1018-00004 · Penterra Pharmaceuticals Corp · Regulatory & Compliance

hipaa-research-authorization-memo.docx DOCUMENT Finance & Banking

35 / 78 ← → ✕

MEMORANDUM

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION / ATTORNEY WORK PRODUCT

TO: Miriam Calloway, Partner, Calderwood & Harkness LLP Rebecca Liang, Esq., Associate General Counsel, Clinical Affairs, Penterra Pharmaceuticals Corp.

FROM: Sean Morrissey, Associate, Calderwood & Harkness LLP Christopher Aiken, Associate, Calderwood & Harkness LLP

DATE: April 3, 2023

RE: HIPAA Research Authorization Framework — Protocol PPC-4871-III (CLARION Trial); Master Clinical Trial Agreement with Veridian Health Research Network, Inc.

MATTER NO.: 1018-00004

Right-click to update Table of Contents

I. Executive Summary

This memorandum analyzes the requirements of the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), as implemented through the regulations set forth at 45 C.F.R. Parts 160 and 164, as they apply to the collection, use, and disclosure of protected health information ("PHI") in connection with the CLARION clinical trial (Protocol PPC-4871-III). The analysis is undertaken at the request of Penterra Pharmaceuticals Corp. and is intended to inform the structuring of the Master Clinical Trial Agreement ("MCTA") between Penterra and Veridian Health Research Network, Inc., as well as ancillary data sharing arrangements with the contract research organization, electronic data capture vendor, and central laboratory that will support the trial.

Penterra Pharmaceuticals Corp. ("Penterra" or the "Sponsor") is a Delaware corporation headquartered at 200 Biopharma Boulevard, Suite 1400, Princeton, New Jersey 08540, publicly traded on the Nasdaq Global Select Market under the ticker symbol PTRA. Penterra is sponsoring a Phase III, randomized, double-blind, placebo-controlled, multi-center clinical trial evaluating penterafenib (PPC-4871), a selective tyrosine kinase inhibitor, for the treatment of advanced hepatocellular carcinoma ("HCC") in adult patients who have progressed on or are intolerant to first-line systemic therapy. The trial is designated the CLARION trial and is governed by Protocol PPC-4871-III.

The MCTA between Penterra and Veridian Health Research Network, Inc. ("Veridian"), a Delaware 501(c)(3) corporation headquartered at 750 Research Parkway, 8th Floor, Philadelphia, Pennsylvania 19104, covers a network of 38 academic medical centers and affiliated clinical research sites located across 14 states. The total deal value of the MCTA, inclusive of per-subject payments, investigator fees, institutional overhead, and pass-through costs, is approximately $80,000,000 over the anticipated life of the trial. The planned enrollment is 1,200 subjects, randomized in a 2:1 ratio of penterafenib to placebo (800 treatment arm, 400 placebo arm), over a 42-month enrollment period, with total study duration of approximately 60 months from first patient in ("FPI") to database lock and final clinical study report.

The CLARION trial will generate a substantial volume of PHI, which will necessarily flow among multiple entities. These include the 38 Veridian Network clinical sites (each of which is a HIPAA covered entity), Penterra as the trial sponsor, Meridian Contract Research Organization, Inc. ("Meridian CRO," headquartered at 9200 Corporate Boulevard, Raleigh, North Carolina 27615), Pinnacle Data Solutions, Inc. (the electronic data capture ("EDC") vendor, headquartered at 6000 Clearwater Drive, San Diego, California 92121), and Northbridge Bioanalytical Laboratories, Inc. (the central laboratory, headquartered at 2900 Commerce Way, Baltimore, Maryland 21224). The multi-party, multi-state nature of these data flows presents significant HIPAA compliance considerations that must be addressed in the MCTA and related agreements.

Our key conclusions are as follows:

• Research Authorization Required. For the vast majority of PHI uses and disclosures in the CLARION trial, a valid individual HIPAA research authorization must be obtained from each enrolled subject prior to the disclosure of PHI by the covered entity sites. The authorization must contain all elements specified in 45 C.F.R. § 164.508(c) and should be integrated into the informed consent form for operational efficiency.

• MCTA Integration. The MCTA should incorporate a HIPAA-compliant authorization form as part of its regulatory compliance framework. The data sharing provisions in Exhibit F (Confidentiality and Data Protection Provisions) must be drafted to align with HIPAA's permissible use and disclosure requirements, and Exhibit H (Regulatory Compliance Representations and Covenants) should include specific HIPAA compliance representations from Veridian and the participating sites.

• Business Associate Agreements. Business associate agreements ("BAAs") are required for certain relationships — most critically, between the covered entity sites and Meridian CRO, Pinnacle Data Solutions, and Northbridge Bioanalytical Laboratories. The need for a BAA between the sites and Penterra is more nuanced, as discussed in detail below.

• De-Identification Pathway. For certain secondary analyses (including health economics and outcomes research, post-marketing analyses, and publications), de-identified data sets may be created under either the Expert Determination or Safe Harbor methods of 45 C.F.R. § 164.514, which would remove HIPAA restrictions on further use and disclosure.

• State Law Overlay. Because the 38 sites span 14 states, several of which have privacy laws more protective than HIPAA (including Pennsylvania, Illinois, and California), a state-by-state analysis is required to ensure the authorization form and data handling procedures comply with the most restrictive applicable law.

The sections that follow provide a detailed analysis of each of these issues and set forth specific recommendations for incorporation into the MCTA and related agreements.

II. Regulatory Background and Applicability

A. Overview of HIPAA Privacy Rule (45 C.F.R. Part 164, Subpart E)

The HIPAA Privacy Rule, codified at 45 C.F.R. Part 164, Subpart E, establishes national standards for the protection of individually identifiable health information. The Privacy Rule was promulgated by the U.S. Department of Health and Human Services ("HHS") pursuant to the administrative simplification provisions of HIPAA (Pub. L. No. 104-191) and was significantly modified by the Health Information Technology for Economic and Clinical Health Act ("HITECH Act," Pub. L. No. 111-5, Title XIII) and the 2013 Omnibus Rule (78 Fed. Reg. 5566 (Jan. 25, 2013)). The fundamental purpose of the Privacy Rule is to protect the privacy of individuals' health information while permitting the flow of health information needed to provide and promote high-quality health care and to protect the public's health and well-being.

The Privacy Rule applies to "protected health information," which is defined as individually identifiable health information that is transmitted or maintained in any form or medium, whether electronic, paper, or oral. 45 C.F.R. § 160.103. "Individually identifiable health information" is health information, including demographic data, that: (i) is created or received by a health care provider, health plan, employer, or health care clearinghouse; (ii) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual; and (iii) identifies the individual or with respect to which there is a reasonable basis to believe that the information can be used to identify the individual. Id.

It is important to distinguish between PHI generally and electronic PHI ("ePHI"). The term ePHI refers to PHI that is transmitted by or maintained in electronic media. 45 C.F.R. § 160.103. While the Privacy Rule applies to PHI in all forms, the HIPAA Security Rule (discussed in Section II.B below) applies specifically to ePHI. In the context of the CLARION trial, a substantial portion of PHI will be maintained and transmitted electronically — through the Pinnacle EDC platform, electronic safety reporting systems, and electronic communications among sites, Meridian CRO, and Penterra — making compliance with both the Privacy Rule and the Security Rule essential.

The Privacy Rule establishes a comprehensive framework governing when and how covered entities may use and disclose PHI. As a general matter, a covered entity may not use or disclose PHI except as permitted or required by the Privacy Rule. Permitted uses and disclosures include, among others, disclosures for treatment, payment, and health care operations; disclosures authorized by the individual; disclosures for public health activities; disclosures for health oversight activities; and disclosures for research purposes, subject to specific conditions. The research provisions of the Privacy Rule are of central importance to this memorandum and are analyzed in detail in Sections III through VII.

B. HIPAA Security Rule (45 C.F.R. Part 164, Subpart C)

The HIPAA Security Rule, codified at 45 C.F.R. Part 164, Subpart C, establishes national standards for the protection of ePHI. The Security Rule requires covered entities and their business associates to implement administrative safeguards (e.g., security management processes, workforce training, contingency planning), physical safeguards (e.g., facility access controls, workstation security, device and media controls), and technical safeguards (e.g., access controls, audit controls, integrity controls, transmission security) to protect the confidentiality, integrity, and availability of ePHI.

The Security Rule is directly relevant to the CLARION trial because a significant volume of ePHI will be created, transmitted, and maintained through the Pinnacle Data Solutions eClinical/EDC platform. Site coordinators will enter subject-level clinical data — including demographics, medical history, treatment administration records, adverse events, laboratory results, imaging assessments, and survival data — directly into the Pinnacle EDC system. This data will be transmitted electronically to Meridian CRO for data management, query resolution, and biostatistical analysis. Additionally, SAE reports containing subject-level PHI will be transmitted electronically from sites to Meridian CRO and Penterra within 24 hours of awareness, pursuant to Protocol PPC-4871-III's safety reporting requirements.

As an additional regulatory overlay, the electronic data capture system must also comply with the requirements of 21 C.F.R. Part 11, which governs electronic records and electronic signatures in the context of FDA-regulated activities. Part 11 requires, among other things, that electronic systems used to create, modify, maintain, archive, retrieve, or transmit electronic records employ validated systems, audit trails, system access controls, and electronic signature controls. The intersection of the HIPAA Security Rule and 21 C.F.R. Part 11 creates a dual compliance obligation for the Pinnacle EDC platform, which must satisfy both sets of requirements. The specific data security requirements applicable to the CLARION trial are discussed further in Section XII.

C. Covered Entity Analysis — Veridian Network Sites

A threshold question in any HIPAA analysis is whether the entities handling PHI are "covered entities" subject to the Privacy and Security Rules. Under HIPAA, a "covered entity" includes: (i) a health plan; (ii) a health care clearinghouse; or (iii) a health care provider who transmits any health information in electronic form in connection with a transaction for which HHS has adopted a standard (i.e., a "HIPAA-covered transaction"). 45 C.F.R. § 160.103. HIPAA-covered transactions include claims, eligibility inquiries, referral certifications, and other standard transactions specified at 45 C.F.R. Part 162.

Each of the 38 participating clinical sites within the Veridian Health Research Network is an academic medical center or affiliated research institution that provides health care services and transmits health information electronically in connection with HIPAA-covered transactions (including claims for reimbursement to Medicare, Medicaid, and private health plans). Accordingly, each site is a HIPAA covered entity, and the Privacy and Security Rules govern the sites' use and disclosure of PHI, including PHI collected in the course of the CLARION trial.

The lead sites for the trial have been identified as follows:

• Graystone University Medical Center, 1200 University Avenue, Philadelphia, Pennsylvania 19104 (designated as Site 001 in the Protocol), with Dr. Catherine Aldridge, M.D., Ph.D. serving as the principal investigator.

• Lakemont Medical Center, 4400 North Michigan Drive, Chicago, Illinois 60611 (designated as Site 002 in the Protocol), with Dr. Howard Matsuoka, M.D. serving as the principal investigator.

These and the remaining 36 Veridian Network sites conduct clinical research activities as part of their health care operations. The PHI of CLARION trial subjects — who are patients at these institutions receiving investigational treatment for advanced HCC — falls squarely within the scope of the HIPAA Privacy Rule. The sites' collection, use, and disclosure of this PHI in the research context is subject to the Privacy Rule's research provisions, which impose specific requirements (including individual authorization or a waiver thereof) as conditions for permissible use and disclosure.

D. Status of Penterra, Meridian CRO, and Other Third Parties

While the Veridian Network sites are clearly covered entities, the HIPAA status of the other parties involved in the CLARION trial requires more nuanced analysis.

