SOP-N6
Network Data, Systems, Privacy and Records
- Number
- SOP-N6
- Category
- Network
- Edition
- Network Edition 2.0
- Approx. pages
- 7
- Reference Edition source
- SOP-905
[YELLOW] the site fills in. [DEFAULT: green] a value the site may keep or change.
On this page
1. Purpose
This SOP sets how [NETWORK NAME] runs systems shared by member sites, controls who sees each site's records, applies HIPAA when information moves between legal entities in the network, keeps each investigator in control of the study records, and handles privacy incidents that involve more than one entity.
2. Scope
This SOP applies only when [NETWORK NAME] has adopted Model N. Network terms are defined in SOP-N1 section 4.
In scope: shared systems (CTMS, eISF, eSource, eConsent, temperature monitoring, recruitment databases) and access by site and study; the network's HIPAA structure and the pathway for each cross-entity data flow (F-905-01); feasibility queries, network recruitment databases and duplicate-enrollment checks; de-identified network analytics; custody of records in central systems and on exit; privacy incidents across entities.
Out of scope: validation, audit trail, signature, backup and security controls for each system, authorization and waiver steps, and retention periods, which follow SOP-12.
Where a protocol, sponsor, IRB or state law requirement is stricter than this SOP, follow the stricter requirement.
3. Responsibilities
| Role | Responsibilities |
|---|---|
| Network Privacy Officer | Records the HIPAA structure and keeps F-905-01. Approves each new flow within the network entity; for a flow from another covered entity or ACE, records it after that entity's Privacy Officer approves. Coordinates incidents involving more than one entity. |
| Network Security Officer | Owns technical safeguards for shared systems, including site partitions. May be the Network Privacy Officer. |
| Network Quality Lead | Keeps the network system inventory on F-401-01 and runs network access reviews. |
| System Owner | Configures site and study partitions, grants and removes access, and keeps the access log. |
| Network Regulatory Lead | Sets up the central eISF with a controlled section per investigator site and arranges monitor and inspector access. |
| Network Contracts and Finance Lead | Puts BAAs, DUAs and services agreements in place for cross-entity flows. |
| Site Director | Approves access to the site's records and signs agreements for a separate site entity. |
| Privacy Officer (member site) | Runs SOP-12 privacy steps for the site, approves flows that disclose the site's PHI, and handles the site's incidents. The Network Privacy Officer may hold this role for sites in the same covered entity. |
| Principal Investigator (PI) | Keeps control of the study's essential records and approves any use of study data beyond the study. |
4. Definitions
| Term | Definition |
|---|---|
| Shared system | A computerized system used by more than one member site, or by the Network Office and member sites. |
| Site partition | System configuration that separates each investigator site's records so users see only assigned sites and studies. |
| Affiliated covered entity (ACE) | Legally separate covered entities, all under common ownership (an ownership or equity interest of 5 percent or more) or common control, that designate themselves in writing as a single covered entity (45 CFR 164.103, 164.105(b)). Only covered entities can be members. |
| Organized health care arrangement (OHCA) | An arrangement defined in 45 CFR 160.103, such as a clinically integrated care setting. |
| Business associate agreement (BAA) | The contract required by 45 CFR 164.504(e) when an entity handles PHI on behalf of a covered entity. |
| Limited data set (LDS) and data use agreement (DUA) | As in 45 CFR 164.514(e). |
| De-identified information | Information that meets 45 CFR 164.514(b). It is not PHI. |
| Cross-entity data flow | A regular transfer of, or access to, participant or patient information between two legal entities in the network, or from the network to an outside party other than a sponsor under a CTA. |
5. Procedure
5.1 Day-one minimum
5.1.1
The day-one items for this SOP are in SOP-N1 5.1.1: the HIPAA structure and F-905-01 at network level, the same-day incident route (5.8), and the "first flow or shared system" row (5.2, 5.3.4), recorded on F-900-02 Part 0. A flow without a pathway stops until it has one.
5.2 Shared systems and access
5.2.1
The Network Quality Lead lists each shared system in a network section of F-401-01 with the sites and studies it serves, the System Owner and the legal entity that contracts with the vendor; each site's F-401-01 points to it. Each system is assessed as fit for purpose under SOP-12 before use, including the partition test.
