Your Easy Guide to Clinical Studies

The Swiss law regulates the processing of sensitive data, which includes health related data.

 

Study data is health related data and must comply with regulatory protection requirements (e.g. local/cantonal and national data protection law).

 

Requirements include that:

• Study participants are informed about (e.g. PIS) and give prior consent (e.g. ICF) to the:
  • Collection and analysis of their Health related Personal Data (HrPD) (i.e. study data)
  • Collection and analysis of their Biological Material (BM)
  • Further-use of their data for research purposes (i.e. includes both BM and HrPD)

 

In addition;

• Data imust be protected against unauthorised processing (e.g. access rights). The privacy and confidentiality of participant data must be guaranteed (e.g. data coding and anonymisation)
• Participants have the right to information regarding the processing of their data
• The export of HrPD and BM to external researchers, foreign authorities, and international organisations must comply with given data protection regulations and defined agreements (i.e. Data Transfer Agreement (DTA) and Material Transfer Agreement (MTA))

As a SP-INV or Site-INV ensure:

• To comply with data protection laws
• Study staff is trained on the correct handling and processing of participant HrPD and BM (e.g. confidentiality, data entry, storage (e.g. server), and export requirements)
• Quality processes (e.g. SOP, WI) are in place in the event of data protection breach, including the implementation of Corrective and Preventive Action (CAPA)
• CAPAs are implemented in order to prevent future data breaches (e.g. example of a data breach would be the accidental disclosure of participant personal data to outsiders not involved in the study)

 

In the event of sharing HrPD and BM, ensure appropriate agreements are in place (e.g. DTUA / MTA).

 

As a SP-INV or Site-INV:

• Ensure that access to study data is limited to study staff who need access for the management of study data (e.g. data collection, data processing, data analysis).
• Provide data access through the management of person-based access rights (e.g. BIMS, CDMS)

References

ICH GCP E6(R3) – see in particular guidelines in chapter

• 4. Data Governance

ISO 14155:2020 Medical device (access liable to costs) – see in particular section

• 7.7 Subject privacy and confidentiality of data

Swiss Law

HRA – see in particular articles

• Art. 41-43 Transfer, export, storage
• Art. 57 Duty of confidentiality
• Art. 60 Transmission to foreign authorities / organisations

ClinO – see in particular article

• Art. 18 Storage of health related personal data

ClinO-MD – see in particular article

• Art. 8 Data processing in electronic systems and information sharing

HRO – see in particular articles

• Art. 31 d) Protection of personal data
• Art. 32 c) Protection of personal data and the key

FADP – see in particular articles

• Art. 6 Principles
• Art. 16 Cross-border disclosure
• Art. 8 Data security
• Art. 9 Data processing by processors
• Art. 10 Data protection officer
• Art. 25 Right to information