SOP-905
Network Data, Systems, Privacy and Records Across Sites
- Number
- SOP-905
- Category
- Network
- Edition
- Reference Edition 1.3
- Approx. pages
- 11
[YELLOW] the site fills in. [DEFAULT: green] a value the site may keep or change.
On this page
1. Purpose
This SOP describes how [NETWORK NAME] runs computerized systems shared by member sites, controls who can see each member site's records, applies HIPAA when information moves between the Network Office and member sites, keeps each investigator in control of their study records, and handles privacy incidents that involve more than one entity.
2. Scope
This SOP applies only when [NETWORK NAME] has adopted operating Model N under SOP-100 Writing, Approving and Controlling SOPs. A Model S site ignores it.
In scope:
- shared systems: CTMS, eRegulatory and electronic ISF (eISF), eSource, eConsent, temperature monitoring, recruitment databases and registries, and Network Office access to sponsor EDC and other sponsor-deployed systems
- role-based access by member site and study
- the HIPAA structure of the network and the pathway for each data flow between entities
- network recruitment databases, registries and de-identified network analytics
- custody of and access to study records held in central systems, including on member site exit
- privacy incidents and breaches that involve more than one entity
Out of scope:
- system validation, audit trail, electronic signature, backup and security controls, which follow SOP-401 Computerized Systems and Electronic Records for each shared system
- HIPAA authorization, waivers, minimum necessary and breach assessment steps, which follow SOP-400 Participant Privacy and HIPAA in Research
- retention periods and destruction (SOP-402 Record Retention, Archiving and Destruction)
Who performs each activity at the Network Office or the member site follows Appendix B, Central and Site Responsibility Matrix (Appendix B, SOP-905 rows). Where a protocol, sponsor, IRB or applicable state law requirement is stricter than this SOP, follow the stricter requirement.
This SOP describes operating steps. It is not legal advice; [SITE NAME] confirms legal and contracting positions with [LEGAL COUNSEL].
3. Responsibilities
| Role | Responsibilities |
|---|---|
| Network Quality Lead | Owns this SOP. Keeps the network system inventory on F-401-01, approves risk assessments for shared systems, and runs network access reviews. |
| Network Privacy Officer | Records the network's HIPAA structure, maintains F-905-01 and approves each new data flow between member sites that are the same legal entity (N-Integrated); in N-Affiliated, and for any separate legal entity, records each flow after the disclosing entity's Privacy Officer approves it. Coordinates incidents that involve more than one entity. |
| Network Security Officer | Owns technical safeguards for shared systems, including site-level segregation of data. May be the Network Privacy Officer. |
| System Owner (per shared system) | Configures roles and site and study partitions, grants and removes access, and keeps the access log. |
| Network Regulatory Lead | Manages the central eISF structure so that each investigator site has its own controlled section. Arranges sponsor, monitor and inspector access to each site's records. |
| Network Contracts and Finance Lead | Puts BAAs, DUAs, data sharing and services agreements in place for cross-entity flows, and covers system access and record return in network agreements. |
| Site Director (each member site) | Approves access to the member site's records, signs or approves agreements for that legal entity, and appoints the member site Privacy Officer (N-Affiliated). |
| Privacy Officer (each member site) | Runs SOP-400 for the member site, reviews F-905-01 entries that involve the site, and handles the site's incidents. In N-Integrated, the Network Privacy Officer may perform this role for member sites that are the same legal entity as the network entity (SOP-900 5.2.1). |
| Principal Investigator (PI) | Keeps control of the essential records of their study, confirms that monitors, auditors and inspectors can access them, and approves any use of their study data beyond the study. |
| All Research Staff | Access only the sites, studies and records assigned to them. Report suspected privacy incidents under SOP-400. |
4. Definitions
| Term | Definition |
|---|---|
| Network Office | The central organization of [NETWORK NAME], acting collectively. |
| Member site | A site location or legal entity that conducts studies as part of [NETWORK NAME] under its own PI or PIs. |
| N-Integrated | Model N in which one legal entity owns all member sites. N-Integrated defaults apply only where the member site and the network entity are the same legal entity. A separate subsidiary, or a professional corporation under a management services arrangement, follows the N-Affiliated rows for PHI, direction of staff, contract signature, records custody and payments unless counsel confirms otherwise (SOP-900, 5.2.1). |
| N-Affiliated | Model N in which member sites are separate legal entities bound by a network or affiliation agreement. |
