Artem Andrianov, PhD

Blockchain technology may the biggest achievement of cryptography of the last decade-and there are few industries craving its core ability to provide guarantees about data safety and authenticity as much as the clinical trials enterprise. Source data verification (SDV), which today often accounts for 20%–30% of the clinical trial budget, becomes unnecessary when blockchain disrupts pharma.

	However, let’s start from the very beginning of that story. Hashing is the cornerstone technology of the blockchain. The algorithm takes a stride of arbitrary data of any size and produces a “hash,” which is a big number from a selected range with two main properties:

	a) It is very unlikely that different data would have the same hash.

	b) That calculation is reproducible by anyone knowing the algorithm.

	The blockchain is used for storing hashes of a combination of important data with an exact time of saving (timestamp). It can then be used as evidence that the data existed at a certain moment and was not forged or altered.

	These evidences cannot be erased because the blockchain protects them. That allows their use in clinical trials by keeping track of every step and saving a timestamp; e.g., when source data is entered at a clinical site and transferred into the electronic data capturing system of a clinical trial, there is no need to check the correctness of the transfer anymore. Blockchain does it for us.

	For pharma, it is vital to make clinical trials more reproducible, ensuring data for each step is not falsified. For that, every document prepared before a start of a study (informed consent, study protocol, study plans, regulatory documents, etc.) should be timestamped to create a proof that it existed in that exact form before the start of the trial. It is especially important for pre-planned endpoints. In addition, when the study starts, ongoing reports are treated the same (i.e., monitoring visit reports). Each measurement in a trial can be notarized to be safe from forgery and corrections that violate a protocol, good clinical practice (GCP), or even the law. This technology would increase the credibility of clinical trial results. The notarized data exists outside of the blockchain boundary in safe storage and only digital thumbprints of it are inside. Such a permanent catalog of documents significantly reduces the costs for audits, file reviews, lost documents, post-closing, and litigation. Blockchain can also help with pharmaceutical supply chain management, tracking drugs for better accountability and the supply chain integrity.

	Thus, blockchain is used as a notary service and has the potential to reduce systemic risk, increase data quality, and decrease risk of fraud by a notarized process because of the programs open and decentralized nature.

	What does it mean that a blockchain is decentralized? It is a network (so-called peer-to-peer), where data is broadcasted by one peer and received by another, which confirms that fact by broadcasting a hash of the data. Then the hash is received by a third peer and it treats the hash itself as the data and then issues the hash of the hash, etc., effectively forming a chain of hashes. However, each of the peers, before hashing, can combine the received data with other information (timestamp, data from third parties) and that combination is named a “block.” It happens because computing a hash is computationally costly; it is cheaper to compute a hash for a larger bunch of data. A chain of hashes can be looked at as a chain of hashed blocks-which is why it is called blockchain. That chain is kept in a distributed database called a ledger, which is a permanent memory of all peers.

	In a classic blockchain (e.g., Bitcoin), computational costs are intentionally high and even increasing by design if the number of peers grows. In that way, the blockchain controls the creation of new blocks, making it impossible to tamper with the system and trick other users by lying about a true value of the existing block. To do that, an attacker needs to outperform in computing power all peers who produced that block and every block in a chain after it. That algorithm is named proof-of-work (because a new block existence proves that a significant work was done to produce it) and it is a “consensus algorithm” in the sense that it allows reaching agreement about recognizing new blocks.

	As a result, immutability of data is guaranteed by computing power or hundreds of megawatts of energy spent by miners of new blocks. In other approaches, guarantee is an amount of memory or disk space. So such systems are most credible in terms of data authenticity, especially Bitcoin.

	The other side of the equation is that you cannot send data to such a blockchain for free. Any transaction costs money, so in practice, for example, electronic signature services using Bitcoin blockchain for notarizing document signatures accumulate many signatures and send them in large bunchs or otherwise pay a fee for sending each signature as a transaction. In the first case, the wait is hours for finalizing a signature; in the second, it’s tens of minutes.