5.2.2
The vendor agreement for each shared system that holds study records provides: separation of each site's data; export of one site's records in full with audit trails and metadata; access for that site's investigators, monitors, auditors and inspectors for the full retention period, including after the site leaves or the contract ends; and BAA terms where PHI is held.
5.2.3
The System Owner grants access to a site's partition only after that Site Director (or delegate) approves, matched to delegation log entries, F-904-01, or a Network Office role. Network Office staff get the least access their role needs. For a separate member site entity, network access to records containing PHI needs a pathway on F-905-01.
5.2.4
Access is removed when a person leaves, changes role or comes off a site or study; for shared staff, only the affected site's access is removed. The Network Quality Lead reviews user lists for each shared system by partition at least [DEFAULT: every 6 months], and each Site Director confirms the list for the site.
5.2.5
Monitor and auditor accounts are limited to their sponsor's participants at the sites they are assigned to. Reports containing PHI are shared only inside the system or by an approved encrypted method to people with access to that site's partition, never in network-wide emails or meeting packs.
5.2.6
Temperature monitoring alarms go first to on-call staff at the site where the unit is located; central staff are a backup. Excursion records stay with that site (SOP-06).
5.2.7
Electronic signatures: each legal entity whose staff sign FDA-required records electronically submits its own 21 CFR 11.100(c) certification and keeps a copy with F-401-01. One letter covers only the employees of the entity that sent it.
5.3 HIPAA structure
5.3.1
Before any PHI is shared, the Network Privacy Officer, with counsel, records the HIPAA status of the Network Office and each member site on F-905-01 and F-900-02.
5.3.2
Same legal entity: member sites that are the network entity are parts of one covered entity. Information moving between them is a use, limited to the minimum necessary, and still needs a research pathway (5.3.5).
5.3.3
Commonly owned separate covered entities may designate themselves in writing as an ACE if all of them are under common ownership or control (45 CFR 164.105(b)). The designation is kept for 6 years from when it was made or last in effect, whichever is later (45 CFR 164.105(c)), and the ACE complies as one covered entity. Flows between ACE members are uses. An ACE includes only covered entities. Where the network entity is not itself a covered entity and ACE member (for example a management services organization that does not provide care), the Network Office is a business associate of the ACE: a BAA is signed before it handles ACE PHI (5.3.4), and its staff are ACE workforce only where recorded under SOP-N5 5.6.2. Without a designation, each covered entity is separate and 5.3.4 applies.
5.3.4
Separate covered entities: PHI moves only under a pathway recorded on F-905-01:
- the participant's authorization naming the recipient or class (45 CFR 164.508)
- a BAA, where the recipient performs a function for the disclosing entity. The Network Office is a business associate of each covered entity or ACE, other than the network entity itself, whose PHI it creates, receives, maintains or transmits while running a central service, shared system, query or match, and the BAA is signed before it does so (45 CFR 160.103; 164.504(e))
- a DUA for a limited data set used for research (45 CFR 164.514(e))
- an IRB or privacy board waiver or alteration of authorization (45 CFR 164.512(i))
- a treatment disclosure when a participant's care moves to another provider
- de-identified data, which needs no pathway but is still listed
5.3.5
Research uses of PHI need a research pathway in every structure: authorization, a waiver, preparatory to research, decedent research, an LDS under a DUA, or de-identification. An OHCA permits sharing only for the joint health care operations of the arrangement (45 CFR 164.506(c)(5)). Research is not health care operations (45 CFR 164.501), so an OHCA never by itself allows PHI to be shared for research.
5.3.6
The Network Office uses PHI received as a business associate of one site only as that BAA permits, and does not combine it with another site's PHI or use it for another site's study without a separate pathway.
5.3.7
A member site that is not a covered entity applies this SOP as policy and uses confidentiality and security agreements in place of BAAs. 42 CFR Part 2 records and state-protected information (Appendix A) do not cross entities without the Privacy Officer's review of the specific flow.
