Extract to table

The multi-party, multi-state nature of these data flows presents significant HIPAA compliance considerations that must be addressed in the MCTA and related agreements

For the vast majority of PHI uses and disclosures in the CLARION trial, a valid individual HIPAA research authorization must be obtained from each enrolled subject prior to the disclosure of PHI by the covered entity sites

The authorization must contain all elements specified in 45 C

Because the 38 sites span 14 states, several of which have privacy laws more protective than HIPAA (including Pennsylvania, Illinois, and California), a state-by-state analysis is required to ensure the authorization form and data handling procedures comply with the most restrictive applicable law

As an additional regulatory overlay, the electronic data capture system must also comply with the requirements of 21 C

Part 11 creates a dual compliance obligation for the Pinnacle EDC platform, which must satisfy both sets of requirements