| Network Privacy Officer | The Privacy Officer (SOP-400) designated by the Network Office. May be the Network Quality Lead. |
| Network Security Officer | The Security Officer (SOP-400) designated by the Network Office for shared systems. |
| Shared system | A computerized system used by more than one member site or by the Network Office and member sites. |
| Site partition | The configuration of a shared system that separates each investigator site's records so that users see only the sites and studies they are assigned to. |
| Covered entity | A health plan, health care clearinghouse, or health care provider that transmits health information electronically in connection with a HIPAA standard transaction (SOP-400). |
| Affiliated covered entity (ACE) | Legally separate covered entities under common ownership or control that designate themselves, in writing, as a single covered entity for HIPAA (45 CFR 164.105(b)). Common ownership means an ownership or equity interest of 5 percent or more; common control means the power to significantly influence or direct another entity's actions or policies (45 CFR 164.103). |
| Organized health care arrangement (OHCA) | An arrangement defined in 45 CFR 160.103, such as a clinically integrated care setting or an organized system of covered entities that hold themselves out as a joint arrangement and share activities such as quality assessment. |
| Business associate agreement (BAA) | The contract required by 45 CFR 164.504(e) when an entity handles PHI on behalf of a covered entity (SOP-105; SOP-400). |
| Limited data set (LDS) and data use agreement (DUA) | As defined in SOP-400 (45 CFR 164.514(e)). |
| De-identified information | Information that meets 45 CFR 164.514(b) (SOP-400). It is not PHI. |
| Cross-entity data flow | Any regular transfer of, or access to, participant or patient information between two legal entities in the network, or between the network and an outside party. |
| Essential records | Records that permit evaluation of the conduct of a trial and the quality of the data produced (ICH E6(R3) Appendix C). |
5. Procedure
5.1 Shared systems inventory and fitness for purpose
5.1.1
The Network Quality Lead keeps a network section of F-401-01 Computerized System Inventory and Access Log listing each shared system, the member sites and studies it serves, the System Owner, and the legal entity that contracts with the vendor. Each member site's own F-401-01 lists the shared systems it uses and points to the network entry.
5.1.2
Each shared system is risk-assessed and verified as fit for purpose under SOP-401, section 5.2, before any member site uses it. The verification includes a test that a user assigned to one site and study cannot see records of another site or study.
5.1.3
The vendor agreement for each high or medium shared system covers, in addition to SOP-401, section 5.2.2:
- separation of each member site's data and the ability to export one member site's records in full, with audit trails and metadata
- access for each member site's investigators, and for monitors, auditors and inspectors of that site, throughout the retention period
- continued access or transfer of a member site's records if the site leaves the network or the vendor contract ends
- BAA terms where the system holds PHI
5.1.4
Temperature monitoring: where a central platform monitors storage at several member sites, alarms go first to the on-call staff of the member site where the unit is located (SOP-705 Business Continuity and Emergency Preparedness, section 5.3); central staff are a backup. Excursion records stay with that member site (SOP-304 Investigational Product Management).
5.1.5
Electronic signatures: the certification to FDA under 21 CFR 11.100(c) (letter of non-repudiation) follows SOP-401. N-Integrated: one letter from the legal entity covers its own staff, but not staff employed by a separate subsidiary or professional corporation. N-Affiliated, and any separate legal entity: each legal entity whose staff sign electronically submits its own letter and keeps a copy with F-401-01; a Network Office letter does not cover another entity's employees.
5.2 Role-based access by site and study
5.2.1
Each shared system is configured with site partitions. Access to each partition follows SOP-401, section 5.3, and is granted only for the member sites and studies on the person's delegation log entries or their Network Office role.
5.2.2
The System Owner grants access to a member site's partition only after the Site Director of that member site, or the person they name, approves it. For shared staff, the approval matches the assignments on F-904-01 Shared Staff Assignment and Credentialing Log (SOP-904 Shared Staff, Cross-Site Coverage and Central Services).
5.2.3
Network Office staff (for example QA, regulatory, operations) receive the least access their role needs. Network-wide read access to records that contain PHI is granted only where Appendix B assigns a central role that needs it and, in N-Affiliated networks, only where a BAA or other pathway on F-905-01 covers it.