	These fees occur because the blockchain is paired with cryptocurrency. It is needed to reward system participants, do that proportionally to contribution of their power, and allow to exchange that reward for real money. Actually, a peer needs to pay because they are not trusted by other peers because of his or her anonymity.

	To that point, we were discussing public blockchains, where anybody can anonymously become a member of the system. The pricing component gives unparalleled confidence that the data was not manipulated. nevertheless, this confidence is limited, too, because any blockchain is not as decentralized as it is claimed. They have an unspoken dependency on developers, which can change system rules whether by releasing a new version of a software commonly used for a blockchain or even sometimes directly. This is often an open source code, but, in practice, users understand that without a skillful team, the system quickly becomes outdated, which is why the developer’s authority is weighed so much. At times, unhappy users refuse to follow, and blockchain splits. Such an event is referred to as a “hard fork.” These can become a threat if researchers want to conduct a study lasting several years, because during a longer period, the study data may unwillingly face an urge to select a partition to follow.

	However, there are also private blockchains without transaction costs and such a dependency on third parties. In addition, currently, a key question about applying blockchain to clinical trials is whether to use a private or a public blockchain.

	In a private, or “permissioned,” blockchain, there is an administration controlling membership. It is important 

because it controls membership of participants validating transactions. A permissioned blockchain cannot guarantee data immutability because controlling authority can become flawed by an attacker, then establish a coup of flawed validators and then cancel or create arbitrary transactions. Due to regulatory pressure, even if a private blockchain is semi-decentralized, it is impossible to build a censorship-resistant system on the base of it.

	Data manipulation becomes even easier as long as private blockchains do not use proof-of-work consensus. It is impractical because it cannot be expected that third parties not controlling blockchains such as administration (and, thus, trusting it less than public blockchains) would spend their computing power on a big scale for verifying transactions. As for internal resources belonging to the administration, they do not spend their computing power. In these cases, the system may lose the competition to other private blockchains that are more cost-effective. Instead, private blockchains use proof-of-stake or consortium consensus algorithms.

	In proof-of-stake, a new block is proven if a producer has a certain amount of cryptocurrency. So less work is needed for a proof and as a result, transactions happen much faster. You do not need to wait for hours until the blockchain approves a transaction by a new block; it is ready in seconds. That is critical if one is waiting for a sign-off of a regulatory document in a clinical trial that has many signatures and needs to immediately make sure all signatures are stored safely in the blockchain. The industry has a large population of trial participants that will need to have their data validated in a timely manner, so both a quick consensus algorithm and a large number of peers in a blockchain are necessary.

	There is an ongoing debate on how to organize that network. One of the most probable ways is the consortium or Byzantine consensus algorithm that implies peers know each other in advance, and when a new block is produced, they vote for it and are able to establish consensus based on recognized votes of others. This approach involves significant trust in participants and it is natural for associations consisting of well-known and authoritative health organizations. If a private blockchain is controlled by a consortium of organizations, it may be the best fit for clinical trials, if controlling parties include authoritative medical institutions. A legal authority potentially would take part, too. For example, FDA is currently conducting research in that direction with IBM.

	It is difficult to overestimate the potential positive impact of such a network allowing the transparent sharing of clinical data between all industry stakeholders. It is anticipated by many that the system would finally become a common industry electronic health record (EHR) format, which the sector needs because one of the biggest problems is the lack of visibility. It will increase transparency and cross-institutional visibility of the process of unfinished trials because it will be much easier to share information that is not confidential (for example, the overall number of participants), especially with smart contracts which are discussed ahead. Recent attempts to build a prototype of such a network are MedRec and Gem Health blockchain initiatives.

	Being a consortium blockchain, the network can still avoid complete dependence on a particular blockchain implementation or community. It is possible to have the best of both worlds by using private consortium blockchain as an agile instrument for ongoing operations but, in addition, leisurely send data for storing it in a public blockchain to produce better guarantees. Most advanced digital asset management solutions are saving hashes of the same data in several blockchains at a time, achieving multiplication of safety guarantees.