Penterra Pharmaceuticals Corp. Penterra, as a pharmaceutical company and clinical trial sponsor, is not itself a covered entity under HIPAA. Penterra does not provide health care services, does not operate a health plan, and does not function as a health care clearinghouse. It does not, in the ordinary course of its business, transmit health information electronically in connection with HIPAA-covered transactions. Accordingly, Penterra is not directly subject to the Privacy or Security Rules. However, this does not mean that HIPAA is irrelevant to Penterra. To the contrary, because Penterra receives PHI from covered entities (the Veridian Network sites), it is imperative that Penterra ensure that a proper HIPAA-compliant basis exists for each such disclosure — whether through individual authorization, a waiver of authorization, or another applicable exception. Moreover, if Penterra's relationship with the sites is structured in a manner that causes Penterra to function as a "business associate" (discussed below), Penterra would become directly subject to HIPAA's requirements through that designation.

Meridian CRO. Meridian Contract Research Organization, Inc. provides a wide range of clinical trial services to Penterra under a Master Services Agreement dated January 15, 2023, including site monitoring, data management, safety reporting, biostatistical analysis, and medical writing. In performing these services, Meridian CRO receives, processes, and maintains PHI from the Veridian Network sites on an ongoing basis. The critical question is whether Meridian CRO functions as a "business associate" of the covered entity sites.

Under HIPAA, a "business associate" is a person or entity that, on behalf of a covered entity, performs or assists in the performance of a function or activity involving the use or disclosure of PHI, or provides certain services to or for a covered entity that involve the disclosure of PHI. 45 C.F.R. § 160.103. Meridian CRO's activities — which include receiving PHI directly from sites (e.g., SAE reports), accessing PHI in the EDC system for monitoring and data management purposes, and processing PHI for safety reporting to Penterra and the FDA — constitute functions performed on behalf of the sites that involve the use and disclosure of PHI. Accordingly, Meridian CRO is likely a business associate of each participating site (or, more practically, of Veridian on behalf of its network), and a BAA between Meridian CRO and the sites (or Veridian) is required. We note that this business associate relationship with the sites is separate from, and in addition to, Meridian CRO's contractual relationship with Penterra under the Master Services Agreement.

Pinnacle Data Solutions, Inc. Pinnacle hosts and operates the eClinical/EDC platform through which site coordinators enter subject-level clinical data, including PHI, for the CLARION trial. Pinnacle stores, maintains, and transmits ePHI on its servers and makes such data accessible to authorized users at the sites, Meridian CRO, and Penterra. Because Pinnacle creates, receives, maintains, or transmits ePHI on behalf of the sites (and potentially on behalf of Penterra), Pinnacle is a business associate requiring a BAA. The precise structure of Pinnacle's business associate relationships — whether Pinnacle is a business associate of the sites, of Penterra, or of both — depends on the contractual arrangements and the direction of data flows, and should be clarified in the MCTA and related agreements. At a minimum, a BAA between Pinnacle and the sites (or Veridian) and a BAA between Pinnacle and Penterra should be executed.

Northbridge Bioanalytical Laboratories, Inc. Northbridge serves as the central laboratory for the CLARION trial, receiving biospecimens (blood samples, tissue samples) from the Veridian Network sites along with associated identifying information (subject identifiers, dates of collection, clinical annotations) for pharmacokinetic/pharmacodynamic ("PK/PD") analyses, biomarker assessments, and safety laboratory testing. Because Northbridge receives PHI from covered entity sites in connection with services performed for the research study, Northbridge functions as a business associate of the sites and a BAA is required.

E. Interaction with FDA Regulatory Requirements

The HIPAA Privacy Rule's research provisions do not exist in isolation; they must be harmonized with the extensive regulatory framework governing clinical trials under the jurisdiction of the U.S. Food and Drug Administration ("FDA"). The FDA's regulations governing the protection of human subjects in clinical investigations (21 C.F.R. Part 50), institutional review boards (21 C.F.R. Part 56), and investigational new drug applications (21 C.F.R. Part 312) each impose requirements that intersect with, but are distinct from, HIPAA's requirements.

Most significantly, the HIPAA research authorization is a separate legal instrument from the informed consent required under 21 C.F.R. Part 50. Informed consent under Part 50 is a process by which a subject is informed of the nature, risks, and benefits of participation in a clinical trial and voluntarily agrees to participate. HIPAA authorization is a specific written permission from the individual authorizing a covered entity to use or disclose the individual's PHI for specified purposes. While both documents may address overlapping subject matter — and, as discussed in Section III.C below, may be combined into a single integrated document — they serve distinct regulatory purposes and must each satisfy their own respective regulatory requirements.

HIPAA expressly acknowledges the FDA's regulatory oversight role. Under 45 C.F.R. § 164.512(d), a covered entity may disclose PHI to a health oversight agency (including the FDA) for oversight activities authorized by law, including audits, investigations, inspections, and licensure or disciplinary actions. This provision permits the sites and Penterra to disclose PHI to the FDA as necessary for IND safety reporting (7-day and 15-day reports), IND annual reports, pre-approval inspections, and other regulatory interactions without the need for individual authorization.

For reference, Penterra's Investigational New Drug application for penterafenib was filed with the FDA in October 2021 under IND Number 157823. The CLARION trial has been registered on ClinicalTrials.gov under the identifier NCT05928174.

III. HIPAA Authorization for Research Use and Disclosure of PHI

A. When Authorization Is Required (45 C.F.R. § 164.508(b)–(c))

The general rule under the HIPAA Privacy Rule is that a covered entity may not use or disclose PHI for research purposes without a valid, written authorization from the individual whose PHI is at issue, unless an applicable exception (such as a waiver of authorization, preparatory-to-research review, or de-identification) applies. 45 C.F.R. § 164.508(a). This authorization requirement applies to the CLARION trial and will serve as the primary HIPAA compliance mechanism for the study.

In the CLARION trial, the 38 Veridian Network sites will collect extensive PHI from each of the 1,200 enrolled subjects over the course of the study. The categories of PHI to be collected pursuant to Protocol PPC-4871-III include, but are not limited to:

• Demographic information (name, date of birth, age, sex, race, ethnicity, contact information)

• Medical history and concomitant medications

• Physical examination findings and vital signs

• Screening and eligibility assessments, including prior treatment history for HCC

• Treatment administration records (study drug dosing, dose modifications, treatment discontinuations)

• Laboratory results (hematology, chemistry, coagulation, liver function, renal function, tumor markers) — collected at the site and at Northbridge Bioanalytical Laboratories

• Imaging data (CT, MRI) for tumor assessment under RECIST v1.1 criteria

• Adverse events and serious adverse events, including causality assessments

• Biomarker and PK/PD data from biospecimen analyses

• Survival data, including date and cause of death

Each of these data elements constitutes PHI when associated with individually identifiable information. Because the CLARION trial is a prospective clinical trial in which subjects are actively enrolled and can be approached for consent and authorization, HIPAA authorization must be obtained from each research subject prior to the initial use or disclosure of that subject's PHI for trial purposes. The authorization should be obtained at the time of enrollment, concurrently with the informed consent process under 21 C.F.R. Part 50.

As a practical matter, the authorization may be executed as either a standalone document or as an integrated component of the informed consent form. As discussed further in Section III.C below, we recommend the latter approach — combining the HIPAA authorization with the informed consent form into a single document — for reasons of operational efficiency, subject comprehension, and regulatory streamlining. However, regardless of the format chosen, the authorization must contain all of the required elements specified in the Privacy Rule.

B. Required Elements of a Valid HIPAA Authorization

The Privacy Rule prescribes specific elements that must be included in a valid HIPAA authorization. These are divided into "core elements" under 45 C.F.R. § 164.508(c)(1) and "required statements" under 45 C.F.R. § 164.508(c)(2). An authorization that fails to include any required element is defective and may not serve as a valid basis for the use or disclosure of PHI.

Core Elements (45 C.F.R. § 164.508(c)(1)). The following core elements must be included in the HIPAA authorization for the CLARION trial:

1. Description of the PHI to Be Used or Disclosed. The authorization must contain a specific and meaningful description of the categories of PHI that will be used or disclosed in connection with the trial. For the CLARION study, this description should encompass all protocol-specified data elements, including medical history, physical examination findings, laboratory results (including those generated by Northbridge Bioanalytical Laboratories), diagnostic imaging data, adverse event and serious adverse event reports, pharmacokinetic and pharmacodynamic data from biospecimen analyses, biomarker data, treatment records, and survival outcomes. The description should be sufficiently specific to inform the subject of the types of health information that will be shared, while being broad enough to encompass all data collection required by Protocol PPC-4871-III.

2. Names or Classes of Persons Authorized to Make the Use or Disclosure. The authorization must identify who is authorized to use or disclose the subject's PHI. In the CLARION trial, this includes the Veridian Network site at which the subject is enrolled and the principal investigator and study staff at that site. For example, at Site 001 (Graystone University Medical Center), the authorization would identify Graystone University Medical Center and Dr. Catherine Aldridge, M.D., Ph.D. as the principal investigator; at Site 002 (Lakemont Medical Center), the authorization would identify Lakemont Medical Center and Dr. Howard Matsuoka, M.D. The template authorization form should use a structure that permits site-specific customization of this element while maintaining uniformity across the 38-site network.

3. Names or Classes of Persons Authorized to Receive the PHI. The authorization must identify who may receive the subject's PHI. For the CLARION trial, the recipients include:

• Penterra Pharmaceuticals Corp. (Sponsor)

• Meridian Contract Research Organization, Inc. (CRO)

• The U.S. Food and Drug Administration and other regulatory authorities as required by law

• Institutional Review Boards, including the Graystone University Institutional Review Board (IRB Registration No. IRB00012847) and the Veridian Central IRB, as well as any other IRBs with oversight authority

• Pinnacle Data Solutions, Inc. (EDC vendor)

• Northbridge Bioanalytical Laboratories, Inc. (central laboratory)

• Data Safety Monitoring Board members

• Other parties as required by law or regulation

The authorization may identify recipients by name or by class (e.g., "the Sponsor's contract research organization," "the central laboratory"), provided the description is sufficiently specific to inform the subject. We recommend identifying the primary recipients by name for transparency.

4. Description of Each Purpose of the Requested Use or Disclosure. The authorization must describe the purpose for which the PHI will be used or disclosed. For the CLARION trial, the stated purpose should be: "Clinical research under Protocol PPC-4871-III (the CLARION trial), a Phase III clinical study evaluating the investigational drug penterafenib (PPC-4871) for the treatment of advanced hepatocellular carcinoma, including data collection, analysis, safety monitoring, regulatory reporting, and publication of study results."

5. Expiration Date or Expiration Event. The authorization must include an expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure. The Privacy Rule permits the use of the statement "end of the research study" as the expiration event for a research authorization. 45 C.F.R. § 164.508(c)(1)(v). We recommend using the following formulation: "This authorization does not have an expiration date. It will remain in effect until the end of the CLARION research study (projected to be completed in approximately August 2028), plus such additional period as may be necessary for Penterra Pharmaceuticals Corp. and its authorized representatives to complete analysis, regulatory reporting, and document retention activities." This formulation accounts for the 60-month study duration as well as the 15-year document retention period specified in the MCTA, during which access to PHI may be necessary for regulatory compliance purposes.

6. Signature and Date. The authorization must be signed and dated by the individual (research subject) or the individual's personal representative. If signed by a personal representative, the authorization must describe such representative's authority to act for the individual.

Required Statements (45 C.F.R. § 164.508(c)(2)). In addition to the core elements, the following statements must be included in the authorization:

1. Right to Revoke. The authorization must include a statement informing the individual of the right to revoke the authorization in writing, and must describe the exceptions to the right to revoke and how the individual may revoke authorization. The authorization should state: "You have the right to withdraw (revoke) this authorization at any time by providing written notice to the study investigator at [site name and address]. If you withdraw this authorization, no new health information about you will be gathered for the study after that point. However, health information that was already gathered or shared before you withdrew your authorization may continue to be used and disclosed as described in this authorization, to the extent necessary to maintain the integrity of the research."

