from each sub-investigator prior to their participation in the study	Pending	Prior to each sub-investigator's participation	Estimated 4-6 sub-investigators per site = approximately 150-228 total sub-investigators requiring financial disclosures
FD-10	Annual update of financial disclosures from all participating investigators	21 C.F.R. § 54.4(a)(2); MCTA covenant	Exhibit H; Exhibit I	Penterra (Samantha Novak); Meridian CRO	Establish annual cadence for collecting updated financial disclosure certifications from all investigators and sub-investigators; track and follow up on delinquent submissions	Pending	Annually from date of initial certification	First annual update cycle anticipated August-September 2024

[sheet: Additional Regulatory (21 CFR)]

Item No.	Requirement / Obligation	Statutory / Regulatory Citation	Applicable MCTA Provision	Responsible Party	Compliance Action Required	Status	Due Date	Notes / Comments
REG-01	Electronic records and electronic signatures must comply with 21 CFR Part 11	21 C.F.R. Part 11	Exhibit F — Confidentiality and Data Protection; Exhibit J — Safety Reporting Procedures	Penterra; Pinnacle Data Solutions (EDC vendor); Meridian CRO	Confirm Pinnacle EDC platform (6000 Clearwater Drive, San Diego, CA 92121) is 21 CFR Part 11 compliant; obtain vendor certification; include Part 11 compliance representations in MCTA Exhibit F	Pending	Prior to EDC system go-live	Technology/EDC integration costs: $1,230,000 (per Exhibit B)
REG-02	Informed consent requirements — 21 CFR Part 50 compliance for all trial subjects	21 C.F.R. Part 50	Exhibit H; Protocol PPC-4871-III	Veridian sites (investigators/coordinators); IRBs	Ensure ICF template complies with all Part 50 elements; ICF must be approved by applicable IRB (Graystone IRB — IRB00012847 for PA sites; Veridian Central IRB for non-PA sites) prior to use at each site	Pending	Prior to first patient enrollment at each site	Planned enrollment: 1,200 subjects (2:1 randomization — 800 treatment : 400 placebo)
REG-03	IRB review and approval — 21 CFR Part 56 compliance	21 C.F.R. Part 56	MCTA IRB provisions; Schedule 1 — Participating Sites	Veridian (Dr. Lena Marchetti, Ph.D.); Graystone IRB; Veridian Central IRB	Each of 38 sites must have IRB approval prior to enrollment. Lead sites (Graystone, Lakemont) require individual IRB approval; remaining sites may rely on Veridian Central IRB under IRB Authorization Agreement per revised Common Rule	In Progress	Prior to site activation at each site; lead site IRB approvals required as closing condition precedent (satisfied July 5, 2023)	IRB reliance structure analyzed in separate memorandum
REG-04	IND regulations — compliance with 21 CFR Part 312 for investigational new drug requirements	21 C.F.R. Part 312	MCTA; Exhibit A — Protocol Synopsis; Exhibit J — Safety Reporting	Penterra (as IND holder — IND 157823); Castleton & Hargrove LLP	Maintain IND in good standing; submit IND annual reports, protocol amendments, IND safety reports (7-day for fatal/life-threatening, 15-day for all others); ensure sites comply with investigator obligations under 21 CFR 312.60-312.69	Ongoing	Throughout study duration (60 months)	IND filed October 2021; Phase II completed January 2023 (38% ORR in advanced HCC)
REG-05	ICH E6(R2) Good Clinical Practice compliance	ICH E6(R2)	Exhibit H — Regulatory Compliance Representations	All parties: Penterra, Veridian, investigators, Meridian CRO	Include GCP compliance representations in MCTA Exhibit H; ensure Meridian CRO (9200 Corporate Boulevard, Raleigh, NC 27615) monitoring plan aligns with ICH E6(R2) risk-based monitoring requirements	In Progress	Prior to MCTA execution; ongoing throughout trial	Meridian CRO MSA dated January 15, 2023
REG-06	SAE reporting — sites must report serious adverse events within 24 hours of awareness to Penterra and Meridian CRO	21 C.F.R. § 312.32; ICH E6(R2)	Exhibit J — Safety Reporting Procedures	Veridian sites (investigators); Penterra (Dr. Elaine Whitford, CMO); Meridian CRO	Ensure MCTA Exhibit J specifies 24-hour SAE reporting from site to sponsor/CRO; Penterra responsible for IND safety reports to FDA (7-day and 15-day timelines)	In Progress	Prior to MCTA execution; ongoing	Safety data management per Meridian CRO agreement; central lab services by Northbridge Bioanalytical Laboratories (2900 Commerce Way, Baltimore, MD 21224)
REG-07	Source document retention — sites must retain for minimum 15 years post-study completion	21 C.F.R. § 312.62; ICH E6(R2) § 8	MCTA data/records retention provisions	Veridian sites	MCTA requires site retention of source documents for minimum 15 years post-study completion (approximately until August 2043 based on projected study completion August 2028)	Pending	Included in MCTA drafting
REG-08	Drug accountability and investigational product management at each site	21 C.F.R. § 312.62; 21 C.F.R. § 312.69	MCTA; Protocol PPC-4871-III; Exhibit D — Drug Supply and Accountability	Veridian sites (investigators/pharmacists); Penterra (Jennifer Holt); Meridian CRO	Ensure each of 38 sites maintains accurate drug accountability logs for penterafenib (PPC-4871) and matching placebo; verify controlled storage conditions (15-25°C) per product specifications; conduct periodic drug reconciliation	Pending	Prior to first patient enrollment at each site; ongoing	Drug supply manufactured by Penterra at Princeton facility; distributed via Pharma Logistics International, LLC