Of course, a potential EHR system is not limited to clinical trials. The most important use of it is a media for sharing medical information, health data banks, and research commons, while keeping information about patients and making it available securely for authorized doctors and clinical researchers. With blockchain, each medication prescription is like a deposit, and when a doctor discontinues a treatment, it is a withdrawal. So it is possible for another doctor to see the balance without looking through every deposit operation. Also important for patient privacy is that institutions will not need to send data back and forth; they just use the common ledger. Hence, blockchain increases confidence in patient privacy.

	That system enables organizations to better coordinate compliance or any type of audits, across multiple sources, ensuring a fully complete file every time. Additionally, the global medical records network can support a registry of medical devices being a basement for Internet of Medical Things (IoMT).

	The blockchain can help decentralize clinical studies because of its own decentralized nature. Currently, clinical trials depend on having consistent reporting locations to ensure proper collection of data. But it can be problematic in terms of retention because they are not likely to be convenient for every patient. As the level of inconvenience increases, the odds of a trial completion fall. But blockchain technology allows clinical trials to be monitored from a wider variety of locations, use a wider base of staf,f and have higher patient privacy and information security at the same time, thereby increasing completion rates.

Smart contracts help with privacy and automation

	There are different approaches to address the need for privacy in clinical research. Enigma project (under construction) is a public computation blockchain platform that allows privacy to be kept about data by sending bits of it to some random subset of the system instead of to every participant, like other public blockchains do. Therefore, the full case data is never disclosed. When implemented, it will allow, for example, scanning of genomic databases for candidates taking part in clinical trials, simplifying the process tremendously.

	That scan will be done by smart contracts, the programs starting to work fully inside blockchain automatically when some event happens in it. A smart contract can only be fulfilled or canceled; it is impossible to hang in the middle of a contract. They provide failover because computations can be executed on any machine and are started again if a machine fails. It is similar to a cloud service but not bound to a datacenter. Though authorization and identity remain open issues for smart contracts executed on blockchain-enabled networks, there is promising ongoing work. Many use cases mentioned above can be improved by moving validation logic inside a blockchain as smart contracts. Smart contracts make possible complete automation of some operations, for example, to enroll a patient completely automatically, if a contract gets evidence of consent. It may be a digital thumbprint of a consent form automatically sent to blockchain by a interactive voice/web response system (IWRS) web server. In the health records (EHR) network, informed consent can exist as a form of broader concept-a permission given by a patient and implemented as a smart contract for certain actions with his or her private medical data. These permissions can be fine-grained and allow reading or writing a certain part of a patient’s data.

	It is also possible to conduct much more complex preparations for a clinical trial, for example, transparently pairing donors of organs easier and more reliably than current methods. From a patient viewpoint, using this technology would make it easy to know exactly where you stand in line-and trust that you will stay there. That is why these systems could help drive collaboration between participants and researchers around medical innovation, for example, in population health management.

	The smart contract can also be very useful at the step of closing a clinical trial database, doing that automatically when conditions are met. Some outcomes can be calculated and reported completely automatically. Regulators and contract research organizations (CROs) can have their own contracts automating what is possible to automate and make their work easier. Smart contracts are not legal contracts but can be used for validation of them, effectively replacing an arbiter or custody. They are also useful for claims adjudication and billing management, economizing money by eliminating the need for intermediaries and cutting administrative costs. It is known that 50% of clinical trials go unreported and often fail to share study results. Blockchain with smart contracts can significantly improve that situation and address the issues of outcome switching and selective reporting.