2. Consequences of Refusing to Sign. The authorization must include a statement regarding the ability or inability to condition treatment, payment, enrollment, or eligibility for benefits on the authorization. Under 45 C.F.R. § 164.508(b)(4)(i), a covered entity may condition the provision of research-related treatment on the individual's provision of authorization for the use or disclosure of PHI for such research. Accordingly, the authorization should state: "Your participation in the CLARION clinical trial is voluntary. However, if you do not sign this authorization, you will not be able to participate in the study. Refusing to sign this authorization will not affect your ability to receive standard medical treatment at [site name]."

3. Potential for Re-Disclosure. The authorization must include a statement that PHI disclosed pursuant to the authorization may be subject to re-disclosure by the recipient and may no longer be protected by the HIPAA Privacy Rule. This is particularly important because several of the recipients identified in the authorization (including Penterra, Meridian CRO, Pinnacle, and Northbridge) may not themselves be HIPAA covered entities. The authorization should state: "Health information disclosed under this authorization may be subject to re-disclosure by the recipient and may no longer be protected by federal privacy regulations (HIPAA). However, Penterra Pharmaceuticals Corp. and its authorized representatives are required to protect your health information in accordance with applicable laws and the terms of the research agreement."

C. Research-Specific Authorization Provisions (45 C.F.R. § 164.508(b)(3))

The Privacy Rule includes several provisions specifically tailored to research authorizations.

Compound Authorizations. Under 45 C.F.R. § 164.508(b)(3)(i), an authorization for the use or disclosure of PHI for research may be combined with any other type of written permission for the same or another research study. This includes combining the HIPAA authorization with the informed consent form required under 21 C.F.R. Part 50. We recommend integrating the HIPAA authorization language into the CLARION informed consent document as a clearly identified and distinct section. This integrated approach offers several advantages: it reduces the administrative burden on site coordinators and subjects by requiring only one signature event; it provides subjects with a comprehensive view of both the research participation and data privacy dimensions of the study; and it is consistent with HHS Office for Civil Rights guidance and FDA guidance documents that have endorsed the practice of combining research authorization with informed consent.

We note, however, that the combined document must clearly delineate the HIPAA authorization provisions from the informed consent provisions, and the authorization section must include all required elements set forth in Section III.B above, regardless of whether similar information appears elsewhere in the informed consent form. The HIPAA authorization section should be clearly labeled and should be drafted so that a reasonable person would understand that by signing, they are both consenting to participate in the research study and authorizing the use and disclosure of their PHI.

Authorization for Future Research. Under 45 C.F.R. § 164.508(b)(3)(iii), a covered entity may use or disclose PHI for future research purposes if the authorization adequately describes such future research such that it would be reasonable for the individual to expect that his or her PHI could be used or disclosed for such future research. If Penterra anticipates that CLARION trial data may be used for secondary research purposes beyond the specific objectives of Protocol PPC-4871-III — for example, exploratory biomarker analyses, health economics and outcomes research ("HEOR"), post-marketing safety analyses, or future clinical development of penterafenib — the authorization must either adequately describe such future uses or a separate authorization must be obtained at a later time. We recommend including language in the authorization that describes potential future research uses in sufficiently specific terms to satisfy this requirement, while acknowledging that any future use not adequately described in the authorization would require separate authorization or an alternative HIPAA-compliant basis (such as de-identification or a waiver of authorization).

State Law Overlay. The HIPAA authorization is a federal requirement, but it does not preempt more protective state privacy laws. As discussed in Section XI below, several of the 14 states in which Veridian Network sites are located impose additional requirements for the authorization or consent of individuals prior to the use or disclosure of health information. Notably, Pennsylvania, Illinois, and California each have state-specific privacy protections that may require additional authorization language or procedural safeguards beyond those mandated by HIPAA. Because the CLARION trial will use a uniform template authorization form across all 38 sites, the template must be drafted to comply with the most restrictive applicable law. This may necessitate state-specific addenda or supplemental language for sites located in states with particularly stringent requirements.

D. Template Authorization Form for the MCTA

We recommend that the MCTA include a template HIPAA authorization form as either: (i) an appendix to the MCTA itself; (ii) an attachment to Exhibit F (Confidentiality and Data Protection Provisions); or (iii) a cross-reference to a separately maintained authorization form template that is incorporated by reference. The template form should be protocol-specific to PPC-4871-III (CLARION) and should include all required elements and statements discussed in Sections III.B and III.C above.

Prior to use, the template authorization form must be reviewed and approved by the relevant IRBs. For sites in the Veridian Network, the IRB review structure is as follows:

• Graystone University Institutional Review Board (IRB Registration No. IRB00012847): Primary IRB of record for Site 001 (Graystone University Medical Center) and, under IRB Authorization Agreements, potentially for other Pennsylvania-based Veridian sites.

• Veridian Central IRB: Central IRB serving as the IRB of record for the remaining Veridian Network sites under an IRB Authorization Agreement structure, consistent with the NIH single-IRB policy and FDA guidance on the use of central IRBs.

The template authorization form should be circulated to both IRBs for review concurrently with the informed consent form, and any IRB-required modifications should be incorporated into the final template prior to site activation and subject enrollment.

IV. Waiver or Alteration of Authorization for Research (45 C.F.R. § 164.512(i))

A. IRB/Privacy Board Waiver Criteria

The HIPAA Privacy Rule provides that a covered entity may use or disclose PHI for research without individual authorization if an IRB or Privacy Board has approved a waiver or alteration of the authorization requirement. 45 C.F.R. § 164.512(i)(1)(i). This waiver mechanism is intended for situations in which obtaining individual authorization is impracticable or would compromise the scientific validity or feasibility of the research.

To approve a waiver or alteration of authorization, the IRB or Privacy Board must determine that the following three criteria are satisfied:

1. Minimal Risk to Privacy. The use or disclosure of PHI involves no more than minimal risk to the privacy of individuals. This determination requires the IRB or Privacy Board to find that: (a) there is an adequate plan to protect the identifiers from improper use and disclosure; (b) there is an adequate plan to destroy the identifiers at the earliest opportunity consistent with conduct of the research, unless there is a health or research justification for retaining the identifiers or such retention is otherwise required by law; and (c) there are adequate written assurances that the PHI will not be reused or re-disclosed to any other person or entity, except as required by law, for authorized oversight of the research study, or for other research for which the use or disclosure of PHI would be permitted under the Privacy Rule.

2. Impracticability Without Waiver. The research could not practicably be conducted without the waiver or alteration of the authorization requirement. This criterion requires a showing that obtaining individual authorization from each subject whose PHI is needed would be so burdensome as to render the research impracticable — for example, because the research involves a large retrospective cohort, subjects cannot be located, or obtaining authorization would introduce selection bias.

3. Necessity of PHI. The research could not practicably be conducted without access to and use of the PHI. This criterion requires a showing that de-identified data or other non-PHI sources would be insufficient for the research purposes.

The IRB or Privacy Board must document its waiver approval in writing. The documentation must include: (i) identification and authority of the approving IRB or Privacy Board; (ii) findings with respect to each of the three waiver criteria; (iii) a brief description of the PHI for which use or disclosure has been determined to be necessary; (iv) the date of the waiver approval; and (v) the signature of the IRB chair or Privacy Board chair (or designated representative). 45 C.F.R. § 164.512(i)(2).

B. Applicability to the CLARION Trial

For the primary CLARION trial enrollment of 1,200 subjects, a waiver of authorization is generally not appropriate. The CLARION trial is a prospective clinical trial in which subjects are actively recruited, screened, and enrolled. Each subject has direct contact with the study team and undergoes an informed consent process. There is no impracticability barrier to obtaining HIPAA authorization at the time of enrollment. Indeed, as discussed in Section III.C above, the HIPAA authorization can and should be integrated into the informed consent form, making its execution a seamless part of the enrollment process. Seeking a waiver of authorization for prospectively enrolled subjects would be difficult to justify under the waiver criteria and could expose the sites and Penterra to regulatory risk.

However, there are several narrower scenarios in which a waiver of authorization may be appropriate or necessary:

• Pre-Enrollment Screening / Preparatory to Research. As discussed in Section V below, site investigators may need to review patient medical records at their institutions to identify potentially eligible subjects with advanced HCC prior to approaching those patients for enrollment. This activity may be addressed under the preparatory-to-research exception (45 C.F.R. § 164.512(i)(1)(ii)), which does not require a waiver, but if PHI must be removed from the covered entity during the screening process (e.g., to create screening logs with patient identifiers), a waiver of authorization may be necessary.

• Retrospective Chart Review. If Penterra or Meridian CRO determines during the course of the trial that a safety signal requires a retrospective review of enrolled subjects' medical records beyond the data elements captured in the CRFs, a waiver of authorization may be sought from the IRB to permit this targeted review, particularly for subjects who have been lost to follow-up, have withdrawn from the study, or have died.

• Deceased Subjects. HIPAA provides a separate provision for the use and disclosure of PHI of deceased individuals for research purposes. Under 45 C.F.R. § 164.512(i)(1)(iii), a covered entity may use or disclose PHI of a decedent for research purposes, provided the researcher represents that the use or disclosure is solely for research on the PHI of decedents, that the PHI sought is necessary for the research, and (upon request) provides documentation of the death of the individuals about whom information is sought. Given that the CLARION trial enrolls patients with advanced HCC — a disease with a significant mortality rate — this provision may be relevant for ongoing data collection on subjects who die during the study.

Recommendation. We recommend that Penterra rely on full HIPAA authorization for all prospectively enrolled subjects and seek waivers of authorization only for narrow, well-defined preparatory or ancillary research activities. Any waiver requests should be submitted to and documented by the Graystone IRB (for Graystone-related activities) or the Veridian Central IRB (for network-wide or other site-specific activities), with appropriate documentation retained in the study regulatory binder.

C. Alteration of Authorization

An alteration of authorization is a lesser modification than a full waiver and permits the use of an authorization form that omits one or more of the normally required elements. 45 C.F.R. § 164.512(i)(1)(i). For example, an alteration might permit the use of an authorization that does not include the names of specific recipients if such identification would be impracticable.

An alteration of authorization may be relevant if Penterra wishes to receive limited data sets (see Section VI below) rather than full PHI for certain secondary analyses. An altered authorization might, for example, omit certain identifying information from the authorization form to align with the more limited scope of PHI being disclosed. However, the same three criteria that apply to a full waiver (minimal risk, impracticability, necessity) must be satisfied before an IRB or Privacy Board can approve an alteration.

At this stage of the CLARION trial planning, we do not anticipate that an alteration of authorization will be needed for the primary study activities. If a need arises during the course of the trial, we will advise on the applicable requirements at that time.

V. Reviews Preparatory to Research (45 C.F.R. § 164.512(i)(1)(ii))

The HIPAA Privacy Rule provides a specific exception that permits covered entities to use or disclose PHI for reviews preparatory to research without obtaining individual authorization and without an IRB or Privacy Board waiver. Under 45 C.F.R. § 164.512(i)(1)(ii), a covered entity may use or disclose PHI for this purpose provided the following three conditions are met:

1. Purpose Limitation. The use or disclosure of PHI is sought solely for the purpose of preparing a research protocol or for similar purposes preparatory to research.

2. No Removal of PHI. No PHI is removed from the covered entity by the researcher during the review. The PHI must remain within the covered entity's systems and cannot be recorded, copied, or taken off-site.

3. Necessity. The PHI sought by the researcher is necessary for the preparatory research purposes.

Additionally, the researcher must provide the covered entity with a representation, which may be oral or written, that the above conditions are satisfied.

Application to the CLARION Trial. The preparatory-to-research exception is directly relevant to the CLARION trial's subject recruitment process. Site investigators — including Dr. Aldridge at Graystone and Dr. Matsuoka at Lakemont — may need to review patient charts and electronic health records at their respective institutions to identify patients with advanced hepatocellular carcinoma who may be eligible for enrollment in the CLARION trial based on Protocol PPC-4871-III's inclusion and exclusion criteria. This preliminary chart review is a classic example of a "review preparatory to research" under the Privacy Rule.