REG-09	Protocol deviations and violations — establish reporting procedures for GCP deviations	21 C.F.R. Part 312; ICH E6(R2) § 5.20	MCTA; Exhibit H; Protocol PPC-4871-III	Veridian sites; Penterra (Jennifer Holt); Meridian CRO	Define protocol deviation categories (major/minor), establish reporting timelines (major deviations within 24 hours to sponsor, minor within 5 business days), and include deviation tracking in MCTA quality provisions	Pending	Prior to MCTA execution	Meridian CRO responsible for deviation tracking and trend analysis per MSA
REG-10	Data Safety Monitoring Board (DSMB) — establish independent DSMB per protocol requirements	21 C.F.R. § 312.32; ICH E6(R2); FDA Guidance on DSMBs	Protocol PPC-4871-III; DSMB Charter (separate document)	Penterra (Dr. Marcus Yun); Castleton & Hargrove LLP	Establish independent DSMB with charter defining composition (minimum 3 independent members including biostatistician), meeting schedule (after every 200 subjects enrolled), interim analysis plan, and stopping rules	In Progress	Prior to first patient enrollment	DSMB Chair: Dr. Franklin Osei, M.D., Ph.D. (independent oncologist, not affiliated with any Veridian site)

[sheet: Overview]
Field | Detail
Document Title | Regulatory Compliance Checklist — Anti-Kickback Statute, Physician Payments Sunshine Act (Open Payments), HIPAA, 21 CFR Part 54
Prepared By | Christopher Aiken, Associate, Calderwood & Harkness LLP
Reviewed By | Sean Morrissey, Associate; Miriam Calloway, Partner
Date Prepared | April 3, 2023
Matter Number | 1018-00004
Client | Penterra Pharmaceuticals Corp. (PPC)
Client Address | 200 Biopharma Boulevard, Suite 1400, Princeton, NJ 08540
Counterparty | Veridian Health Research Network, Inc. (VHRN)
Counterparty Address | 750 Research Parkway, 8th Floor, Philadelphia, PA 19104
Agreement | Master Clinical Trial Agreement (MCTA) between Penterra and Veridian
Protocol | PPC-4871-III (CLARION — Clinical Assessment of Response with Longitudinal Investigation in ONcology)
Investigational Product | Penterafenib (PPC-4871), oral multi-kinase inhibitor
Indication | Advanced hepatocellular carcinoma (HCC), second-line after prior systemic therapy
IND Number | IND 157823
ClinicalTrials.gov Identifier | NCT05928174
Phase | Phase III, randomized, double-blind, placebo-controlled
Planned Enrollment | 1,200 subjects (800 treatment : 400 placebo)
Number of Sites | 38 Veridian Network sites across 14 states
Total Deal Value | $80,000,000
Global Principal Investigator | Dr. Catherine Aldridge, M.D., Ph.D., Graystone University Medical Center
Co-Principal Investigator | Dr. Howard Matsuoka, M.D., Lakemont Medical Center
CRO | Meridian Contract Research Organization, Inc.
Regulatory Counsel | Castleton & Hargrove LLP (Dr. Priya Sundaram, Esq.)
Governing Law | State of New York
Purpose of Checklist | Catalogue all regulatory compliance obligations under the Anti-Kickback Statute, Sunshine Act, HIPAA, and 21 CFR Part 54 applicable to the CLARION trial MCTA and related investigator agreements
[sheet: Anti-Kickback Statute]
Item No. | Requirement / Obligation | Statutory / Regulatory Citation | Applicable MCTA Provision | Responsible Party | Compliance Action Required | Status | Due Date | Notes / Comments
AKS-01 | All payments to investigators and sites must reflect fair market value (FMV) for services rendered | 42 U.S.C. § 1320a-7b(b); OIG Guidance | Exhibit H — Regulatory Compliance Representations and Covenants; Exhibit B — Budget and Payment Schedule | Penterra (Samantha Novak, Director, Clinical Contracts); Calderwood & Harkness | Obtain independent FMV assessment of per-patient fees ($52,000/subject) and investigator grants ($1,500,000 total); document in Fair Market Value Memorandum | In Progress | Prior to MCTA execution | Per-patient fee of $52,000 covers screen-to-completion across 4 milestones ($13,000 each at randomization, Week 12, Week 24, study completion). FMV memo under preparation by Sean Morrissey.
AKS-02 | Investigator compensation must not be tied to enrollment volume in a manner that constitutes inducement for referrals | 42 U.S.C. § 1320a-7b(b)(1)-(2) | PI Agreement (Dr. Catherine Aldridge); Co-PI Agreement (Dr. Howard Matsuoka); Exhibit B | Penterra (Rebecca Liang, Esq.); Calderwood & Harkness | Confirm payment milestones are based on legitimate clinical activities, not enrollment incentives; ensure no bonus or premium for exceeding enrollment targets | Pending | Prior to MCTA execution | Milestone payments structured as 25%/25%/25%/25% per patient at defined clinical time points — compliant structure
AKS-03 | Personal services and management contracts safe harbor compliance | 42 C.F.R. § 1001.952(d) | MCTA Sections on scope of services, term, compensation | Calderwood & Harkness (Christopher Aiken) | Verify MCTA satisfies all elements: (i) written agreement signed by parties; (ii) term of at least one year; (iii) services specified in advance; (iv) aggregate compensation set in advance, consistent with FMV, and not determined in manner taking into account volume or value of referrals | In Progress | Prior to MCTA execution | MCTA term covers projected 60-month study duration. Aggregate compensation of $80,000,000 specified in Exhibit B.