Procuring clinical data privacy with blockchain storage

	We already discussed a case of storing trial data out of blockchain (the so-called off-chain solution), but it is also possible to protect confidential clinical trial data by using a distributed storage on top of a blockchain. It avoids having two sets of permissions-one for reading off-chain data and another for conducting operations committing to the blockchain, thus simplifying the process and making it more secure. Pieces of kept data are encrypted and distributed between blockchain peers and no one besides the owner can decrypt it. In this case, they are file servers competing in a storage marketplace for storage users’ money. So as an alternative to cloud storage, it claims better privacy and even better benefit-cost ratio. That approach also facilitates decentralized clinical research projects that can query big data in a scalable manner.

	Also in the area of big data, a perspective use of blockchain for clinical trials is genomic data management. In this approach, versioning of documents is not something external to the blockchain; so not only is each version notarized, it is also a succession of versions.

		Manning, Jim. “Blockchain Can Revolutionize Every Aspect Of Healthcare.” 

https://www.ethnews.com/blockchain-can-revolutionize-every-aspect-of-healthcare

		Das, Reenita. “Does Blockchain Have A Place In Healthcare?” Accessed August 7, 2017. 

https://www.forbes.com/forbes/welcome/?toURL=https://www.forbes.com/sites/reenitadas/2017/05/08/does-blockchain-have-a-place-in-healthcare/&refURL=http://www.appliedclinicaltrialsonline.com/blockchain-clinical-trials-ultimate-data-notary?pageID=2&referrer=http://www.appliedclinicaltrialsonline.com/blockchain-clinical-trials-ultimate-data-notary?pageID=2

		Benchoufi, Mehdi, and Philippe Ravaud. “Blockchain Technology for Improving Clinical Research Quality.” 

 18, no. 1 (July 19, 2017): 335. doi:10.1186/s13063-017-2035-z.	

		Nugent, Timothy, David Upton, and Mihai Cimpoesu. “Improving Data Transparency in Clinical Trials Using Blockchain Smart Contracts.” F1000Research 5 (2016): 2541. doi:10.12688/f1000research.9756.1.	

		Melendez, Steven. “MIT’s New Blockchain Project Enigma Wants To Let You Share Your Data On Your Terms.” Fast Company, December 23, 2015. 

https://www.fastcompany.com/3054976/mits-new-blockchain-project-enigma-wants-to-let-you-share-your-data-on-your-terms

Articles

Assessing the benefits of using blockchain technology as a notary service in the network sharing of clinical data. 

BlockChain in Clinical Trials—the Ultimate Data Notary

	As the pace and volatility of many industries increase, we need a better way to tilt the odds back in favor of success. Keeping costs low is useless when project failure threatens the very existence of an organization.

	A traditional clinical study planning tend to rely on facts and figures-fixed and upfront costs (institutional approvals, mandated fees) and costs related to subject visits (e.g., physicians' fees, procedures, etc.). Many unknowns remain not considered in the end-budget formula, which comprises many variables.

	The unknowns about how a trial will (most probably) change during a trial’s run: real number of available patients, the time sites are ready to invest in a study, priorities, and risks. In the classic financial planning methodology, the longer project is, the more uncertainty (read: risks) it contains. In a long-term project, we can face even political and regulatory uncertainty.

	Some companies call risks "hidden” study costs. A simple example of such cost could be a delayed start of a trial. Other examples are non-compliance, protocol deviations, fraud, safety issues, increased salaries, and operating costs over time, etc.

	How to assess them? How to include these (unpleasant) costs? Moreover, how to persuade a sponsor to reserve money for these costs? 

	Actually, every sponsor reserves around 20-30% of a budget for unforeseen expenses. Some of them do it even unconsciously. However, why 20% or 30% and what can we do to minimize it to, say five per cent? Is there a methodology in place? Risk-based budgeting can probably allow achieving the target.

	The whole bunch of the mentioned challenges can be resolved with a Risk-based budgeting (RBB)-a methodology, that includes risks and uncertainties of the real world into financial planning as a whole, and a study budget in particular. The good news about risks is that they CAN be mitigated when identified correctly.

	Here there are two complications-to identify risks and assess their impact and probability correctly-these steps are the prerequisite to start planning the right mitigation actions.