Under this exception, investigators may access and review PHI in existing medical records for the purpose of identifying potentially eligible patients, assessing the feasibility of enrollment targets, and determining whether individual patients meet the study's inclusion and exclusion criteria. However, the investigators may not remove PHI from the covered entity during this process. This means, for example, that an investigator may review a patient's chart to determine whether the patient has a confirmed diagnosis of HCC, has progressed on first-line systemic therapy, and meets other eligibility criteria, but the investigator may not create a screening log that includes patient names, medical record numbers, or other PHI and transmit that log to Penterra or Meridian CRO. The screening log that is shared externally must be limited to de-identified information or must rely on a separate HIPAA-compliant basis for disclosure.

We recommend that the MCTA address the preparatory-to-research exception in Exhibit H (Regulatory Compliance Representations and Covenants) by including clear guidance to sites on the scope and limitations of this exception. Specifically, the MCTA should:

• Acknowledge that investigators may conduct preparatory-to-research reviews of patient records at their institutions for the purpose of identifying potentially eligible CLARION subjects.

• Remind sites that no PHI may be removed from the site during preparatory reviews.

• Require investigators to provide the requisite representation to the site's privacy officer or designated HIPAA compliance personnel prior to initiating such reviews.

• Include language in site training materials — to be delivered by Penterra's clinical operations team (Jennifer Holt, VP, Clinical Operations; Samantha Novak, Director, Clinical Contracts) in coordination with Meridian CRO — on the proper application of the preparatory-to-research exception.

VI. Limited Data Sets (45 C.F.R. § 164.514(e))

A. Definition and Permissible Uses

A "limited data set" is a category of health information that has been stripped of certain direct identifiers but that may retain other potentially identifying information. Specifically, a limited data set excludes the following 16 categories of direct identifiers of the individual and of the individual's relatives, employers, and household members: (i) names; (ii) postal address information other than town or city, state, and zip code; (iii) telephone numbers; (iv) fax numbers; (v) email addresses; (vi) Social Security numbers; (vii) medical record numbers; (viii) health plan beneficiary numbers; (ix) account numbers; (x) certificate/license numbers; (xi) vehicle identifiers and serial numbers including license plate numbers; (xii) device identifiers and serial numbers; (xiii) web URLs; (xiv) IP addresses; (xv) biometric identifiers; and (xvi) full-face photographic images.

Notably, a limited data set may include dates (including dates of admission, discharge, service, birth, and death), geographic information at the city, state, and zip code level, and ages (including ages over 89, which must be aggregated to a single category of "90 or older" for Safe Harbor de-identification but may be retained in a limited data set).

A covered entity may use or disclose a limited data set for research purposes, provided the covered entity enters into a Data Use Agreement ("DUA") with the recipient. 45 C.F.R. § 164.514(e)(1). The DUA must include provisions that: (i) establish the permitted uses and disclosures of the limited data set by the recipient; (ii) identify who is permitted to use or receive the limited data set; and (iii) require the recipient to agree not to use or further disclose the information other than as permitted by the DUA or as otherwise required by law, to use appropriate safeguards to prevent use or disclosure other than as provided by the DUA, to report to the covered entity any use or disclosure not provided for in the DUA of which the recipient becomes aware, to ensure that any agents or subcontractors who receive the limited data set agree to the same restrictions, and not to identify or contact any individual. 45 C.F.R. § 164.514(e)(4).

B. Applicability to CLARION Trial Data Flows

The limited data set pathway has limited utility for the primary clinical trial data collection in the CLARION study. The core clinical data collected under Protocol PPC-4871-III will necessarily include certain direct identifiers — particularly medical record numbers (maintained at the site level for source data verification purposes), dates of birth (needed for age eligibility and dosing calculations), and potentially subject initials (depending on country-specific regulatory requirements and site practices). The inclusion of these identifiers means that the clinical trial dataset as a whole does not qualify as a limited data set, and the full HIPAA authorization pathway must be used for the primary study activities.

However, limited data sets may be a useful and appropriate mechanism for certain secondary and ancillary data uses, including:

• Post-Trial Epidemiological Analyses. If Penterra or its academic collaborators wish to conduct epidemiological analyses using CLARION trial data after the completion of the primary study, a limited data set that retains dates and geographic information but strips direct identifiers may be sufficient for these purposes. A DUA between the Veridian sites and Penterra (or the academic collaborators) would be required.

• Health Economics and Outcomes Research (HEOR). Penterra's HEOR team may seek access to CLARION trial data for health economic modeling, cost-effectiveness analyses, or real-world evidence studies. To the extent that such analyses can be conducted using a limited data set, the DUA pathway offers a streamlined alternative to obtaining individual authorizations for secondary research.

• Academic Publications. Investigators at the Veridian Network sites may wish to publish individual-level data from the CLARION trial in peer-reviewed journals. Where such publications require subject-level data that cannot be fully de-identified (e.g., case reports, subgroup analyses by date of event or geographic region), a limited data set under a DUA may provide a compliant pathway.

If the limited data set pathway is utilized for any of these purposes, the DUA should be structured as either: (i) a standalone agreement between the disclosing site(s) and the recipient(s); (ii) an addendum to the MCTA; or (iii) an exhibit to the intellectual property side letter governing data ownership and publication rights. The choice of vehicle will depend on the specific circumstances and the parties' preferences, and we are available to advise on the optimal structure as the need arises.

VII. De-Identification of PHI (45 C.F.R. § 164.514(a)–(c))

A. Two Methods of De-Identification

Under the HIPAA Privacy Rule, health information that has been de-identified in accordance with 45 C.F.R. § 164.514 is no longer considered PHI and is therefore not subject to the Privacy Rule's restrictions on use and disclosure. De-identification may be achieved through one of two methods:

1. Expert Determination Method (§ 164.514(b)(1)). Under this method, a person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for rendering information not individually identifiable determines that the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an individual who is a subject of the information. The expert must apply statistical or scientific principles to make this determination and must document the methods and results of the analysis that justify the determination. This method offers greater flexibility than the Safe Harbor method because it does not require removal of specific enumerated identifiers, but it requires the engagement of a qualified statistical expert and the preparation of a formal written determination.

2. Safe Harbor Method (§ 164.514(b)(2)). Under this method, de-identification is achieved by removing 18 categories of identifiers: (i) names; (ii) geographic subdivisions smaller than a state (except for the initial three digits of a zip code if certain population thresholds are met); (iii) dates (except year) directly related to an individual, and all ages over 89 (aggregated to a single category of "90 or older"); (iv) telephone numbers; (v) fax numbers; (vi) email addresses; (vii) Social Security numbers; (viii) medical record numbers; (ix) health plan beneficiary numbers; (x) account numbers; (xi) certificate/license numbers; (xii) vehicle identifiers and serial numbers; (xiii) device identifiers and serial numbers; (xiv) web URLs; (xv) IP addresses; (xvi) biometric identifiers; (xvii) full-face photographs and comparable images; and (xviii) any other unique identifying number, characteristic, or code. Additionally, the covered entity must have no actual knowledge that the residual information could be used, alone or in combination, to identify an individual.

B. Application to the CLARION Trial

De-identification is a powerful tool for enabling secondary uses of clinical trial data that fall outside the scope of the original HIPAA authorization. Under the MCTA, Penterra retains exclusive ownership of all clinical trial data generated in connection with Protocol PPC-4871-III. Once trial data is de-identified in accordance with either the Expert Determination or Safe Harbor method, HIPAA's restrictions on use and disclosure no longer apply, and the de-identified data may be used and shared for a wide range of purposes without further HIPAA authorization or compliance obligations.

Specific applications of de-identified data in the CLARION trial context include:

• Regulatory Submissions to FDA. Although the FDA typically receives coded data (with subject identification numbers but without direct identifiers such as names or Social Security numbers), the data submitted in regulatory filings is generally not fully de-identified under the Safe Harbor standard because it may include dates and other elements. However, for certain types of submissions — such as summary data presentations, integrated summary of safety and efficacy documents, and advisory committee briefing materials — fully de-identified data may be appropriate.

• Publications and Presentations. De-identified data may be used for scientific publications in peer-reviewed journals, presentations at medical conferences, and other academic dissemination activities without triggering HIPAA requirements.

• Post-Marketing Analyses. If penterafenib receives marketing approval, de-identified data from the CLARION trial may be used for post-marketing safety analyses, comparative effectiveness research, and real-world evidence generation.

• Data Sharing with Third Parties. We note that Penterra has been approached by Ridgeline Capital Markets regarding potential investor-facing analyses of the CLARION trial data. Any sharing of de-identified data with Ridgeline or other financial entities must comply not only with HIPAA de-identification standards but also with applicable securities laws (including Regulation FD) and the confidentiality obligations under the MCTA and related agreements. The fact that data is de-identified under HIPAA does not eliminate other legal constraints on its disclosure.

Coded Data Analysis. A significant practical question arises with respect to coded data — that is, data in which direct identifiers have been replaced with a code (such as a subject identification number), with a master key linking the code to the individual's identity maintained separately. Under the HIPAA Privacy Rule, coded data may be considered de-identified under the Safe Harbor method only if: (a) the code is not derived from or related to information about the individual (e.g., the code is not the individual's medical record number, Social Security number, or initials); and (b) the covered entity does not use or disclose the code or any mechanism for re-identification. 45 C.F.R. § 164.514(c).

In the CLARION trial, each enrolled subject will be assigned a unique subject identification number (screening number and randomization number) within the Pinnacle EDC system. The sites will maintain a master linking log that connects each subject identification number to the subject's identity (name, medical record number, date of birth). Penterra and Meridian CRO will receive only coded data (identified by subject number) and will not have access to the master linking log.

For this structure to satisfy HIPAA's de-identification requirements, it is critical that:

1. The subject identification numbering system used in the Pinnacle EDC system is not derived from PHI. The screening numbers and randomization numbers should be system-generated sequential or random numbers that bear no relationship to the subject's name, date of birth, medical record number, or other identifier.

2. The master linking log is maintained exclusively at the site level and is not shared with Penterra, Meridian CRO, or any other entity outside the covered entity.

3. Neither Penterra nor Meridian CRO has the ability to re-identify subjects using the coded data and any other information in their possession.

Recommendation. We recommend that the Pinnacle EDC system be configured to generate subject identification numbers that are purely sequential or algorithmically random and that are not derived from any PHI. Sites should be instructed to maintain master linking logs as confidential documents stored at the site, accessible only to authorized site personnel. The MCTA and BAAs should include provisions confirming that Penterra and Meridian CRO will not attempt to re-identify subjects using coded data and that the master linking log will not be disclosed to any party outside the site. This structure will maximize the applicability of the de-identification pathway for secondary uses of CLARION trial data.

VIII. Data Sharing Architecture and Business Associate Agreements

A. PHI Data Flow Mapping for the CLARION Trial

Understanding the HIPAA compliance requirements for the CLARION trial requires a clear mapping of the data flows through which PHI moves among the various parties. Based on our review of Protocol PPC-4871-III, the draft MCTA, and the Meridian CRO Master Services Agreement, the following data flows have been identified:

Flow 1: Site → Pinnacle EDC Platform. Site coordinators and investigators at each of the 38 Veridian Network sites will enter subject-level clinical data — including demographics, medical history, physical examination findings, treatment records, adverse events, laboratory results, and imaging assessments — into the Pinnacle Data Solutions eClinical/EDC platform. This data entry constitutes the transmission of ePHI from the covered entity sites to Pinnacle's hosted platform and represents the primary mechanism by which PHI enters the electronic data management ecosystem for the CLARION trial.