AKS-04 | Start-up fees must reflect actual costs and FMV of site activation services | 42 U.S.C. § 1320a-7b(b); OIG Guidance | Exhibit B — Start-up fees: $75,000/site × 38 sites = $2,850,000 | Penterra (Samantha Novak) | Confirm start-up fee of $75,000/site ($37,500 upon site activation, $37,500 upon first patient enrolled) reflects documented costs of site initiation activities | Pending | Prior to MCTA execution | Payment split into two installments mitigates inducement risk
AKS-05 | Annual site maintenance fees must reflect FMV of ongoing site operational support | 42 U.S.C. § 1320a-7b(b) | Exhibit B — Annual maintenance: $40,000/site × 38 sites × 3.5 avg years = $5,320,000 | Penterra (Samantha Novak) | Document basis for $40,000/site/year maintenance fee; benchmark against industry comparables | Pending | Prior to MCTA execution | Paid annually in advance on each site-activation anniversary
AKS-06 | Network coordination/administrative fee must reflect FMV of Veridian central administration services | 42 U.S.C. § 1320a-7b(b) | Exhibit B — Network coordination fee: $300,000/quarter × 14 quarters = $4,200,000 | Penterra (Rebecca Liang); Calderwood & Harkness | Assess Veridian central coordination services scope and confirm $4,200,000 fee is FMV; include in FMV memorandum | Pending | Prior to MCTA execution | Veridian is a 501(c)(3) tax-exempt research organization (EIN: 23-4178205); fee covers coordination across 38 sites in 14 states
AKS-07 | Investigator grants for publication/academic support must be for legitimate purposes and at FMV | 42 U.S.C. § 1320a-7b(b); OIG Compliance Program Guidance for Pharmaceutical Manufacturers | Exhibit B — Investigator grants: $1,500,000 lump sum | Penterra (Rebecca Liang); Calderwood & Harkness | Confirm grants are disbursed only upon acceptance of manuscripts for peer-reviewed publication and are not disguised referral payments | Pending | Prior to MCTA execution | Publication rights subject to Penterra 60-day review + up to 90-day patent delay per Exhibit G
AKS-08 | No payments to investigators or sites conditioned on favorable study outcomes or positive data | 42 U.S.C. § 1320a-7b(b) | MCTA; PI and Co-PI Agreements | Calderwood & Harkness | Review all payment provisions to confirm no outcome-based bonuses or data-contingent payments | In Progress | Prior to MCTA execution | Study is double-blind, placebo-controlled; milestone payments linked to procedural time points, not outcomes
AKS-09 | Ensure MCTA includes express Anti-Kickback compliance representations and covenants | 42 U.S.C. § 1320a-7b(b) | Exhibit H — Regulatory Compliance Representations and Covenants | Calderwood & Harkness (Sean Morrissey) | Draft and include in Exhibit H mutual representations that payments constitute FMV, are for legitimate services, and comply with all applicable federal and state anti-kickback laws | In Progress | Included in First Draft MCTA (April 7, 2023)
AKS-10 | Review state anti-kickback and fee-splitting statutes in all 14 states where Veridian sites are located | Varies by state | MCTA; Individual Site Agreements | Calderwood & Harkness (Christopher Aiken) | Conduct 14-state survey of applicable state anti-kickback and self-referral statutes; identify any state-specific compliance requirements beyond federal AKS | Pending | Prior to MCTA execution | Sites span 14 states including PA, IL, MA, CO, GA and others
AKS-11 | Prohibition on swapping — ensure MCTA payments do not constitute remuneration for referrals of federal health care program patients | 42 U.S.C. § 1320a-7b(b); OIG Advisory Opinions | MCTA; PI Agreements; Co-PI Agreements | Calderwood & Harkness (Christopher Aiken); Penterra (Rebecca Liang) | Analyze whether any Veridian site investigators also prescribe Penterra commercial products; if so, assess swapping risk and document mitigation measures | Pending | Prior to MCTA execution | Penterra has two FDA-approved oncology products on market: Pentavex (penterafenib-adjacent) and Clariqor (CDK4/6 inhibitor)
AKS-12 | Exclusion screening — verify no investigators or sites are excluded from federal health care programs | 42 U.S.C. § 1320a-7; OIG List of Excluded Individuals/Entities (LEIE); GSA SAM.gov | Exhibit H — Regulatory Compliance Representations | Penterra (Samantha Novak); Meridian CRO | Run OIG LEIE and GSA SAM.gov exclusion screening on all investigators, sub-investigators, and key site personnel prior to site activation; repeat screening monthly during study | Pending | Prior to each site activation; ongoing monthly | Approximately 150+ individuals to screen across 38 sites
AKS-13 | Compliance training — ensure all relevant Penterra and Veridian personnel receive Anti-Kickback training | 42 U.S.C. § 1320a-7b(b); OIG Compliance Program Guidance | MCTA; Exhibit H | Penterra (Rebecca Liang); Veridian (Patricia Dunne, VP Compliance) | Conduct AKS compliance training for all Penterra clinical operations personnel involved in CLARION trial and ensure Veridian certifies equivalent training for its network compliance staff | Pending | Prior to MCTA execution; annually thereafter | Training records to be maintained for duration of study plus 6 years
AKS-14 | Audit rights — MCTA must include sponsor audit rights to verify AKS compliance at sites | 42 U.S.C. § 1320a-7b(b); OIG Guidance | MCTA Section — Audit and Inspection Rights | Calderwood & Harkness; Penterra (Samantha Novak) | Ensure MCTA grants Penterra right to audit Veridian and individual sites for AKS compliance, including review of financial records, payment flows, and investigator compensation documentation | In Progress | Included in First Draft MCTA (April 7, 2023) | Audit rights provision also covers HIPAA, GCP, and financial disclosure compliance