	There are number of tools appeared to assess risks today (e.g. TransCelerate’s RACT, RAMMT from Metric Champion Consortium, OPTIMON study, etc.). These tools help to assess risks systematically, but anyway the major job is to be done by a study team.

	The building of RBB implies the following steps:

Risk assessment of the protocol and a future project.

“Water-proofing” of the risk assessments with various stakeholders.

Prioritization of risk categories and selection of the proper mitigation actions.

Including the costs of mitigation actions into clinical budget, a flexible part of it.

Evaluation of effectiveness of risk assessment and mitigation actions at the end of a trial.

	Therefore, the structure of RBB looks as follows:

	Part 1. A classical evaluation of fixed and variable cost for a trial.

	Part 2. Fixed part for mitigation actions of identified and prioritized risks.

	Part 3. Flexible part for corrective and preventive actions of early identified issues before they escalate.

	Part 4. A budget for unknown risks (provided a proper planning it can be reduced to 1-2% of overall costs).

	Summing up, a study budget is the initial and the one of the most decisive components of the success of a clinical trial. Lack of funding in a critical situation results in complete disaster for the whole study success and lost time. Risks and uncertainties must be planned together with fixed figures and prices and be a part of every clinical budget, which can help to finish trial on budget with 1%-3% deviation.

	Moreover, keeping in mind that the patient safety always has to come first over the protocol and costs, mitigating the risks connected with patient safety, we minimize a possible negative impact on a patient in a trial.

	So, adoption of the concept of the Risk-Based Budgeting could help you to maintain the trial budget within a reasonable range or even to save the whole clinical trial not to mention the patients’ safety.

, the World's First Agile Risk-based Contract Research Organization, totally devoted to the Agile Risk Based Approach in Drug Development.

, a German SaaS provider of risk-based analytics and data-driven quality management solutions in clinical research.

Adoption of the concept of Risk-Based Budgeting could help maintain the trial budget or even save the whole clinical trial.

Risk Based Budgeting

	The blockchain technology is the biggest achievement of cryptography of the last decade. There are few industries craving its core ability to provide guarantees about data safety and authenticity as much as the industry of clinical trials. Source Data Verification (SDV), which demands nowadays 20–30% of the clinical trial budget, becomes unneeded when blockchain disrupts the pharma.

	However, let us start from the very beginning of that story. Hashing is the cornerstone technology of the blockchain. The algorithm takes a stride of arbitrary data of any size and produces a ‘hash’ which is a big number from a selected range with two main properties:

	a) It is very unlikely that different data would have the same hash and

	These evidences cannot be erased because the blockchain protects them. That allows their use in clinical trials by keeping track of every step and saving a timestamp; e.g., when source data is entered at a clinical site and transferred into Electronic Data Capturing system of a clinical trial, there is no need to check the correctness of the transfer anymore. Blockchain does it for us.

	For pharma, it is vital to make clinical trials more reproducible, ensuring data for each step is not falsified. For that, every document prepared before a start of a study (informed consent, study protocol, study plans, regulatory documents, etc.) should be timestamped to create a proof that it existed in that exact form before the start of the trial. It is especially important for pre-planned endpoints. In addition, when the trial starts, ongoing reports are treated the same, for example every monitoring visit report. Each measurement in a trial can be notarized to be safe from forgery and corrections that violate a protocol, good clinical practice, or even the law. This technology would increase the credibility of clinical trial results. The notarized data exists outside of the blockchain boundary in safe storage and only digital thumbprints of it are inside. Such a permanent catalog of documents significantly reduces the costs for audits, file reviews, lost documents, post-closing, and litigation. Blockchain can also help with pharmaceutical supply chain management tracking drugs for better accountability and the supply chain integrity.

	Thus blockchain is used as a notary service and has the potential to reduce systemic risk, increase data quality, and decrease risk of fraud by a notarized process because of the programs open and decentralized nature.