5.2.4
Sponsor-deployed systems (EDC, IRT, sponsor eConsent) are accessed through accounts the sponsor issues for each investigator site. Shared staff request a separate account or role for each site number where the sponsor requires, and the Regulatory Coordinator of each site records it on F-401-01.
5.2.5
Access is removed when a person leaves, changes role or comes off a site or study, within the timelines in SOP-401, section 5.3.5. When a shared person comes off one member site, only that site's access is removed.
5.2.6
The Network Quality Lead reviews user lists for each high shared system against delegation logs and F-904-01 at least [DEFAULT: every 6 months], by site partition, and records the review on F-401-01. Each Site Director confirms the list for their site.
5.2.7
Monitor and auditor accounts in shared systems, including remote access to source, are limited to that sponsor's participants in the partitions of the sites the monitor or auditor is assigned to, and follow SOP-400, section 5.5, and SOP-600 Sponsor Monitoring Visits.
5.2.8
Reports that contain PHI (for example a pre-screening list, an SAE line listing with dates of birth, a CTMS visit list) are shared only inside the system that holds them, or by an encrypted method approved under SOP-401, section 5.9, to people with access to that site's partition. They are not attached to network-wide emails or meeting packs. Reports sent to the Network Office from an N-Affiliated member site follow a pathway on F-905-01.
5.3 HIPAA structure of the network
5.3.1
Before any PHI is shared, the Network Privacy Officer, with counsel, records the HIPAA status of the Network Office and each member site on F-905-01 and in each entity's privacy policy (SOP-400, section 5.1).
5.3.2
N-Integrated, one legal entity: the member sites are parts of one covered entity (or one hybrid entity under SOP-400, section 5.1.2). Information moving between member sites is a use within the entity, not a disclosure to another entity. It still needs a research pathway (5.3.5).
5.3.3
N-Integrated, separate legal entities under common ownership or control: the entities may designate themselves in writing as an ACE (45 CFR 164.105(b)), keep the designation for at least six years, and comply with the Privacy Rule as one entity. If no ACE is designated, each entity is a separate covered entity and 5.3.4 applies.
5.3.4
N-Affiliated: each member site is its own covered entity (or a non-covered entity under SOP-400, section 5.1.5). PHI moves from one entity to another only under a permitted pathway recorded on F-905-01, for example:
- the participant's HIPAA authorization that names the recipient or class of recipient (45 CFR 164.508)
- a BAA, where the recipient performs a function for the disclosing entity and uses the PHI only for that site's purposes. The Network Office is a business associate of each member site whose PHI it creates, receives, maintains or transmits while running a central service for that site (for example central regulatory, recruitment, QA audits or a shared system), and a BAA is signed before it does so
- a DUA, for a limited data set used for research (45 CFR 164.514(e))
- an IRB or privacy board waiver or alteration of authorization (45 CFR 164.512(i))
- a disclosure for treatment, where a participant's care moves to another provider
- de-identified data (45 CFR 164.514(b)), which needs no pathway but is still listed on F-905-01
5.3.5
Research uses of PHI need a research pathway in every model: authorization, an IRB waiver, preparatory to research, decedent research, a limited data set under a DUA, or de-identification (SOP-400, sections 5.2 and 5.3). An OHCA permits sharing for the joint health care operations of the arrangement (45 CFR 164.506(c)(5)). Research, meaning work designed to develop or contribute to generalizable knowledge (45 CFR 164.501), is not health care operations, so an OHCA does not by itself allow PHI to be shared for research.
5.3.6
A business associate may use the PHI it receives from one member site only as its BAA permits. The Network Office does not combine PHI received as a business associate of one member site with another site's PHI, or use it for another site's study, unless a separate pathway covers that use.
5.3.7
Member sites that are not covered entities still apply this SOP as policy (SOP-400, section 5.1.3), and use confidentiality and data security agreements in place of BAAs (SOP-105 Oversight of Service Providers and Vendors).
5.3.8
42 CFR Part 2 records and state laws with extra protection (Appendix A, State Law Worksheet) are not shared across entities without the Privacy Officer's review of the specific flow.