AKS-15 | Documentation and record retention — maintain all AKS compliance documentation for minimum 10 years | 42 U.S.C. § 1320a-7b(b); 31 U.S.C. § 3731 (FCA SOL considerations) | MCTA record retention provisions | Penterra (Samantha Novak); Calderwood & Harkness | Retain all FMV assessments, payment records, compliance certifications, training records, and audit reports for minimum 10 years from date of last payment under MCTA | Pending | Ongoing throughout study and post-study | MCTA general document retention period is 15 years post-study completion; AKS-specific retention of 10 years is subsumed
[sheet: Sunshine Act (Open Payments)]
Item No. | Requirement / Obligation | Statutory / Regulatory Citation | Applicable MCTA Provision | Responsible Party | Compliance Action Required | Status | Due Date | Notes / Comments
SA-01 | Penterra must report all payments and transfers of value to covered recipients (physicians and teaching hospitals) to CMS via the Open Payments system | 42 U.S.C. § 1320a-7h; 42 C.F.R. Part 403, Subpart I | Exhibit H — Regulatory Compliance Representations | Penterra (Samantha Novak; Rebecca Liang) | Establish tracking system for all payments to individual investigators (e.g., Dr. Catherine Aldridge, Dr. Howard Matsuoka) and to teaching hospitals within the Veridian Network | Pending | Prior to first payment under MCTA | Applicable manufacturers (including Penterra as Nasdaq-listed pharma company, ticker PTRA) must report annually by March 31 for prior calendar year
SA-02 | Categorize reportable payments by nature of payment: research, consulting, food/beverage, travel, education, grant, etc. | 42 C.F.R. § 403.904 | Exhibit B; PI Agreement; Co-PI Agreement | Penterra (Samantha Novak) | Map each MCTA payment category to CMS Open Payments reporting categories; per-patient fees = research payments; investigator grants = research/grants; start-up and maintenance fees to institutions = research payments to teaching hospitals | In Progress | Prior to MCTA execution | Per-patient fees ($52,000/subject = $13,000 × 4 milestones); investigator grants ($1,500,000 total); start-up fees ($75,000/site); maintenance fees ($40,000/site/year)
SA-03 | Identify all covered recipients among Veridian site investigators | 42 U.S.C. § 1320a-7h(e)(6) | Schedule 1 — List of Participating Sites; PI/Co-PI Agreements | Penterra (Samantha Novak); Veridian (Patricia Dunne) | Obtain NPI numbers and covered recipient status for all principal investigators and sub-investigators at 38 sites; confirm teaching hospital status for each Veridian Network institution | Pending | Prior to first payment | Lead sites: Graystone University Medical Center (Site 001, Philadelphia, PA); Lakemont Medical Center (Site 002, Chicago, IL); plus Haverford Regional (Site 003, Boston, MA), Cedar Falls University Hospital (Site 004, Denver, CO), Weston Memorial (Site 005, Atlanta, GA), and 33 others
SA-04 | Determine whether per-patient payments made to institutions (vs. individual physicians) are reportable | 42 C.F.R. § 403.904(f) | Exhibit B; Individual Site Agreements | Calderwood & Harkness (Sean Morrissey) | Analyze payment flow: payments under MCTA flow to Veridian/sites (institutions); determine reporting obligation for pass-through payments to individual investigators | Pending | Prior to MCTA execution | Payments from Penterra to Veridian as central network entity, then allocated to individual sites
SA-05 | Research payment context reporting — report associated research details including protocol name and ClinicalTrials.gov identifier | 42 C.F.R. § 403.904(g) | Exhibit A — Protocol Synopsis | Penterra (Samantha Novak) | Include in all Open Payments reports: Protocol PPC-4871-III, CLARION, ClinicalTrials.gov ID NCT05928174, IND 157823, indication (advanced HCC) | Pending | At time of annual report filing | Research payment context documents allow delayed publication of payment details until FDA approval or 4 years after payment, whichever is earlier
SA-06 | Delayed publication election for research payments | 42 C.F.R. § 403.910 | N/A — Penterra internal election | Penterra (Rebecca Liang; Samantha Novak) | Determine whether Penterra elects delayed publication for research payments under CLARION trial; requires ongoing clinical investigation (IND 157823 active) | Pending | At time of annual report filing | CLARION enrollment period: 42 months (target FPI August 14, 2023 through projected last patient in February 2027)
SA-07 | Include Sunshine Act compliance representations in MCTA | 42 U.S.C. § 1320a-7h | Exhibit H — Regulatory Compliance Representations | Calderwood & Harkness | Ensure MCTA Exhibit H includes mutual covenants to cooperate on Open Payments reporting and timely provision of payment data | In Progress | Included in First Draft MCTA (April 7, 2023)
SA-08 | Track food, beverage, travel, and lodging provided to investigators in connection with CLARION trial activities | 42 C.F.R. § 403.904(a) | MCTA; PI Agreements | Penterra (Jennifer Holt, VP Clinical Operations); Meridian CRO | Coordinate with Meridian CRO (Thomas Hartwell, CEO) to capture non-monetary transfers of value at investigator meetings, site initiation visits, and advisory board meetings | Pending | Ongoing throughout trial | Meridian CRO Master Services Agreement dated January 15, 2023 governs CRO responsibilities