	What does it mean that a blockchain is decentralized? It is a network (so-called peer-to-peer), where data is broadcasted by one peer in his will and received by another, which confirms that fact by broadcasting a hash of the data. Then the hash is received by a third peer and it treats the hash itself as the data and then issues the hash of the hash etc., effectively forming a chain of hashes. However, each of peers, before hashing, can combine the received data with other information (timestamp, data from third parties) and that combination is named a block. It happens because computing a hash is computationally costly and it is cheaper to compute a hash for a bigger bunch of data. A chain of hashes can be looked at as a chain of hashed blocks-which is why it is called blockchain. That chain is kept in a distributed database called ledger, which is just a permanent memory of all peers.

	In a classic blockchain (e.g., Bitcoin) computational costs are intentionally high and even increasing by design if a number of peers grows. In that way the blockchain controls the creation of new blocks making it impossible to tamper with the system and trick other users by lying about a true value of the existing block. For that, an attacker needs to outperform in computing power all peers who produced that block and every block in a chain after it. That algorithm is named proof-of-work (because a new block existence proves that a big work was done to produce it) and it is a ‘consensus algorithm’ in the sense that it allows reaching agreement about recognizing new blocks.

	The other side of the coin is that you cannot send data to such a blockchain for free. Any transaction costs money, so in practice, for example, electronic signature services using Bitcoin blockchain for notarizing document signatures whether firstly accumulate many signatures and send them in a big bunch or otherwise pay a fee for sending each signature as a transaction. In the first case, you wait for hours, in the second for tens of minutes for finalizing your signature.

	These fees occur because the blockchain is paired with cryptocurrency. It is needed to reward system participants, do that proportionally to contribution of their power and allow to exchange that reward for real money. Actually, a peer needs to pay because it is not trusted by other peers because of his anonymity and they require money or work to trust him.

	To that point we were discussing public blockchains where anybody can anonymously become a member of the system. It gives unparalleled confidence that the data was not manipulated but, as you see, for a certain price. Still, this confidence is yet limited too because any blockchain is not as decentralized as it is claimed. They have an unspoken dependency on developers which can change system rules whether by releasing a new version of a software commonly used for a blockchain or even directly sometimes. This is often an open source code but in practice users understand that without a skillful team the system quickly becomes outdated, which is why developer’s authority weighs so much. Sometimes, unhappy users refuse to follow and blockchain splits. The name for such event is ‘hard fork’ and it becomes a threat if you want to conduct a study lasting for years because during a longer period the study data may unwillingly face an urge to select a partition to follow.

	However, there are also private blockchains without transaction costs and such a dependency on third parties. In addition, currently, a question about applying blockchain to clinical trials is whether to use a private or a public blockchain.

	In a private (also named ‘permissioned’) blockchain, there is an administration controlling membership. It is important because it controls membership of participants validating transactions. A permissioned blockchain cannot guarantee data immutability because controlling authority can become flawed by an attacker, then establish a coup of flawed validators and then cancel or create arbitrary transactions. Due to regulatory pressure, even if a private blockchain is semi-decentralized it is impossible to build a censorship-resistant system on the base of it.

	Data manipulation becomes even easier as long as private blockchains do not use proof-of-work consensus. It is impractical because it cannot be expected that third parties not controlling blockchain like administration (and so trusting it less than public blockchains) would spend their computing power on a big scale for verifying transactions. As for internal resources belonging to the administration, they do not spend their computing power because in this case, the system may lose the competition to other private blockchains that are more cost effective. Instead, private blockchains use proof-of-stake or consortium consensus algorithms.

	In proof-of-stake, a new block is proven if a producer has a certain amount of cryptocurrency. So less work is needed for a proof and as a result, transactions happen much faster. You do not need to wait for hours until the blockchain approves your transaction by a new block, it is ready in seconds. It is very important if you are waiting for signing off a regulatory document for a clinical trial with many signatures and need to immediately make sure all signatures are stored safely in the blockchain. The industry has a big population of participants that will need to have their data validated in a timely manner, so both a quick consensus algorithm and a big number of peers in a blockchain are needed for that.