5.4 Network recruitment databases and registries
5.4.1
A network research volunteer database holds people who agreed to be contacted about future studies at any member site. Entry follows SOP-300 Participant Recruitment, Pre-Screening and Advertising, section 5.4. The agreement to be contacted (and the authorization, where one is used) names the Network Office and the member sites, or the class of member sites, that may receive the person's information, and states how to opt out.
5.4.1.1
An opt-out received by any member site or the Network Office applies network-wide. The System Owner records it in the database within [DEFAULT: 5 business days] and tells each member site that holds a copy of the person's details.
5.4.2
The Network Privacy Officer decides, with the IRB where needed, whether each network database or registry needs IRB approval, HIPAA authorization, or both. In general:
- a database built only from people's own written agreement to be contacted, holding contact details and self-reported information, may be run under site policy where the IRB agrees
- a database or registry built by extracting health information from member site records for future research is a research activity and needs individual authorization or an IRB waiver of authorization, and IRB review of the registry protocol
- searching member site medical records to find candidates for a study follows the pathways in SOP-300, section 5.3. Under the preparatory-to-research provision (45 CFR 164.512(i)(1)(ii)) no PHI may be removed from the covered entity that holds the records, so central staff who are not that entity's workforce need an IRB or privacy board waiver of authorization, or the patient's authorization, before they record or use the PHI to contact candidates
5.4.3
N-Affiliated: patient information from one member site's records enters a network database only with the individual's authorization naming the network, or under an IRB waiver. A BAA alone allows the Network Office to run a database for that member site only, not to offer that site's patients to other member sites.
5.4.4
Candidates from a network database are contacted only with IRB-approved materials for the study and referred to the member site chosen in the allocation plan (SOP-902 Network Study Feasibility, Allocation and Central Contracting). The referral is recorded on F-300-01 Pre-Screening Log.
5.4.5
Checks for duplicate or concurrent enrollment across member sites compare identifiers (for example name, date of birth, partial phone number) between entities. Where both member sites are the same legal entity (or members of a designated ACE under 5.3.3), this is a use within the entity, done by staff with access to both sites' records or by an automated match that returns only match or no match. Otherwise (N-Affiliated, or separate legal entities without an ACE) the check is a one-way hashed match run by the Network Office under a BAA with each participating member site that expressly permits the match, where each study's consent and authorization (or an IRB waiver of authorization under 45 CFR 164.512(i)) covers the check. The match returns only match or no match, and the pathway is recorded on F-905-01. Matches are referred to the PIs of both studies.
5.5 Cross-Entity Data Flow Register (F-905-01)
5.5.1
The Network Privacy Officer keeps F-905-01 Cross-Entity Data Flow Register. Each regular data flow between legal entities in the network, and from the network to an outside party other than a sponsor under a CTA, is entered before it starts.
5.5.2
Each entry records:
- data set and whether it contains PHI, a limited data set or de-identified data
- sending entity and receiving entity
- purpose and the studies or activities it supports
- legal pathway (5.3.4) and the agreement or authorization reference
- system or transfer method and safeguards
- minimum necessary fields, where minimum necessary applies
- owner at each entity and the date of the next review
5.5.3
N-Integrated, one legal entity: entries are needed for flows leaving the entity and for flows between ACE members. Flows within the entity are documented through system access records (5.2).
5.5.4
The Network Privacy Officer and each affected member site Privacy Officer review F-905-01 at least [DEFAULT: annually] and when a member site joins or leaves (SOP-901 Member Site Onboarding, Integration and Exit). A flow without a valid pathway is stopped until one is in place, and handled as a privacy incident under SOP-400, section 5.10.
5.6 De-identified network analytics
5.6.1
Network metrics, scorecards (SOP-903 Network Oversight of Member Sites (Metrics, Central QA, Escalation)), feasibility counts and business reports use aggregate or de-identified data. De-identification uses the safe harbor or expert determination method in 45 CFR 164.514(b).
5.6.2
Shared reports suppress small counts that could identify a person, for example counts below [DEFAULT: 11] in a cell defined by rare conditions, small locations or narrow dates.