5.4 Cross-Entity Data Flow Register (F-905-01)
5.4.1
The Network Privacy Officer enters each regular flow on F-905-01 before it starts: data set and type (PHI, LDS, de-identified), sending and receiving entities, purpose and studies, pathway and agreement reference, system or method and safeguards, minimum necessary fields, owners, and next review date. Within one legal entity, only flows leaving the entity and flows between ACE members are entered; flows inside the entity are shown by access records.
5.4.2
The Network Privacy Officer and each affected site Privacy Officer review F-905-01 at least [DEFAULT: annually] and when a site joins or leaves. A flow without a valid pathway stops until it has one and is handled as a privacy incident.
5.5 Feasibility queries, recruitment databases and duplicate-enrollment checks
5.5.1
Feasibility. Within the network entity, or by ACE workforce across ACE members, data may be queried across sites, and only aggregate counts go to a sponsor. Whether the Network Office may run a feasibility query on data of another covered entity or ACE under a BAA is an open question for counsel. Until [LEGAL COUNSEL] confirms it in writing and the confirmation is recorded on F-905-01, the covered entity runs its own query and sends only counts. (Preparatory-to-research limits: SOP-12.)
5.5.2
Record review for recruitment. Central staff who are not workforce of the covered entity that holds the records need an IRB or privacy board waiver, or the patient's authorization, before they record or use PHI to contact candidates.
5.5.3
Network volunteer database. Entry follows SOP-M3 with each person's written agreement to be contacted, naming the Network Office and the member sites (or class of sites) that may receive the details, and how to opt out. A database built by extracting health information from site records is a research activity needing authorization or an IRB waiver and IRB review. Patient information from a separate entity's records enters a network database only with authorization naming the network or an IRB waiver; a BAA alone lets the Network Office run a database for that site only. An opt-out received anywhere applies network-wide within [DEFAULT: 5 business days].
5.5.4
Duplicate-enrollment checks. Within the network entity, or by ACE workforce across ACE members, the check is a use, done by staff with access to both sites' records or by an automated match returning only match or no match. Otherwise, including a check the Network Office runs for an ACE it is not a member of, the check is a one-way hashed match run by the Network Office under a BAA with each participating covered entity or ACE that expressly permits it, where each study's consent and authorization (or an IRB waiver under 45 CFR 164.512(i)) covers it. It returns only match or no match, the pathway is recorded on F-905-01, and matches go to the PIs of both studies.
5.6 De-identified network analytics
5.6.1
Network metrics, scorecards (SOP-N4), feasibility counts and business reports use aggregate or de-identified data (safe harbor or expert determination, 45 CFR 164.514(b)). This is the network's single small-number rule: any report shared beyond one site and the Network Office suppresses each count below [DEFAULT: 11], and any rate built on such a count.
5.6.2
A site-assigned study ID does not by itself make a data set identifiable where it meets 45 CFR 164.514(c): it is not derived from information about the individual (not built from initials, date of birth or record number) and cannot otherwise be translated to identify the person, and the site does not use or disclose it for another purpose or disclose the key. The data set is de-identified only if no other identifier in 164.514(b)(2), including dates other than year, is present. Because study IDs also appear on records disclosed to sponsors, the Network Privacy Officer confirms with counsel whether a given study ID meets 164.514(c); until confirmed, a data set carrying it is treated as PHI and crosses a legal-entity line only under a pathway on F-905-01.
5.6.3
Study data are not used beyond the study (for example pooled for publication or marketing) unless the CTA, the consent form and the PI allow it.
5.7 Record custody in central systems and on exit
5.7.1
Each investigator keeps the records the regulations require (21 CFR 312.62; 21 CFR 812.140) and should control the essential records of the investigator site (ICH E6(R3) Annex 1, 2.12). Holding them in a central eISF, eSource or CTMS does not move that duty.
5.7.2
The Network Regulatory Lead gives each investigator site its own eISF section per study (SOP-03). The PI and site Regulatory Coordinator have full access; Network Office staff edit only as Appendix B assigns. The System Owner gives a site's monitor, auditor, IRB or FDA time-limited read-only access to that section, or certified copies, within the time the request needs. Other sites' records are not shown unless the inspection covers them.
5.7.3
Each site Regulatory Coordinator keeps on file where every essential and source record is held. When source moves between sites, the original stays with the site that created it, and the receiving site keeps a certified copy or documented read-only access.