SA-09 | Annual attestation and data submission to CMS | 42 C.F.R. § 403.908 | N/A — Penterra internal process | Penterra (Samantha Novak) | Submit annual Open Payments report to CMS by March 31 for each preceding calendar year; first report covering 2023 payments due March 31, 2024 | Pending | March 31, 2024 (first filing)
SA-10 | Dispute resolution process for contested reported amounts with covered recipients | 42 C.F.R. § 403.912 | N/A | Penterra (Samantha Novak) | Establish internal process for addressing investigator disputes regarding reported payment amounts during the CMS review/dispute window | Pending | Prior to first filing
SA-11 | Aggregate reporting thresholds — determine whether any payments fall below de minimis reporting threshold | 42 C.F.R. § 403.904(a)(1) | Exhibit B | Penterra (Samantha Novak) | Review all payment categories against the current CMS de minimis threshold (currently $12.37/individual payment and $123.69/aggregate per covered recipient per year for non-research payments); note that research payments have no de minimis threshold | Pending | Prior to first filing | All CLARION payments substantially exceed de minimis thresholds; research payments reported regardless of amount
SA-12 | Physician ownership and investment interest reporting | 42 U.S.C. § 1320a-7h(a)(2) | Exhibit H; Financial Disclosure Certification Template | Penterra (Rebecca Liang); Calderwood & Harkness | Coordinate with 21 CFR Part 54 financial disclosure process to identify any investigators holding ownership or investment interests in Penterra (Nasdaq: PTRA); report as applicable under Open Payments ownership/investment category | Pending | Prior to first filing | Cross-reference with FD-02 and FD-08 on Financial Disclosure sheet
[sheet: HIPAA Compliance]
Item No. | Requirement / Obligation | Statutory / Regulatory Citation | Applicable MCTA Provision | Responsible Party | Compliance Action Required | Status | Due Date | Notes / Comments
HIPAA-01 | Research authorization — obtain valid HIPAA authorization from each trial subject for use/disclosure of PHI for research purposes | 45 C.F.R. § 164.508(b)(1); 45 C.F.R. § 164.512(i) | Exhibit F — Confidentiality and Data Protection Provisions | Veridian sites (investigators/coordinators); Penterra (Jennifer Holt) | Ensure informed consent forms include HIPAA-compliant research authorization; review ICF template for compliance with 45 C.F.R. § 164.508 core elements | In Progress | Prior to first patient enrollment (target FPI: August 14, 2023) | 1,200 subjects planned for enrollment across 38 sites; authorization must be obtained from each subject prior to access to PHI
HIPAA-02 | Determine whether waiver or alteration of authorization is applicable for any study activities (e.g., screening, registry review) | 45 C.F.R. § 164.512(i)(1)(i); 45 C.F.R. § 164.512(i)(2) | Exhibit F | Calderwood & Harkness; site IRBs (Graystone IRB — IRB00012847; Veridian Central IRB) | Analyze whether any pre-screening or registry-based activities require IRB/Privacy Board waiver of authorization; document analysis | Pending | Prior to IRB submissions | IRB reliance structure: Graystone IRB for PA sites; Veridian Central IRB for non-PA sites across remaining states
HIPAA-03 | Minimum necessary standard — limit PHI disclosed to Penterra and Meridian CRO to minimum necessary for research purposes | 45 C.F.R. § 164.502(b); 45 C.F.R. § 164.514(d) | Exhibit F; MCTA data transfer provisions | Veridian sites; Penterra; Meridian CRO | Define data elements to be collected in EDC (Pinnacle Data Solutions platform) and ensure only minimum necessary PHI is transmitted; use coded/de-identified data where possible | Pending | Prior to EDC system configuration | EDC vendor: Pinnacle Data Solutions, Inc., 6000 Clearwater Drive, San Diego, CA 92121; Central lab: Northbridge Bioanalytical Laboratories, Inc., 2900 Commerce Way, Baltimore, MD 21224
HIPAA-04 | Business Associate Agreements (BAAs) — execute BAAs with all entities receiving PHI on behalf of covered entities | 45 C.F.R. § 164.502(e); 45 C.F.R. § 164.504(e) | Exhibit F; Exhibit K — Approved Subcontractors List | Penterra (Rebecca Liang); Calderwood & Harkness | Confirm BAAs in place between: (i) Veridian sites and Penterra; (ii) Penterra and Meridian CRO; (iii) Penterra and Pinnacle Data Solutions; (iv) Penterra/sites and Northbridge Bioanalytical Laboratories. Ensure MCTA itself constitutes or incorporates a BAA. | Pending | Prior to MCTA execution / data transfer | Approved subcontractors per Exhibit K: Meridian CRO, Pinnacle Data Solutions, Northbridge Bioanalytical Laboratories
HIPAA-05 | De-identification standards — ensure any data shared externally (publications, regulatory submissions) is properly de-identified | 45 C.F.R. § 164.514(a)-(c) | Exhibit F; Exhibit G — IP and Publication Rights | Penterra (Dr. Marcus Yun, SVP Clinical Development); investigators | Establish de-identification procedures for publication datasets and regulatory submissions; either expert determination or safe harbor method | Pending | Prior to any data sharing/publication | Penterra retains exclusive ownership of all clinical trial data per Exhibit G