5.6.3
A participant study ID may stay on a data set that is otherwise de-identified under 45 CFR 164.514(b) only if the ID meets 45 CFR 164.514(c): it is not derived from or related to information about the individual (for example not built from initials, date of birth or medical record number) and cannot otherwise be translated to identify the person, and the member site does not use or disclose the ID for any other purpose and does not disclose the key or other means of re-identification. A study ID that does not meet both conditions makes the data set PHI. Because study IDs also appear on records disclosed to sponsors, the Network Privacy Officer confirms with counsel whether a given study ID meets the second condition; until confirmed, the data set is treated as PHI. Such data sets are used in network reports only where needed to verify a data point, and only under a pathway on F-905-01 when they cross a legal-entity line.
5.6.4
Use of study data beyond the study (for example pooling sponsor trial data across sites for publications or marketing) is not permitted unless the CTA, the consent form and the PI allow it.
5.7 Record custody and access in central systems
5.7.1
Each investigator keeps the records the regulations require for their own study (21 CFR 312.62; 21 CFR 812.140) and should have control of all essential records generated at their investigator site (ICH E6(R3) Annex 1, 2.12.11). A central eISF, eSource or CTMS is a place where those records are held, not a transfer of the investigator's duty.
5.7.2
The Network Regulatory Lead sets up the central eISF so that each investigator site has its own section for each study, following SOP-204 Essential Documents and the Investigator Site File. The PI and the member site Regulatory Coordinator have full access to their section. Network Office staff edit a section only as Appendix B assigns.
5.7.3
Each investigator site's records are made available, on request, to that site's monitor, auditor, IRB and FDA (21 CFR 312.68; 21 CFR 812.145; ICH E6(R3) Annex 1, 2.12.14). The System Owner can grant time-limited read-only access to one site's section, or produce certified copies under SOP-401, section 5.6, within the time the request requires. An inspector is not shown other member sites' records unless the inspection covers them.
5.7.4
The Regulatory Coordinator of each member site keeps on file where every essential record and source record for each study is held (SOP-102 Site Organization, Roles and Staff Responsibilities, section 5.4.6; SOP-306 Source Documentation and Data Integrity (ALCOA+)).
5.7.5
When source records for a participant move between member sites (for example a participant transfers sites, or a visit is done at another member site), the receiving site keeps a certified copy made under SOP-401, section 5.6, or documented read-only access to the original in the shared system, and records the location on its source data location list (SOP-306). The original stays with the site that created it.
5.7.6
Retention follows SOP-402. The Network Office does not destroy a member site's records held in a central system without the written agreement of that site's PI or Site Director and the sponsor's written authorization (SOP-402, section 5.7).
5.8 Records when a member site exits
5.8.1
Records follow the investigator site. When a member site leaves the network (SOP-901), the Network Regulatory Lead and the Site Director agree in writing, before the exit date, how the site's records in each shared system, including eSource, eConsent records and the eISF, will be:
- exported in full, with audit trails, metadata and signatures, in a readable format, and verified by the site, or
- kept in the central system with continued access for the site's investigators, monitors and inspectors for the full retention period under a written agreement
5.8.2
The member site Regulatory Coordinator records the transfer or access arrangement on F-402-01 Record Archiving and Retrieval Log, and informs each sponsor of the person responsible for the records (ICH E6(R3) Annex 1, 2.12.13; SOP-402, section 5.6). The Network Regulatory Lead confirms the F-402-01 entries are complete for every study conducted at the site (SOP-901 5.9.3).
5.8.3
IDE studies: a transfer of custody of investigator records is notified to FDA as in SOP-402, section 5.6.2 (21 CFR 812.140(e)).
5.8.4
The site's access to shared systems ends only after the export is verified or the continued-access agreement is signed. Data flows on F-905-01 involving the site are closed and the end date recorded.
5.9 Privacy incidents and breaches across entities
5.9.1
Any staff member reports a suspected privacy incident to the Privacy Officer of the entity they work for, as in SOP-400, section 5.10. If the incident involves a shared system, the Network Office or another member site's information, that Privacy Officer tells the Network Privacy Officer the same business day.
5.9.2
The Network Privacy Officer identifies which entities' PHI is involved and which entity is the covered entity for each affected record, and records this on F-400-01 Privacy Incident Report.
5.9.3
N-Integrated, one legal entity or ACE: one breach assessment and one set of notifications is made for the entity. The Network Privacy Officer leads, with the Privacy Officer of the member site where the incident happened. Discovery for the entity is set as in SOP-400, section 5.10.5, so knowledge at any member site starts the clock for the whole entity.