5.7.4
The Network Office does not destroy a site's records without written agreement of that site's PI or Site Director and the sponsor's written authorization (SOP-12).
5.7.5
Exit: records follow the investigator site. Before the exit date, the Network Regulatory Lead and Site Director agree in writing whether each shared system's records (including eSource, eConsent and eISF) are exported in full with audit trails, metadata and signatures and verified by the site, or kept with continued access for the full retention period. The site's access ends only after export is verified or the continued-access agreement is signed. The site Regulatory Coordinator records it on F-402-01 and tells each sponsor (ICH E6(R3) Annex 1, 2.12; SOP-N2 5.9.3). Flows on F-905-01 for the site are closed with an end date.
5.8 Privacy incidents across entities
5.8.1
Staff report a suspected incident to the Privacy Officer of the entity they work for (SOP-12). If it involves a shared system, the Network Office or another site's information, that Privacy Officer tells the Network Privacy Officer the same business day. The Network Privacy Officer records on F-400-01 whose PHI is involved and which covered entity holds each record.
5.8.2
One legal entity or ACE: one breach assessment and one set of notifications, led by that entity's Privacy Officer with the site where the incident happened. Knowledge at any site counts as discovery by the entity. Where the Network Office acted as business associate, it notifies under 5.8.3.
5.8.3
Separate covered entities: each covered entity whose PHI is involved makes its own breach assessment and notifications (45 CFR 164.404 to 164.408). A business associate notifies the covered entity as the BAA requires, without unreasonable delay and no later than 60 calendar days after discovery (45 CFR 164.410), and within [DEFAULT: 24 hours of discovery] where the BAA sets that. The Network Privacy Officer coordinates so individuals receive one consistent notice where possible.
5.8.4
State breach laws for each affected individual's state are checked (Appendix A). Sponsors and IRBs are told as CTAs and IRB policies require. An incident caused by a shared system or central process becomes a network-wide CAPA (SOP-N4).
6. Related Forms and SOPs
- F-905-01 Cross-Entity Data Flow Register
- F-400-01 Privacy Incident Report
- F-401-01 Computerized System Inventory and Access Log
- F-402-01 Record Archiving and Retrieval Log
- F-900-02 Network Operating Model and Appendix B Adoption Record
- F-904-01 Shared Staff Assignment and Credentialing Log
- Appendix A State Law Worksheet
- SOP-03 IRB Oversight, Essential Records and Study Activation
- SOP-06 Investigational Product Management
- SOP-12 Privacy, Electronic Systems and Record Retention
- SOP-M3 Recruitment and Advertising
- SOP-N1, SOP-N2, SOP-N4, SOP-N5
7. References
| Reference | Title |
|---|---|
| 21 CFR 312.62; 812.140 | Investigator records and retention; device records and custody |
| 21 CFR 11.100(c) | Electronic signatures: certification to FDA |
| 45 CFR 160.103 | HIPAA definitions (OHCA, workforce, business associate) |
| 45 CFR 164.103 | Definitions (common ownership, common control) |
| 45 CFR 164.105(b) | Affiliated covered entities |
| 45 CFR 164.501 | Definitions (health care operations, research) |
| 45 CFR 164.504(e) | Business associate contracts |
| 45 CFR 164.506(c)(5) | Disclosures within an organized health care arrangement |
| 45 CFR 164.508 | Authorization |
| 45 CFR 164.512(i) | Uses and disclosures for research |
| 45 CFR 164.514(b), (c), (e) | De-identification; re-identification codes; limited data set |
| 45 CFR 164.404 to 164.410 | Breach notification |
| 42 CFR Part 2 | Confidentiality of Substance Use Disorder Patient Records |
| ICH E6(R3) Annex 1, 2.12; Annex 1, 4.3 | Records; computerised systems |
| Reference Edition SOP-905 | Network Data, Systems, Privacy and Records Across Sites (background and full wording) |
Independent Site SOP Library. Licensed CC BY-NC 4.0 by the American Institute for Medical Research (AIMR), with added permission for any site's internal use (license terms). Not legal advice: each adopting site confirms state law, IRB and sponsor requirements with its own counsel and owns every step it approves.