Flow 2: Site → Northbridge Bioanalytical Laboratories. Sites will ship biospecimens (blood samples, tissue sa

MEMORANDUM
PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION / ATTORNEY WORK PRODUCT
TO: Miriam Calloway, Partner, Calderwood & Harkness LLP Rebecca Liang, Esq., Associate General Counsel, Clinical Affairs, Penterra Pharmaceuticals Corp.
FROM: Sean Morrissey, Associate, Calderwood & Harkness LLP Christopher Aiken, Associate, Calderwood & Harkness LLP
DATE: April 3, 2023
RE: HIPAA Research Authorization Framework — Protocol PPC-4871-III (CLARION Trial); Master Clinical Trial Agreement with Veridian Health Research Network, Inc.
MATTER NO.: 1018-00004
Right-click to update Table of Contents
I. Executive Summary
This memorandum analyzes the requirements of the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), as implemented through the regulations set forth at 45 C.F.R. Parts 160 and 164, as they apply to the collection, use, and disclosure of protected health information ("PHI") in connection with the CLARION clinical trial (Protocol PPC-4871-III). The analysis is undertaken at the request of Penterra Pharmaceuticals Corp. and is intended to inform the structuring of the Master Clinical Trial Agreement ("MCTA") between Penterra and Veridian Health Research Network, Inc., as well as ancillary data sharing arrangements with the contract research organization, electronic data capture vendor, and central laboratory that will support the trial.
Penterra Pharmaceuticals Corp. ("Penterra" or the "Sponsor") is a Delaware corporation headquartered at 200 Biopharma Boulevard, Suite 1400, Princeton, New Jersey 08540, publicly traded on the Nasdaq Global Select Market under the ticker symbol PTRA. Penterra is sponsoring a Phase III, randomized, double-blind, placebo-controlled, multi-center clinical trial evaluating penterafenib (PPC-4871), a selective tyrosine kinase inhibitor, for the treatment of advanced hepatocellular carcinoma ("HCC") in adult patients who have progressed on or are intolerant to first-line systemic therapy. The trial is designated the CLARION trial and is governed by Protocol PPC-4871-III.
The MCTA between Penterra and Veridian Health Research Network, Inc. ("Veridian"), a Delaware 501(c)(3) corporation headquartered at 750 Research Parkway, 8th Floor, Philadelphia, Pennsylvania 19104, covers a network of 38 academic medical centers and affiliated clinical research sites located across 14 states. The total deal value of the MCTA, inclusive of per-subject payments, investigator fees, institutional overhead, and pass-through costs, is approximately $80,000,000 over the anticipated life of the trial. The planned enrollment is 1,200 subjects, randomized in a 2:1 ratio of penterafenib to placebo (800 treatment arm, 400 placebo arm), over a 42-month enrollment period, with total study duration of approximately 60 months from first patient in ("FPI") to database lock and final clinical study report.
The CLARION trial will generate a substantial volume of PHI, which will necessarily flow among multiple entities. These include the 38 Veridian Network clinical sites (each of which is a HIPAA covered entity), Penterra as the trial sponsor, Meridian Contract Research Organization, Inc. ("Meridian CRO," headquartered at 9200 Corporate Boulevard, Raleigh, North Carolina 27615), Pinnacle Data Solutions, Inc. (the electronic data capture ("EDC") vendor, headquartered at 6000 Clearwater Drive, San Diego, California 92121), and Northbridge Bioanalytical Laboratories, Inc. (the central laboratory, headquartered at 2900 Commerce Way, Baltimore, Maryland 21224). The multi-party, multi-state nature of these data flows presents significant HIPAA compliance considerations that must be addressed in the MCTA and related agreements.
Our key conclusions are as follows:
• Research Authorization Required. For the vast majority of PHI uses and disclosures in the CLARION trial, a valid individual HIPAA research authorization must be obtained from each enrolled subject prior to the disclosure of PHI by the covered entity sites. The authorization must contain all elements specified in 45 C.F.R. § 164.508(c) and should be integrated into the informed consent form for operational efficiency.
• MCTA Integration. The MCTA should incorporate a HIPAA-compliant authorization form as part of its regulatory compliance framework. The data sharing provisions in Exhibit F (Confidentiality and Data Protection Provisions) must be drafted to align with HIPAA's permissible use and disclosure requirements, and Exhibit H (Regulatory Compliance Representations and Covenants) should include specific HIPAA compliance representations from Veridian and the participating sites.
• Business Associate Agreements. Business associate agreements ("BAAs") are required for certain relationships — most critically, between the covered entity sites and Meridian CRO, Pinnacle Data Solutions, and Northbridge Bioanalytical Laboratories. The need for a BAA between the sites and Penterra is more nuanced, as discussed in detail below.
• De-Identification Pathway. For certain secondary analyses (including health economics and outcomes research, post-marketing analyses, and publications), de-identified data sets may be created under either the Expert Determination or Safe Harbor methods of 45 C.F.R. § 164.514, which would remove HIPAA restrictions on further use and disclosure.
• State Law Overlay. Because the 38 sites span 14 states, several of which have privacy laws more protective than HIPAA (including Pennsylvania, Illinois, and California), a state-by-state analysis is required to ensure the authorization form and data handling procedures comply with the most restrictive applicable law.
The sections that follow provide a detailed analysis of each of these issues and set forth specific recommendations for incorporation into the MCTA and related agreements.
II. Regulatory Background and Applicability
A. Overview of HIPAA Privacy Rule (45 C.F.R. Part 164, Subpart E)
The HIPAA Privacy Rule, codified at 45 C.F.R. Part 164, Subpart E, establishes national standards for the protection of individually identifiable health information. The Privacy Rule was promulgated by the U.S. Department of Health and Human Services ("HHS") pursuant to the administrative simplification provisions of HIPAA (Pub. L. No. 104-191) and was significantly modified by the Health Information Technology for Economic and Clinical Health Act ("HITECH Act," Pub. L. No. 111-5, Title XIII) and the 2013 Omnibus Rule (78 Fed. Reg. 5566 (Jan. 25, 2013)). The fundamental purpose of the Privacy Rule is to protect the privacy of individuals' health information while permitting the flow of health information needed to provide and promote high-quality health care and to protect the public's health and well-being.
The Privacy Rule applies to "protected health information," which is defined as individually identifiable health information that is transmitted or maintained in any form or medium, whether electronic, paper, or oral. 45 C.F.R. § 160.103. "Individually identifiable health information" is health information, including demographic data, that: (i) is created or received by a health care provider, health plan, employer, or health care clearinghouse; (ii) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual; and (iii) identifies the individual or with respect to which there is a reasonable basis to believe that the information can be used to identify the individual. Id.
It is important to distinguish between PHI generally and electronic PHI ("ePHI"). The term ePHI refers to PHI that is transmitted by or maintained in electronic media. 45 C.F.R. § 160.103. While the Privacy Rule applies to PHI in all forms, the HIPAA Security Rule (discussed in Section II.B below) applies specifically to ePHI. In the context of the CLARION trial, a substantial portion of PHI will be maintained and transmitted electronically — through the Pinnacle EDC platform, electronic safety reporting systems, and electronic communications among sites, Meridian CRO, and Penterra — making compliance with both the Privacy Rule and the Security Rule essential.
The Privacy Rule establishes a comprehensive framework governing when and how covered entities may use and disclose PHI. As a general matter, a covered entity may not use or disclose PHI except as permitted or required by the Privacy Rule. Permitted uses and disclosures include, among others, disclosures for treatment, payment, and health care operations; disclosures authorized by the individual; disclosures for public health activities; disclosures for health oversight activities; and disclosures for research purposes, subject to specific conditions. The research provisions of the Privacy Rule are of central importance to this memorandum and are analyzed in detail in Sections III through VII.
B. HIPAA Security Rule (45 C.F.R. Part 164, Subpart C)
The HIPAA Security Rule, codified at 45 C.F.R. Part 164, Subpart C, establishes national standards for the protection of ePHI. The Security Rule requires covered entities and their business associates to implement administrative safeguards (e.g., security management processes, workforce training, contingency planning), physical safeguards (e.g., facility access controls, workstation security, device and media controls), and technical safeguards (e.g., access controls, audit controls, integrity controls, transmission security) to protect the confidentiality, integrity, and availability of ePHI.
The Security Rule is directly relevant to the CLARION trial because a significant volume of ePHI will be created, transmitted, and maintained through the Pinnacle Data Solutions eClinical/EDC platform. Site coordinators will enter subject-level clinical data — including demographics, medical history, treatment administration records, adverse events, laboratory results, imaging assessments, and survival data — directly into the Pinnacle EDC system. This data will be transmitted electronically to Meridian CRO for data management, query resolution, and biostatistical analysis. Additionally, SAE reports containing subject-level PHI will be transmitted electronically from sites to Meridian CRO and Penterra within 24 hours of awareness, pursuant to Protocol PPC-4871-III's safety reporting requirements.
As an additional regulatory overlay, the electronic data capture system must also comply with the requirements of 21 C.F.R. Part 11, which governs electronic records and electronic signatures in the context of FDA-regulated activities. Part 11 requires, among other things, that electronic systems used to create, modify, maintain, archive, retrieve, or transmit electronic records employ validated systems, audit trails, system access controls, and electronic signature controls. The intersection of the HIPAA Security Rule and 21 C.F.R. Part 11 creates a dual compliance obligation for the Pinnacle EDC platform, which must satisfy both sets of requirements. The specific data security requirements applicable to the CLARION trial are discussed further in Section XII.
C. Covered Entity Analysis — Veridian Network Sites
A threshold question in any HIPAA analysis is whether the entities handling PHI are "covered entities" subject to the Privacy and Security Rules. Under HIPAA, a "covered entity" includes: (i) a health plan; (ii) a health care clearinghouse; or (iii) a health care provider who transmits any health information in electronic form in connection with a transaction for which HHS has adopted a standard (i.e., a "HIPAA-covered transaction"). 45 C.F.R. § 160.103. HIPAA-covered transactions include claims, eligibility inquiries, referral certifications, and other standard transactions specified at 45 C.F.R. Part 162.
Each of the 38 participating clinical sites within the Veridian Health Research Network is an academic medical center or affiliated research institution that provides health care services and transmits health information electronically in connection with HIPAA-covered transactions (including claims for reimbursement to Medicare, Medicaid, and private health plans). Accordingly, each site is a HIPAA covered entity, and the Privacy and Security Rules govern the sites' use and disclosure of PHI, including PHI collected in the course of the CLARION trial.
The lead sites for the trial have been identified as follows:
• Graystone University Medical Center, 1200 University Avenue, Philadelphia, Pennsylvania 19104 (designated as Site 001 in the Protocol), with Dr. Catherine Aldridge, M.D., Ph.D. serving as the principal investigator.
• Lakemont Medical Center, 4400 North Michigan Drive, Chicago, Illinois 60611 (designated as Site 002 in the Protocol), with Dr. Howard Matsuoka, M.D. serving as the principal investigator.
These and the remaining 36 Veridian Network sites conduct clinical research activities as part of their health care operations. The PHI of CLARION trial subjects — who are patients at these institutions receiving investigational treatment for advanced HCC — falls squarely within the scope of the HIPAA Privacy Rule. The sites' collection, use, and disclosure of this PHI in the research context is subject to the Privacy Rule's research provisions, which impose specific requirements (including individual authorization or a waiver thereof) as conditions for permissible use and disclosure.
D. Status of Penterra, Meridian CRO, and Other Third Parties
While the Veridian Network sites are clearly covered entities, the HIPAA status of the other parties involved in the CLARION trial requires more nuanced analysis.
Penterra Pharmaceuticals Corp. Penterra, as a pharmaceutical company and clinical trial sponsor, is not itself a covered entity under HIPAA. Penterra does not provide health care services, does not operate a health plan, and does not function as a health care clearinghouse. It does not, in the ordinary course of its business, transmit health information electronically in connection with HIPAA-covered transactions. Accordingly, Penterra is not directly subject to the Privacy or Security Rules. However, this does not mean that HIPAA is irrelevant to Penterra. To the contrary, because Penterra receives PHI from covered entities (the Veridian Network sites), it is imperative that Penterra ensure that a proper HIPAA-compliant basis exists for each such disclosure — whether through individual authorization, a waiver of authorization, or another applicable exception. Moreover, if Penterra's relationship with the sites is structured in a manner that causes Penterra to function as a "business associate" (discussed below), Penterra would become directly subject to HIPAA's requirements through that designation.