HIPAA-06 | Data security safeguards — implement administrative, physical, and technical safeguards for electronic PHI (ePHI) | 45 C.F.R. § 164.302-318 (Security Rule) | Exhibit F | All parties handling ePHI: Veridian sites, Penterra, Meridian CRO, Pinnacle Data Solutions | Confirm all parties maintain HIPAA Security Rule-compliant safeguards; include security representations in MCTA Exhibit F; verify Pinnacle EDC platform security certifications | In Progress | Prior to MCTA execution | 21 C.F.R. Part 11 electronic records requirements also applicable (see Additional Regulatory sheet)
HIPAA-07 | Breach notification obligations | 45 C.F.R. §§ 164.400-414 | Exhibit F | All parties handling PHI | Include breach notification obligations in MCTA and BAAs; specify notification timelines (without unreasonable delay, no later than 60 days from discovery) and coordination procedures among Penterra, Veridian, and subcontractors | Pending | Prior to MCTA execution | Coordinate with MCTA confidentiality provisions (10-year confidentiality term)
HIPAA-08 | Subject rights — access, amendment, accounting of disclosures for research uses of PHI | 45 C.F.R. §§ 164.524, 164.526, 164.528 | Exhibit F; ICF/authorization | Veridian sites (as covered entities) | Establish procedures at each site for responding to subject requests for access, amendment, and accounting of disclosures of PHI used in CLARION trial | Pending | Prior to first patient enrollment | Site staff training required at all 38 sites
HIPAA-09 | State privacy law preemption analysis — identify state laws more stringent than HIPAA in the 14 states where sites operate | 45 C.F.R. § 160.203 | Exhibit F; Schedule 1 — Participating Sites | Calderwood & Harkness (Christopher Aiken) | Conduct 14-state survey of state health privacy laws (e.g., state genetic privacy, substance abuse, mental health record protections) that may impose requirements more stringent than HIPAA | Pending | Prior to MCTA execution | Sites located in 14 states
HIPAA-10 | Accounting of disclosures for treatment, payment, and health care operations vs. research disclosures | 45 C.F.R. § 164.528(a)(2) | Exhibit F | Veridian sites | Confirm sites maintain accounting of research-related PHI disclosures to Penterra, Meridian CRO, and other recipients for required 6-year period | Pending | Ongoing throughout trial | Study duration: 60 months total (42-month enrollment + 18-month follow-up)
HIPAA-11 | Limited data set agreements — determine whether any study data transmissions qualify as limited data sets under HIPAA | 45 C.F.R. § 164.514(e) | Exhibit F | Calderwood & Harkness; Penterra (Dr. Marcus Yun) | Analyze whether any data flows (e.g., aggregate safety data, interim analysis datasets) may be structured as limited data sets with corresponding data use agreements rather than full PHI transmissions | Pending | Prior to EDC configuration | Limited data sets exclude direct identifiers but may include dates, geographic information
HIPAA-12 | Training — HIPAA Privacy and Security training for all site personnel with access to PHI | 45 C.F.R. § 164.530(b); 45 C.F.R. § 164.308(a)(5) | Exhibit F; MCTA training provisions | Veridian (Patricia Dunne); site investigators | Ensure all site personnel (investigators, coordinators, study nurses, data entry staff) complete HIPAA Privacy and Security training prior to accessing CLARION trial PHI; document training completion | Pending | Prior to first patient enrollment at each site | Training certification to be maintained in site regulatory binder
HIPAA-13 | Data transfer mechanisms — ensure secure transmission of PHI between sites, EDC, central lab, and sponsor | 45 C.F.R. § 164.312(e)(1) | Exhibit F; Exhibit K | Penterra (IT Security); Pinnacle Data Solutions; Northbridge Bioanalytical Laboratories | Validate encryption standards (AES-256 or equivalent) for all PHI transmissions; confirm SFTP/VPN protocols for data transfers between sites and EDC; verify central lab specimen chain-of-custody procedures minimize PHI exposure | Pending | Prior to EDC system go-live | Central lab specimens shipped with coded identifiers only; linking key maintained separately at sites
HIPAA-14 | Risk assessment — conduct HIPAA Security Rule risk assessment for CLARION trial data flows | 45 C.F.R. § 164.308(a)(1)(ii)(A) | Exhibit F | Penterra (IT Security); Meridian CRO | Perform comprehensive risk assessment of all CLARION trial PHI data flows, storage systems, and access controls; document findings and remediation plan | Pending | Prior to MCTA execution | Risk assessment to cover Pinnacle EDC, Meridian CRO CTMS, Northbridge LIMS, and all site systems
[sheet: 21 CFR Part 54 — Financial Disc]
Item No. | Requirement / Obligation | Statutory / Regulatory Citation | Applicable MCTA Provision | Responsible Party | Compliance Action Required | Status | Due Date | Notes / Comments
FD-01 | Collect financial disclosure information from all clinical investigators (Form FDA 3454 or 3455) prior to study participation | 21 C.F.R. § 54.4(a) | Exhibit H — Regulatory Compliance Representations; Exhibit I — Form of Investigator Undertaking | Penterra (Samantha Novak; Dr. Marcus Yun); Meridian CRO | Distribute Financial Disclosure Certification Template to all PIs and sub-investigators at 38 Veridian sites; collect completed certifications prior to site activation | In Progress | Prior to each site activation | Template prepared by Calderwood & Harkness (see Financial Disclosure Certification Template doc). Global PI: Dr. Catherine Aldridge (Graystone). Co-PI: Dr. Howard Matsuoka (Lakemont).