5.9.4
N-Affiliated:
- each covered entity whose PHI is involved is responsible for its own breach assessment and for notice to its affected individuals, HHS and media where required (45 CFR 164.404 to 164.408)
- when the Network Office or a member site holds the PHI as a business associate, it notifies the covered entity as the BAA requires, without unreasonable delay and no later than 60 calendar days after discovery (45 CFR 164.410), and within [DEFAULT: 24 hours of discovery] where the BAA follows SOP-105, section 5.4
- the Network Privacy Officer coordinates so that individuals receive one consistent notice where possible; the BAA may assign notice tasks to the business associate, but the covered entity stays responsible
5.9.5
State breach laws for every state where affected individuals live are checked (Appendix A). Sponsors are notified as each CTA requires, and IRBs as their policies require (SOP-502 Unanticipated Problems and Reportable New Information).
5.9.6
Incidents with a cause in a shared system or central process are handled as a network-wide CAPA under SOP-903, section 5.5.
6. Related Forms and SOPs
- F-905-01 Cross-Entity Data Flow Register
- F-401-01 Computerized System Inventory and Access Log
- F-400-01 Privacy Incident Report
- F-402-01 Record Archiving and Retrieval Log
- F-300-01 Pre-Screening Log
- F-904-01 Shared Staff Assignment and Credentialing Log
- Appendix A State Law Worksheet
- Appendix B Central and Site Responsibility Matrix (SOP-905 rows)
- SOP-102 Site Organization, Roles and Staff Responsibilities
- SOP-105 Oversight of Service Providers and Vendors
- SOP-204 Essential Documents and the Investigator Site File
- SOP-300 Participant Recruitment, Pre-Screening and Advertising
- SOP-304 Investigational Product Management
- SOP-306 Source Documentation and Data Integrity (ALCOA+)
- SOP-400 Participant Privacy and HIPAA in Research
- SOP-401 Computerized Systems and Electronic Records
- SOP-402 Record Retention, Archiving and Destruction
- SOP-502 Unanticipated Problems and Reportable New Information
- SOP-600 Sponsor Monitoring Visits
- SOP-705 Business Continuity and Emergency Preparedness
- SOP-901 Member Site Onboarding, Integration and Exit
- SOP-902 Network Study Feasibility, Allocation and Central Contracting
- SOP-903 Network Oversight of Member Sites (Metrics, Central QA, Escalation)
- SOP-904 Shared Staff, Cross-Site Coverage and Central Services
7. References
| Reference | Title |
|---|---|
| 21 CFR 312.62 | Investigator recordkeeping and record retention |
| 21 CFR 312.68 | Inspection of investigator's records and reports |
| 21 CFR 812.140 | Records (devices), including (e) transfer of custody |
| 21 CFR 812.145 | Inspections (devices) |
| 21 CFR Part 11 | Electronic Records; Electronic Signatures (11.100(c) certification to FDA) |
| 45 CFR 160.103 | HIPAA definitions (organized health care arrangement, workforce, business associate) |
| 45 CFR 164.103 | Definitions (common control, common ownership) |
| 45 CFR 164.105(b) | Affiliated covered entities |
| 45 CFR 164.501 | Definitions (health care operations, research) |
| 45 CFR 164.504(e) | Business associate contracts |
| 45 CFR 164.506(c)(5) | Disclosures within an organized health care arrangement |
| 45 CFR 164.508 | Uses and disclosures for which an authorization is required |
| 45 CFR 164.512(i) | Uses and disclosures for research purposes |
| 45 CFR 164.514(b), (c), (e) | De-identification; re-identification codes; limited data set |
| 45 CFR 164.404 to 164.410 | Breach notification (individuals, media, Secretary, by business associates) |
| 42 CFR Part 2 | Confidentiality of Substance Use Disorder Patient Records |
| ICH E6(R3) Annex 1, 2.12 | Records |
| ICH E6(R3) Annex 1, 4.3 | Computerised Systems |
| FDA Guidance (Oct 2024) | Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations: Questions and Answers |
Independent Site SOP Library. Licensed CC BY-NC 4.0 by the American Institute for Medical Research (AIMR), with added permission for any site's internal use (license terms). Not legal advice: each adopting site confirms state law, IRB and sponsor requirements with its own counsel and owns every step it approves.