Meridian CRO. Meridian Contract Research Organization, Inc. provides a wide range of clinical trial services to Penterra under a Master Services Agreement dated January 15, 2023, including site monitoring, data management, safety reporting, biostatistical analysis, and medical writing. In performing these services, Meridian CRO receives, processes, and maintains PHI from the Veridian Network sites on an ongoing basis. The critical question is whether Meridian CRO functions as a "business associate" of the covered entity sites.
Under HIPAA, a "business associate" is a person or entity that, on behalf of a covered entity, performs or assists in the performance of a function or activity involving the use or disclosure of PHI, or provides certain services to or for a covered entity that involve the disclosure of PHI. 45 C.F.R. § 160.103. Meridian CRO's activities — which include receiving PHI directly from sites (e.g., SAE reports), accessing PHI in the EDC system for monitoring and data management purposes, and processing PHI for safety reporting to Penterra and the FDA — constitute functions performed on behalf of the sites that involve the use and disclosure of PHI. Accordingly, Meridian CRO is likely a business associate of each participating site (or, more practically, of Veridian on behalf of its network), and a BAA between Meridian CRO and the sites (or Veridian) is required. We note that this business associate relationship with the sites is separate from, and in addition to, Meridian CRO's contractual relationship with Penterra under the Master Services Agreement.
Pinnacle Data Solutions, Inc. Pinnacle hosts and operates the eClinical/EDC platform through which site coordinators enter subject-level clinical data, including PHI, for the CLARION trial. Pinnacle stores, maintains, and transmits ePHI on its servers and makes such data accessible to authorized users at the sites, Meridian CRO, and Penterra. Because Pinnacle creates, receives, maintains, or transmits ePHI on behalf of the sites (and potentially on behalf of Penterra), Pinnacle is a business associate requiring a BAA. The precise structure of Pinnacle's business associate relationships — whether Pinnacle is a business associate of the sites, of Penterra, or of both — depends on the contractual arrangements and the direction of data flows, and should be clarified in the MCTA and related agreements. At a minimum, a BAA between Pinnacle and the sites (or Veridian) and a BAA between Pinnacle and Penterra should be executed.
Northbridge Bioanalytical Laboratories, Inc. Northbridge serves as the central laboratory for the CLARION trial, receiving biospecimens (blood samples, tissue samples) from the Veridian Network sites along with associated identifying information (subject identifiers, dates of collection, clinical annotations) for pharmacokinetic/pharmacodynamic ("PK/PD") analyses, biomarker assessments, and safety laboratory testing. Because Northbridge receives PHI from covered entity sites in connection with services performed for the research study, Northbridge functions as a business associate of the sites and a BAA is required.
E. Interaction with FDA Regulatory Requirements
The HIPAA Privacy Rule's research provisions do not exist in isolation; they must be harmonized with the extensive regulatory framework governing clinical trials under the jurisdiction of the U.S. Food and Drug Administration ("FDA"). The FDA's regulations governing the protection of human subjects in clinical investigations (21 C.F.R. Part 50), institutional review boards (21 C.F.R. Part 56), and investigational new drug applications (21 C.F.R. Part 312) each impose requirements that intersect with, but are distinct from, HIPAA's requirements.
Most significantly, the HIPAA research authorization is a separate legal instrument from the informed consent required under 21 C.F.R. Part 50. Informed consent under Part 50 is a process by which a subject is informed of the nature, risks, and benefits of participation in a clinical trial and voluntarily agrees to participate. HIPAA authorization is a specific written permission from the individual authorizing a covered entity to use or disclose the individual's PHI for specified purposes. While both documents may address overlapping subject matter — and, as discussed in Section III.C below, may be combined into a single integrated document — they serve distinct regulatory purposes and must each satisfy their own respective regulatory requirements.
HIPAA expressly acknowledges the FDA's regulatory oversight role. Under 45 C.F.R. § 164.512(d), a covered entity may disclose PHI to a health oversight agency (including the FDA) for oversight activities authorized by law, including audits, investigations, inspections, and licensure or disciplinary actions. This provision permits the sites and Penterra to disclose PHI to the FDA as necessary for IND safety reporting (7-day and 15-day reports), IND annual reports, pre-approval inspections, and other regulatory interactions without the need for individual authorization.
For reference, Penterra's Investigational New Drug application for penterafenib was filed with the FDA in October 2021 under IND Number 157823. The CLARION trial has been registered on ClinicalTrials.gov under the identifier NCT05928174.
III. HIPAA Authorization for Research Use and Disclosure of PHI
A. When Authorization Is Required (45 C.F.R. § 164.508(b)–(c))
The general rule under the HIPAA Privacy Rule is that a covered entity may not use or disclose PHI for research purposes without a valid, written authorization from the individual whose PHI is at issue, unless an applicable exception (such as a waiver of authorization, preparatory-to-research review, or de-identification) applies. 45 C.F.R. § 164.508(a). This authorization requirement applies to the CLARION trial and will serve as the primary HIPAA compliance mechanism for the study.
In the CLARION trial, the 38 Veridian Network sites will collect extensive PHI from each of the 1,200 enrolled subjects over the course of the study. The categories of PHI to be collected pursuant to Protocol PPC-4871-III include, but are not limited to:
• Demographic information (name, date of birth, age, sex, race, ethnicity, contact information)
• Medical history and concomitant medications
• Physical examination findings and vital signs
• Screening and eligibility assessments, including prior treatment history for HCC
• Treatment administration records (study drug dosing, dose modifications, treatment discontinuations)
• Laboratory results (hematology, chemistry, coagulation, liver function, renal function, tumor markers) — collected at the site and at Northbridge Bioanalytical Laboratories
• Imaging data (CT, MRI) for tumor assessment under RECIST v1.1 criteria
• Adverse events and serious adverse events, including causality assessments
• Biomarker and PK/PD data from biospecimen analyses
• Survival data, including date and cause of death
Each of these data elements constitutes PHI when associated with individually identifiable information. Because the CLARION trial is a prospective clinical trial in which subjects are actively enrolled and can be approached for consent and authorization, HIPAA authorization must be obtained from each research subject prior to the initial use or disclosure of that subject's PHI for trial purposes. The authorization should be obtained at the time of enrollment, concurrently with the informed consent process under 21 C.F.R. Part 50.
As a practical matter, the authorization may be executed as either a standalone document or as an integrated component of the informed consent form. As discussed further in Section III.C below, we recommend the latter approach — combining the HIPAA authorization with the informed consent form into a single document — for reasons of operational efficiency, subject comprehension, and regulatory streamlining. However, regardless of the format chosen, the authorization must contain all of the required elements specified in the Privacy Rule.
B. Required Elements of a Valid HIPAA Authorization
The Privacy Rule prescribes specific elements that must be included in a valid HIPAA authorization. These are divided into "core elements" under 45 C.F.R. § 164.508(c)(1) and "required statements" under 45 C.F.R. § 164.508(c)(2). An authorization that fails to include any required element is defective and may not serve as a valid basis for the use or disclosure of PHI.
Core Elements (45 C.F.R. § 164.508(c)(1)). The following core elements must be included in the HIPAA authorization for the CLARION trial:
1. Description of the PHI to Be Used or Disclosed. The authorization must contain a specific and meaningful description of the categories of PHI that will be used or disclosed in connection with the trial. For the CLARION study, this description should encompass all protocol-specified data elements, including medical history, physical examination findings, laboratory results (including those generated by Northbridge Bioanalytical Laboratories), diagnostic imaging data, adverse event and serious adverse event reports, pharmacokinetic and pharmacodynamic data from biospecimen analyses, biomarker data, treatment records, and survival outcomes. The description should be sufficiently specific to inform the subject of the types of health information that will be shared, while being broad enough to encompass all data collection required by Protocol PPC-4871-III.
2. Names or Classes of Persons Authorized to Make the Use or Disclosure. The authorization must identify who is authorized to use or disclose the subject's PHI. In the CLARION trial, this includes the Veridian Network site at which the subject is enrolled and the principal investigator and study staff at that site. For example, at Site 001 (Graystone University Medical Center), the authorization would identify Graystone University Medical Center and Dr. Catherine Aldridge, M.D., Ph.D. as the principal investigator; at Site 002 (Lakemont Medical Center), the authorization would identify Lakemont Medical Center and Dr. Howard Matsuoka, M.D. The template authorization form should use a structure that permits site-specific customization of this element while maintaining uniformity across the 38-site network.
3. Names or Classes of Persons Authorized to Receive the PHI. The authorization must identify who may receive the subject's PHI. For the CLARION trial, the recipients include:
• Penterra Pharmaceuticals Corp. (Sponsor)
• Meridian Contract Research Organization, Inc. (CRO)
• The U.S. Food and Drug Administration and other regulatory authorities as required by law
• Institutional Review Boards, including the Graystone University Institutional Review Board (IRB Registration No. IRB00012847) and the Veridian Central IRB, as well as any other IRBs with oversight authority
• Pinnacle Data Solutions, Inc. (EDC vendor)
• Northbridge Bioanalytical Laboratories, Inc. (central laboratory)
• Data Safety Monitoring Board members
• Other parties as required by law or regulation
The authorization may identify recipients by name or by class (e.g., "the Sponsor's contract research organization," "the central laboratory"), provided the description is sufficiently specific to inform the subject. We recommend identifying the primary recipients by name for transparency.
4. Description of Each Purpose of the Requested Use or Disclosure. The authorization must describe the purpose for which the PHI will be used or disclosed. For the CLARION trial, the stated purpose should be: "Clinical research under Protocol PPC-4871-III (the CLARION trial), a Phase III clinical study evaluating the investigational drug penterafenib (PPC-4871) for the treatment of advanced hepatocellular carcinoma, including data collection, analysis, safety monitoring, regulatory reporting, and publication of study results."
5. Expiration Date or Expiration Event. The authorization must include an expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure. The Privacy Rule permits the use of the statement "end of the research study" as the expiration event for a research authorization. 45 C.F.R. § 164.508(c)(1)(v). We recommend using the following formulation: "This authorization does not have an expiration date. It will remain in effect until the end of the CLARION research study (projected to be completed in approximately August 2028), plus such additional period as may be necessary for Penterra Pharmaceuticals Corp. and its authorized representatives to complete analysis, regulatory reporting, and document retention activities." This formulation accounts for the 60-month study duration as well as the 15-year document retention period specified in the MCTA, during which access to PHI may be necessary for regulatory compliance purposes.
6. Signature and Date. The authorization must be signed and dated by the individual (research subject) or the individual's personal representative. If signed by a personal representative, the authorization must describe such representative's authority to act for the individual.
Required Statements (45 C.F.R. § 164.508(c)(2)). In addition to the core elements, the following statements must be included in the authorization:
1. Right to Revoke. The authorization must include a statement informing the individual of the right to revoke the authorization in writing, and must describe the exceptions to the right to revoke and how the individual may revoke authorization. The authorization should state: "You have the right to withdraw (revoke) this authorization at any time by providing written notice to the study investigator at [site name and address]. If you withdraw this authorization, no new health information about you will be gathered for the study after that point. However, health information that was already gathered or shared before you withdrew your authorization may continue to be used and disclosed as described in this authorization, to the extent necessary to maintain the integrity of the research."
2. Consequences of Refusing to Sign. The authorization must include a statement regarding the ability or inability to condition treatment, payment, enrollment, or eligibility for benefits on the authorization. Under 45 C.F.R. § 164.508(b)(4)(i), a covered entity may condition the provision of research-related treatment on the individual's provision of authorization for the use or disclosure of PHI for such research. Accordingly, the authorization should state: "Your participation in the CLARION clinical trial is voluntary. However, if you do not sign this authorization, you will not be able to participate in the study. Refusing to sign this authorization will not affect your ability to receive standard medical treatment at [site name]."