FD-02 | Financial interests requiring disclosure: compensation affected by study outcome; proprietary interest in product; significant equity in sponsor; significant payments (>$25,000) from sponsor | 21 C.F.R. § 54.2(a)-(f) | Exhibit H; Financial Disclosure Certification Template | All investigators at Veridian sites | Each investigator must certify presence or absence of: (i) compensation affected by outcome of study; (ii) proprietary interest in penterafenib (PPC-4871); (iii) significant equity interest in Penterra (Nasdaq: PTRA, market cap ~$4.2 billion); (iv) significant payments from Penterra exceeding $25,000 (other than study-related costs) | Pending | Prior to each investigator's participation | Penterra is publicly traded on Nasdaq; investigators must disclose equity holdings in PTRA
FD-03 | Sponsor (IND holder) obligation to collect, certify, and submit financial disclosures to FDA | 21 C.F.R. § 54.4(a)-(b) | MCTA; Exhibit H | Penterra (as IND holder — IND 157823); Castleton & Hargrove LLP (Dr. Priya Sundaram, Esq., regulatory counsel) | Penterra must submit either Form FDA 3454 (certification of no disclosable financial interests) or Form FDA 3455 (disclosure of financial interests) for each investigator as part of the marketing application (NDA/BLA) | Pending | At time of marketing application submission | Coordinate with Castleton & Hargrove LLP on FDA submission strategy; IND maintenance ongoing
FD-04 | Include MCTA covenant requiring investigators to update financial disclosures during study and for one year after completion | 21 C.F.R. § 54.4(a)(2) | Exhibit H; Exhibit I — Form of Investigator Undertaking; PI/Co-PI Agreements | Calderwood & Harkness; Penterra (Rebecca Liang) | Draft and include in MCTA Exhibit H and Exhibit I a covenant requiring investigators to promptly notify Penterra of any changes in financial interests during the study and for one year following study completion (projected study completion: August 2028) | In Progress | Included in First Draft MCTA (April 7, 2023) | Update obligation extends one year post-study completion to approximately August 2029
FD-05 | Maintain records of financial disclosures for required retention period | 21 C.F.R. § 54.6 | MCTA record retention provisions | Penterra (Samantha Novak) | Retain all financial disclosure forms and certifications for 2 years after FDA approval of marketing application or, if not approved, 2 years after investigation is discontinued and FDA notified | Pending | Ongoing | MCTA site records retention: 15 years post-study completion; financial disclosure retention per 21 CFR 54.6 may be shorter but MCTA retention period governs as longer
FD-06 | If disclosable financial interests exist, sponsor must describe steps taken to minimize potential bias | 21 C.F.R. § 54.4(b) | Exhibit H | Penterra; Castleton & Hargrove LLP | Develop protocols for managing identified financial conflicts, including potential measures such as excluding investigator from certain study activities, independent monitoring, or statistical analysis sensitivity testing | Pending | As needed upon receipt of disclosures | CLARION is double-blind, placebo-controlled — blinding provides inherent bias mitigation
FD-07 | Coordinate Form 1572 collection with financial disclosure collection for all investigators | 21 C.F.R. § 312.53(c); 21 C.F.R. Part 54 | MCTA; Form 1572 Preparation Memorandum | Penterra (Jennifer Holt, VP Clinical Operations); Meridian CRO | Ensure Form FDA 1572 (Statement of Investigator) and financial disclosure certification are collected concurrently from each investigator at all 38 sites; maintain coordinated tracking system | Pending | Prior to each site activation | Form 1572 guidance memorandum prepared by Calderwood & Harkness
FD-08 | Veridian Network institutional financial interests — assess whether any Veridian member institution holds equity or financial interest in Penterra | 21 C.F.R. § 54.2(e)-(f) | Exhibit H; MCTA representations | Penterra (Rebecca Liang); Veridian (Gregory Callahan, Esq.) | Request certification from Veridian and each member institution regarding institutional financial interests in Penterra or penterafenib; Veridian is a 501(c)(3) tax-exempt organization — verify investment portfolio does not include PTRA holdings | Pending | Prior to MCTA execution | Veridian EIN: 23-4178205; Graystone and Lakemont are nonprofit corporations
FD-09 | Sub-investigator financial disclosures — ensure disclosures obtained from all sub-investigators, not just PIs | 21 C.F.R. § 54.2(d) | Exhibit H; Exhibit I | Penterra (Samantha Novak); Meridian CRO | Identify all sub-investigators listed on Form 1572 at each of 38 sites; distribute and collect financial disclosure certifications from each sub-investigator prior to their participation in the study | Pending | Prior to each sub-investigator's participation | Estimated 4-6 sub-investigators per site = approximately 150-228 total sub-investigators requiring financial disclosures
FD-10 | Annual update of financial disclosures from all participating investigators | 21 C.F.R. § 54.4(a)(2); MCTA covenant | Exhibit H; Exhibit I | Penterra (Samantha Novak); Meridian CRO | Establish annual cadence for collecting updated financial disclosure certifications from all investigators and sub-investigators; track and follow up on delinquent submissions | Pending | Annually from date of initial certification | First annual update cycle anticipated August-September 2024
[sheet: Additional Regulatory (21 CFR)]
Item No. | Requirement / Obligation | Statutory / Regulatory Citation | Applicable MCTA Provision | Responsible Party | Compliance Action Required | Status | Due Date | Notes / Comments
REG-01 | Electronic records and electronic signatures must comply with 21 CFR Part 11 | 21 C.F.R. Part 11 | Exhibit F — Confidentiality and Data Protection; Exhibit J — Safety Reporting Procedures | Penterra; Pinnacle Data Solutions (EDC vendor); Meridian CRO | Confirm Pinnacle EDC platform (6000 Clearwater Drive, San Diego, CA 92121) is 21 CFR Part 11 compliant; obtain vendor certification; include Part 11 compliance representations in MCTA Exhibit F | Pending | Prior to EDC system go-live | Technology/EDC integration costs: $1,230,000 (per Exhibit B)
REG-02 | Informed consent requirements — 21 CFR Part 50 compliance for all trial subjects | 21 C.F.R. Part 50 | Exhibit H; Protocol PPC-4871-III | Veridian sites (investigators/coordinators); IRBs | Ensure ICF template complies with all Part 50 elements; ICF must be approved by applicable IRB (Graystone IRB — IRB00012847 for PA sites; Veridian Central IRB for non-PA sites) prior to use at each site | Pending | Prior to first patient enrollment at each site | Planned enrollment: 1,200 subjects (2:1 randomization — 800 treatment : 400 placebo)
REG-03 | IRB review and approval — 21 CFR Part 56 compliance | 21 C.F.R. Part 56 | MCTA IRB provisions; Schedule 1 — Participating Sites | Veridian (Dr. Lena Marchetti, Ph.D.); Graystone IRB; Veridian Central IRB | Each of 38 sites must have IRB approval prior to enrollment. Lead sites (Graystone, Lakemont) require individual IRB approval; remaining sites may rely on Veridian Central IRB under IRB Authorization Agreement per revised Common Rule | In Progress | Prior to site activation at each site; lead site IRB approvals required as closing condition precedent (satisfied July 5, 2023) | IRB reliance structure analyzed in separate memorandum
REG-04 | IND regulations — compliance with 21 CFR Part 312 for investigational new drug requirements | 21 C.F.R. Part 312 | MCTA; Exhibit A — Protocol Synopsis; Exhibit J — Safety Reporting | Penterra (as IND holder — IND 157823); Castleton & Hargrove LLP | Maintain IND in good standing; submit IND annual reports, protocol amendments, IND safety reports (7-day for fatal/life-threatening, 15-day for all others); ensure sites comply with investigator obligations under 21 CFR 312.60-312.69 | Ongoing | Throughout study duration (60 months) | IND filed October 2021; Phase II completed January 2023 (38% ORR in advanced HCC)
REG-05 | ICH E6(R2) Good Clinical Practice compliance | ICH E6(R2) | Exhibit H — Regulatory Compliance Representations | All parties: Penterra, Veridian, investigators, Meridian CRO | Include GCP compliance representations in MCTA Exhibit H; ensure Meridian CRO (9200 Corporate Boulevard, Raleigh, NC 27615) monitoring plan aligns with ICH E6(R2) risk-based monitoring requirements | In Progress | Prior to MCTA execution; ongoing throughout trial | Meridian CRO MSA dated January 15, 2023
REG-06 | SAE reporting — sites must report serious adverse events within 24 hours of awareness to Penterra and Meridian CRO | 21 C.F.R. § 312.32; ICH E6(R2) | Exhibit J — Safety Reporting Procedures | Veridian sites (investigators); Penterra (Dr. Elaine Whitford, CMO); Meridian CRO | Ensure MCTA Exhibit J specifies 24-hour SAE reporting from site to sponsor/CRO; Penterra responsible for IND safety reports to FDA (7-day and 15-day timelines) | In Progress | Prior to MCTA execution; ongoing | Safety data management per Meridian CRO agreement; central lab services by Northbridge Bioanalytical Laboratories (2900 Commerce Way, Baltimore, MD 21224)
REG-07 | Source document retention — sites must retain for minimum 15 years post-study completion | 21 C.F.R. § 312.62; ICH E6(R2) § 8 | MCTA data/records retention provisions | Veridian sites | MCTA requires site retention of source documents for minimum 15 years post-study completion (approximately until August 2043 based on projected study completion August 2028) | Pending | Included in MCTA drafting
REG-08 | Drug accountability and investigational product management at each site | 21 C.F.R. § 312.62; 21 C.F.R. § 312.69 | MCTA; Protocol PPC-4871-III; Exhibit D — Drug Supply and Accountability | Veridian sites (investigators/pharmacists); Penterra (Jennifer Holt); Meridian CRO | Ensure each of 38 sites maintains accurate drug accountability logs for penterafenib (PPC-4871) and matching placebo; verify controlled storage conditions (15-25°C) per product specifications; conduct periodic drug reconciliation | Pending | Prior to first patient enrollment at each site; ongoing | Drug supply manufactured by Penterra at Princeton facility; distributed via Pharma Logistics International, LLC
REG-09 | Protocol deviations and violations — establish reporting procedures for GCP deviations | 21 C.F.R. Part 312; ICH E6(R2) § 5.20 | MCTA; Exhibit H; Protocol PPC-4871-III | Veridian sites; Penterra (Jennifer Holt); Meridian CRO | Define protocol deviation categories (major/minor), establish reporting timelines (major deviations within 24 hours to sponsor, minor within 5 business days), and include deviation tracking in MCTA quality provisions | Pending | Prior to MCTA execution | Meridian CRO responsible for deviation tracking and trend analysis per MSA
REG-10 | Data Safety Monitoring Board (DSMB) — establish independent DSMB per protocol requirements | 21 C.F.R. § 312.32; ICH E6(R2); FDA Guidance on DSMBs | Protocol PPC-4871-III; DSMB Charter (separate document) | Penterra (Dr. Marcus Yun); Castleton & Hargrove LLP | Establish independent DSMB with charter defining composition (minimum 3 independent members including biostatistician), meeting schedule (after every 200 subjects enrolled), interim analysis plan, and stopping rules | In Progress | Prior to first patient enrollment | DSMB Chair: Dr. Franklin Osei, M.D., Ph.D. (independent oncologist, not affiliated with any Veridian site)

[sheet: Overview]

Record

Parties

Dates

Amounts