3. Potential for Re-Disclosure. The authorization must include a statement that PHI disclosed pursuant to the authorization may be subject to re-disclosure by the recipient and may no longer be protected by the HIPAA Privacy Rule. This is particularly important because several of the recipients identified in the authorization (including Penterra, Meridian CRO, Pinnacle, and Northbridge) may not themselves be HIPAA covered entities. The authorization should state: "Health information disclosed under this authorization may be subject to re-disclosure by the recipient and may no longer be protected by federal privacy regulations (HIPAA). However, Penterra Pharmaceuticals Corp. and its authorized representatives are required to protect your health information in accordance with applicable laws and the terms of the research agreement."
C. Research-Specific Authorization Provisions (45 C.F.R. § 164.508(b)(3))
The Privacy Rule includes several provisions specifically tailored to research authorizations.
Compound Authorizations. Under 45 C.F.R. § 164.508(b)(3)(i), an authorization for the use or disclosure of PHI for research may be combined with any other type of written permission for the same or another research study. This includes combining the HIPAA authorization with the informed consent form required under 21 C.F.R. Part 50. We recommend integrating the HIPAA authorization language into the CLARION informed consent document as a clearly identified and distinct section. This integrated approach offers several advantages: it reduces the administrative burden on site coordinators and subjects by requiring only one signature event; it provides subjects with a comprehensive view of both the research participation and data privacy dimensions of the study; and it is consistent with HHS Office for Civil Rights guidance and FDA guidance documents that have endorsed the practice of combining research authorization with informed consent.
We note, however, that the combined document must clearly delineate the HIPAA authorization provisions from the informed consent provisions, and the authorization section must include all required elements set forth in Section III.B above, regardless of whether similar information appears elsewhere in the informed consent form. The HIPAA authorization section should be clearly labeled and should be drafted so that a reasonable person would understand that by signing, they are both consenting to participate in the research study and authorizing the use and disclosure of their PHI.
Authorization for Future Research. Under 45 C.F.R. § 164.508(b)(3)(iii), a covered entity may use or disclose PHI for future research purposes if the authorization adequately describes such future research such that it would be reasonable for the individual to expect that his or her PHI could be used or disclosed for such future research. If Penterra anticipates that CLARION trial data may be used for secondary research purposes beyond the specific objectives of Protocol PPC-4871-III — for example, exploratory biomarker analyses, health economics and outcomes research ("HEOR"), post-marketing safety analyses, or future clinical development of penterafenib — the authorization must either adequately describe such future uses or a separate authorization must be obtained at a later time. We recommend including language in the authorization that describes potential future research uses in sufficiently specific terms to satisfy this requirement, while acknowledging that any future use not adequately described in the authorization would require separate authorization or an alternative HIPAA-compliant basis (such as de-identification or a waiver of authorization).
State Law Overlay. The HIPAA authorization is a federal requirement, but it does not preempt more protective state privacy laws. As discussed in Section XI below, several of the 14 states in which Veridian Network sites are located impose additional requirements for the authorization or consent of individuals prior to the use or disclosure of health information. Notably, Pennsylvania, Illinois, and California each have state-specific privacy protections that may require additional authorization language or procedural safeguards beyond those mandated by HIPAA. Because the CLARION trial will use a uniform template authorization form across all 38 sites, the template must be drafted to comply with the most restrictive applicable law. This may necessitate state-specific addenda or supplemental language for sites located in states with particularly stringent requirements.
D. Template Authorization Form for the MCTA
We recommend that the MCTA include a template HIPAA authorization form as either: (i) an appendix to the MCTA itself; (ii) an attachment to Exhibit F (Confidentiality and Data Protection Provisions); or (iii) a cross-reference to a separately maintained authorization form template that is incorporated by reference. The template form should be protocol-specific to PPC-4871-III (CLARION) and should include all required elements and statements discussed in Sections III.B and III.C above.
Prior to use, the template authorization form must be reviewed and approved by the relevant IRBs. For sites in the Veridian Network, the IRB review structure is as follows:
• Graystone University Institutional Review Board (IRB Registration No. IRB00012847): Primary IRB of record for Site 001 (Graystone University Medical Center) and, under IRB Authorization Agreements, potentially for other Pennsylvania-based Veridian sites.
• Veridian Central IRB: Central IRB serving as the IRB of record for the remaining Veridian Network sites under an IRB Authorization Agreement structure, consistent with the NIH single-IRB policy and FDA guidance on the use of central IRBs.
The template authorization form should be circulated to both IRBs for review concurrently with the informed consent form, and any IRB-required modifications should be incorporated into the final template prior to site activation and subject enrollment.
IV. Waiver or Alteration of Authorization for Research (45 C.F.R. § 164.512(i))
A. IRB/Privacy Board Waiver Criteria
The HIPAA Privacy Rule provides that a covered entity may use or disclose PHI for research without individual authorization if an IRB or Privacy Board has approved a waiver or alteration of the authorization requirement. 45 C.F.R. § 164.512(i)(1)(i). This waiver mechanism is intended for situations in which obtaining individual authorization is impracticable or would compromise the scientific validity or feasibility of the research.
To approve a waiver or alteration of authorization, the IRB or Privacy Board must determine that the following three criteria are satisfied:
1. Minimal Risk to Privacy. The use or disclosure of PHI involves no more than minimal risk to the privacy of individuals. This determination requires the IRB or Privacy Board to find that: (a) there is an adequate plan to protect the identifiers from improper use and disclosure; (b) there is an adequate plan to destroy the identifiers at the earliest opportunity consistent with conduct of the research, unless there is a health or research justification for retaining the identifiers or such retention is otherwise required by law; and (c) there are adequate written assurances that the PHI will not be reused or re-disclosed to any other person or entity, except as required by law, for authorized oversight of the research study, or for other research for which the use or disclosure of PHI would be permitted under the Privacy Rule.
2. Impracticability Without Waiver. The research could not practicably be conducted without the waiver or alteration of the authorization requirement. This criterion requires a showing that obtaining individual authorization from each subject whose PHI is needed would be so burdensome as to render the research impracticable — for example, because the research involves a large retrospective cohort, subjects cannot be located, or obtaining authorization would introduce selection bias.
3. Necessity of PHI. The research could not practicably be conducted without access to and use of the PHI. This criterion requires a showing that de-identified data or other non-PHI sources would be insufficient for the research purposes.
The IRB or Privacy Board must document its waiver approval in writing. The documentation must include: (i) identification and authority of the approving IRB or Privacy Board; (ii) findings with respect to each of the three waiver criteria; (iii) a brief description of the PHI for which use or disclosure has been determined to be necessary; (iv) the date of the waiver approval; and (v) the signature of the IRB chair or Privacy Board chair (or designated representative). 45 C.F.R. § 164.512(i)(2).
B. Applicability to the CLARION Trial
For the primary CLARION trial enrollment of 1,200 subjects, a waiver of authorization is generally not appropriate. The CLARION trial is a prospective clinical trial in which subjects are actively recruited, screened, and enrolled. Each subject has direct contact with the study team and undergoes an informed consent process. There is no impracticability barrier to obtaining HIPAA authorization at the time of enrollment. Indeed, as discussed in Section III.C above, the HIPAA authorization can and should be integrated into the informed consent form, making its execution a seamless part of the enrollment process. Seeking a waiver of authorization for prospectively enrolled subjects would be difficult to justify under the waiver criteria and could expose the sites and Penterra to regulatory risk.
However, there are several narrower scenarios in which a waiver of authorization may be appropriate or necessary:
• Pre-Enrollment Screening / Preparatory to Research. As discussed in Section V below, site investigators may need to review patient medical records at their institutions to identify potentially eligible subjects with advanced HCC prior to approaching those patients for enrollment. This activity may be addressed under the preparatory-to-research exception (45 C.F.R. § 164.512(i)(1)(ii)), which does not require a waiver, but if PHI must be removed from the covered entity during the screening process (e.g., to create screening logs with patient identifiers), a waiver of authorization may be necessary.
• Retrospective Chart Review. If Penterra or Meridian CRO determines during the course of the trial that a safety signal requires a retrospective review of enrolled subjects' medical records beyond the data elements captured in the CRFs, a waiver of authorization may be sought from the IRB to permit this targeted review, particularly for subjects who have been lost to follow-up, have withdrawn from the study, or have died.
• Deceased Subjects. HIPAA provides a separate provision for the use and disclosure of PHI of deceased individuals for research purposes. Under 45 C.F.R. § 164.512(i)(1)(iii), a covered entity may use or disclose PHI of a decedent for research purposes, provided the researcher represents that the use or disclosure is solely for research on the PHI of decedents, that the PHI sought is necessary for the research, and (upon request) provides documentation of the death of the individuals about whom information is sought. Given that the CLARION trial enrolls patients with advanced HCC — a disease with a significant mortality rate — this provision may be relevant for ongoing data collection on subjects who die during the study.
Recommendation. We recommend that Penterra rely on full HIPAA authorization for all prospectively enrolled subjects and seek waivers of authorization only for narrow, well-defined preparatory or ancillary research activities. Any waiver requests should be submitted to and documented by the Graystone IRB (for Graystone-related activities) or the Veridian Central IRB (for network-wide or other site-specific activities), with appropriate documentation retained in the study regulatory binder.
C. Alteration of Authorization
An alteration of authorization is a lesser modification than a full waiver and permits the use of an authorization form that omits one or more of the normally required elements. 45 C.F.R. § 164.512(i)(1)(i). For example, an alteration might permit the use of an authorization that does not include the names of specific recipients if such identification would be impracticable.
An alteration of authorization may be relevant if Penterra wishes to receive limited data sets (see Section VI below) rather than full PHI for certain secondary analyses. An altered authorization might, for example, omit certain identifying information from the authorization form to align with the more limited scope of PHI being disclosed. However, the same three criteria that apply to a full waiver (minimal risk, impracticability, necessity) must be satisfied before an IRB or Privacy Board can approve an alteration.
At this stage of the CLARION trial planning, we do not anticipate that an alteration of authorization will be needed for the primary study activities. If a need arises during the course of the trial, we will advise on the applicable requirements at that time.
V. Reviews Preparatory to Research (45 C.F.R. § 164.512(i)(1)(ii))
The HIPAA Privacy Rule provides a specific exception that permits covered entities to use or disclose PHI for reviews preparatory to research without obtaining individual authorization and without an IRB or Privacy Board waiver. Under 45 C.F.R. § 164.512(i)(1)(ii), a covered entity may use or disclose PHI for this purpose provided the following three conditions are met:
1. Purpose Limitation. The use or disclosure of PHI is sought solely for the purpose of preparing a research protocol or for similar purposes preparatory to research.
2. No Removal of PHI. No PHI is removed from the covered entity by the researcher during the review. The PHI must remain within the covered entity's systems and cannot be recorded, copied, or taken off-site.
3. Necessity. The PHI sought by the researcher is necessary for the preparatory research purposes.
Additionally, the researcher must provide the covered entity with a representation, which may be oral or written, that the above conditions are satisfied.
Application to the CLARION Trial. The preparatory-to-research exception is directly relevant to the CLARION trial's subject recruitment process. Site investigators — including Dr. Aldridge at Graystone and Dr. Matsuoka at Lakemont — may need to review patient charts and electronic health records at their respective institutions to identify patients with advanced hepatocellular carcinoma who may be eligible for enrollment in the CLARION trial based on Protocol PPC-4871-III's inclusion and exclusion criteria. This preliminary chart review is a classic example of a "review preparatory to research" under the Privacy Rule.
Under this exception, investigators may access and review PHI in existing medical records for the purpose of identifying potentially eligible patients, assessing the feasibility of enrollment targets, and determining whether individual patients meet the study's inclusion and exclusion criteria. However, the investigators may not remove PHI from the covered entity during this process. This means, for example, that an investigator may review a patient's chart to determine whether the patient has a confirmed diagnosis of HCC, has progressed on first-line systemic therapy, and meets other eligibility criteria, but the investigator may not create a screening log that includes patient names, medical record numbers, or other PHI and transmit that log to Penterra or Meridian CRO. The screening log that is shared externally must be limited to de-identified information or must rely on a separate HIPAA-compliant basis for disclosure.
We recommend that the MCTA address the preparatory-to-research exception in Exhibit H (Regulatory Compliance Representations and Covenants) by including clear guidance to sites on the scope and limitations of this exception. Specifically, the MCTA should:
• Acknowledge that investigators may conduct preparatory-to-research reviews of patient records at their institutions for the purpose of identifying potentially eligible CLARION subjects.
• Remind sites that no PHI may be removed from the site during preparatory reviews.
• Require investigators to provide the requisite representation to the site's privacy officer or designated HIPAA compliance personnel prior to initiating such reviews.
• Include language in site training materials — to be delivered by Penterra's clinical operations team (Jennifer Holt, VP, Clinical Operations; Samantha Novak, Director, Clinical Contracts) in coordination with Meridian CRO — on the proper application of the preparatory-to-research exception.
VI. Limited Data Sets (45 C.F.R. § 164.514(e))
A. Definition and Permissible Uses
A "limited data set" is a category of health information that has been stripped of certain direct identifiers but that may retain other potentially identifying information. Specifically, a limited data set excludes the following 16 categories of direct identifiers of the individual and of the individual's relatives, employers, and household members: (i) names; (ii) postal address information other than town or city, state, and zip code; (iii) telephone numbers; (iv) fax numbers; (v) email addresses; (vi) Social Security numbers; (vii) medical record numbers; (viii) health plan beneficiary numbers; (ix) account numbers; (x) certificate/license numbers; (xi) vehicle identifiers and serial numbers including license plate numbers; (xii) device identifiers and serial numbers; (xiii) web URLs; (xiv) IP addresses; (xv) biometric identifiers; and (xvi) full-face photographic images.
Notably, a limited data set may include dates (including dates of admission, discharge, service, birth, and death), geographic information at the city, state, and zip code level, and ages (including ages over 89, which must be aggregated to a single category of "90 or older" for Safe Harbor de-identification but may be retained in a limited data set).
A covered entity may use or disclose a limited data set for research purposes, provided the covered entity enters into a Data Use Agreement ("DUA") with the recipient. 45 C.F.R. § 164.514(e)(1). The DUA must include provisions that: (i) establish the permitted uses and disclosures of the limited data set by the recipient; (ii) identify who is permitted to use or receive the limited data set; and (iii) require the recipient to agree not to use or further disclose the information other than as permitted by the DUA or as otherwise required by law, to use appropriate safeguards to prevent use or disclosure other than as provided by the DUA, to report to the covered entity any use or disclosure not provided for in the DUA of which the recipient becomes aware, to ensure that any agents or subcontractors who receive the limited data set agree to the same restrictions, and not to identify or contact any individual. 45 C.F.R. § 164.514(e)(4).
B. Applicability to CLARION Trial Data Flows
The limited data set pathway has limited utility for the primary clinical trial data collection in the CLARION study. The core clinical data collected under Protocol PPC-4871-III will necessarily include certain direct identifiers — particularly medical record numbers (maintained at the site level for source data verification purposes), dates of birth (needed for age eligibility and dosing calculations), and potentially subject initials (depending on country-specific regulatory requirements and site practices). The inclusion of these identifiers means that the clinical trial dataset as a whole does not qualify as a limited data set, and the full HIPAA authorization pathway must be used for the primary study activities.
However, limited data sets may be a useful and appropriate mechanism for certain secondary and ancillary data uses, including:
• Post-Trial Epidemiological Analyses. If Penterra or its academic collaborators wish to conduct epidemiological analyses using CLARION trial data after the completion of the primary study, a limited data set that retains dates and geographic information but strips direct identifiers may be sufficient for these purposes. A DUA between the Veridian sites and Penterra (or the academic collaborators) would be required.
• Health Economics and Outcomes Research (HEOR). Penterra's HEOR team may seek access to CLARION trial data for health economic modeling, cost-effectiveness analyses, or real-world evidence studies. To the extent that such analyses can be conducted using a limited data set, the DUA pathway offers a streamlined alternative to obtaining individual authorizations for secondary research.
• Academic Publications. Investigators at the Veridian Network sites may wish to publish individual-level data from the CLARION trial in peer-reviewed journals. Where such publications require subject-level data that cannot be fully de-identified (e.g., case reports, subgroup analyses by date of event or geographic region), a limited data set under a DUA may provide a compliant pathway.
If the limited data set pathway is utilized for any of these purposes, the DUA should be structured as either: (i) a standalone agreement between the disclosing site(s) and the recipient(s); (ii) an addendum to the MCTA; or (iii) an exhibit to the intellectual property side letter governing data ownership and publication rights. The choice of vehicle will depend on the specific circumstances and the parties' preferences, and we are available to advise on the optimal structure as the need arises.
VII. De-Identification of PHI (45 C.F.R. § 164.514(a)–(c))
A. Two Methods of De-Identification
Under the HIPAA Privacy Rule, health information that has been de-identified in accordance with 45 C.F.R. § 164.514 is no longer considered PHI and is therefore not subject to the Privacy Rule's restrictions on use and disclosure. De-identification may be achieved through one of two methods:
1. Expert Determination Method (§ 164.514(b)(1)). Under this method, a person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for rendering information not individually identifiable determines that the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an individual who is a subject of the information. The expert must apply statistical or scientific principles to make this determination and must document the methods and results of the analysis that justify the determination. This method offers greater flexibility than the Safe Harbor method because it does not require removal of specific enumerated identifiers, but it requires the engagement of a qualified statistical expert and the preparation of a formal written determination.
2. Safe Harbor Method (§ 164.514(b)(2)). Under this method, de-identification is achieved by removing 18 categories of identifiers: (i) names; (ii) geographic subdivisions smaller than a state (except for the initial three digits of a zip code if certain population thresholds are met); (iii) dates (except year) directly related to an individual, and all ages over 89 (aggregated to a single category of "90 or older"); (iv) telephone numbers; (v) fax numbers; (vi) email addresses; (vii) Social Security numbers; (viii) medical record numbers; (ix) health plan beneficiary numbers; (x) account numbers; (xi) certificate/license numbers; (xii) vehicle identifiers and serial numbers; (xiii) device identifiers and serial numbers; (xiv) web URLs; (xv) IP addresses; (xvi) biometric identifiers; (xvii) full-face photographs and comparable images; and (xviii) any other unique identifying number, characteristic, or code. Additionally, the covered entity must have no actual knowledge that the residual information could be used, alone or in combination, to identify an individual.
B. Application to the CLARION Trial
De-identification is a powerful tool for enabling secondary uses of clinical trial data that fall outside the scope of the original HIPAA authorization. Under the MCTA, Penterra retains exclusive ownership of all clinical trial data generated in connection with Protocol PPC-4871-III. Once trial data is de-identified in accordance with either the Expert Determination or Safe Harbor method, HIPAA's restrictions on use and disclosure no longer apply, and the de-identified data may be used and shared for a wide range of purposes without further HIPAA authorization or compliance obligations.
Specific applications of de-identified data in the CLARION trial context include:
• Regulatory Submissions to FDA. Although the FDA typically receives coded data (with subject identification numbers but without direct identifiers such as names or Social Security numbers), the data submitted in regulatory filings is generally not fully de-identified under the Safe Harbor standard because it may include dates and other elements. However, for certain types of submissions — such as summary data presentations, integrated summary of safety and efficacy documents, and advisory committee briefing materials — fully de-identified data may be appropriate.
• Publications and Presentations. De-identified data may be used for scientific publications in peer-reviewed journals, presentations at medical conferences, and other academic dissemination activities without triggering HIPAA requirements.
• Post-Marketing Analyses. If penterafenib receives marketing approval, de-identified data from the CLARION trial may be used for post-marketing safety analyses, comparative effectiveness research, and real-world evidence generation.
• Data Sharing with Third Parties. We note that Penterra has been approached by Ridgeline Capital Markets regarding potential investor-facing analyses of the CLARION trial data. Any sharing of de-identified data with Ridgeline or other financial entities must comply not only with HIPAA de-identification standards but also with applicable securities laws (including Regulation FD) and the confidentiality obligations under the MCTA and related agreements. The fact that data is de-identified under HIPAA does not eliminate other legal constraints on its disclosure.
Coded Data Analysis. A significant practical question arises with respect to coded data — that is, data in which direct identifiers have been replaced with a code (such as a subject identification number), with a master key linking the code to the individual's identity maintained separately. Under the HIPAA Privacy Rule, coded data may be considered de-identified under the Safe Harbor method only if: (a) the code is not derived from or related to information about the individual (e.g., the code is not the individual's medical record number, Social Security number, or initials); and (b) the covered entity does not use or disclose the code or any mechanism for re-identification. 45 C.F.R. § 164.514(c).
In the CLARION trial, each enrolled subject will be assigned a unique subject identification number (screening number and randomization number) within the Pinnacle EDC system. The sites will maintain a master linking log that connects each subject identification number to the subject's identity (name, medical record number, date of birth). Penterra and Meridian CRO will receive only coded data (identified by subject number) and will not have access to the master linking log.
For this structure to satisfy HIPAA's de-identification requirements, it is critical that:
1. The subject identification numbering system used in the Pinnacle EDC system is not derived from PHI. The screening numbers and randomization numbers should be system-generated sequential or random numbers that bear no relationship to the subject's name, date of birth, medical record number, or other identifier.
2. The master linking log is maintained exclusively at the site level and is not shared with Penterra, Meridian CRO, or any other entity outside the covered entity.
3. Neither Penterra nor Meridian CRO has the ability to re-identify subjects using the coded data and any other information in their possession.
Recommendation. We recommend that the Pinnacle EDC system be configured to generate subject identification numbers that are purely sequential or algorithmically random and that are not derived from any PHI. Sites should be instructed to maintain master linking logs as confidential documents stored at the site, accessible only to authorized site personnel. The MCTA and BAAs should include provisions confirming that Penterra and Meridian CRO will not attempt to re-identify subjects using coded data and that the master linking log will not be disclosed to any party outside the site. This structure will maximize the applicability of the de-identification pathway for secondary uses of CLARION trial data.
VIII. Data Sharing Architecture and Business Associate Agreements
A. PHI Data Flow Mapping for the CLARION Trial
Understanding the HIPAA compliance requirements for the CLARION trial requires a clear mapping of the data flows through which PHI moves among the various parties. Based on our review of Protocol PPC-4871-III, the draft MCTA, and the Meridian CRO Master Services Agreement, the following data flows have been identified:
Flow 1: Site → Pinnacle EDC Platform. Site coordinators and investigators at each of the 38 Veridian Network sites will enter subject-level clinical data — including demographics, medical history, physical examination findings, treatment records, adverse events, laboratory results, and imaging assessments — into the Pinnacle Data Solutions eClinical/EDC platform. This data entry constitutes the transmission of ePHI from the covered entity sites to Pinnacle's hosted platform and represents the primary mechanism by which PHI enters the electronic data management ecosystem for the CLARION trial.
Flow 2: Site → Northbridge Bioanalytical Laboratories. Sites will ship biospecimens (blood samples, tissue sa

MEMORANDUM

MATTER NO.: 1018-00004

Record

Parties

Dates

Amounts