	There is an ongoing debate on how to organize that network. One of the most probable ways is the consortium or Byzantine consensus algorithm that implies peers know each other in advance and when a new block is produced, they vote for it and are able to establish consensus based on recognized votes of others. This approach involves significant trust in participants and it is natural for associations consisting of well-known and authoritative health organizations. If a private blockchain is controlled by a consortium of organizations, it may be the best fit for clinical trials if controlling parties include authoritative medical institutions. A legal authority potentially would take part too, for example, FDA is currently conducting research in that direction together with IBM.

	It is difficult to overestimate the potential positive impact of such a network allowing to transparently share clinical data between all participants of the industry. It is anticipated by many that system would finally become a common industry Electronic Health Records (EHR) format which industry needs so badly because one of biggest problems is the lack of visibility. It will increase transparency and cross-institutional visibility of the process of unfinished trials because it will be much easier to share information that is not confidential (for example, the overall number of participants), especially with smart contracts which are discussed below. Recent attempts to build a prototype of such a network are MedRec and Gem Health blockchain initiatives.

	Being a consortium blockchain, the network can still avoid complete dependence on a particular blockchain implementation or community. It is possible to have the best of both worlds by using private consortium blockchain as an agile instrument for ongoing operations but additionally leisurely send data for storing it in a public blockchain to have better guarantees. Most advanced digital asset management solutions are saving hashes of the same data in several blockchains at a time achieving multiplication of safety guarantees.

	Of course, a potential EHR system is not limited to clinical trials. The most important use of it is a media for sharing medical information, health data banks, and research commons, while keeping information about patients and making it available securely for authorized doctors and clinical researchers. With blockchain, each medication prescription is like a deposit, and when a doctor discontinues a medication, it is a withdrawal. So it is possible for another doctor to see the balance without looking through every deposit operation. Also important for patient privacy is that institutions will not need to send data back and forth, they just use the common ledger. So blockchain increases confidence in patient privacy.

	That system enables organizations to better coordinate compliance or any type of audits, across multiple sources ensuring a fully complete file every time.

	Additionally, the global medical records network can support a registry of medical devices being a basement for Internet of Medical Things (IoMT).

	The blockchain can help decentralize clinical studies because of its own decentralized nature. Currently, clinical trials depend on having consistent reporting locations to ensure proper collection of data. But it can be problematic in terms of retention because they are not likely to be convenient for every patient. As the level of inconvenience increase, the odds of a trial completion fall. But blockchain technology allows clinical trials to be monitored from a wider variety of locations, use a wider base of staff and have higher patient privacy and information security at the same time, thereby increasing completion rates.

	Smart contracts are helping with privacy and automation

	There are different approaches to address the need for privacy in clinical research. Enigma project (under construction) is a public computation blockchain platform that allows privacy to be kept about data by sending bits of it to some random subset of the system instead of sending it to every participant like other public blockchains. So the full case data is never disclosed. When implemented, it will allow, for example, scanning of genomic databases for candidates taking part in clinical trials, simplifying the process tremendously.

	That scan will be done by smart contracts, the programs starting to work inside blockchain fully automatically when some event happens in it. A smart contract can only be fulfilled or canceled, it is impossible to hang in the middle of a contract. So they provide failover because computations can be executed on any machine and are started again if a machine fails. It is like a cloud service but not bound to a datacenter. Though authorization and identity remain open issues for smart contracts executed on blockchain-enabled networks, there is promising ongoing work. Many use cases mentioned above can be improved by moving validation logic inside a blockchain as smart contracts. Smart contracts make possible complete automation of some operations, for example, to enroll a patient completely automatically if a contract gets evidence of consent. It may be a digital thumbprint of a consent form automatically sent to blockchain by Interactive Voice/Web Response System (IWRS) web server. In the health records (EHR) network informed consent can exist as a form of broader concept - a permission given by a patient and implemented as a smart contract for certain actions with his private medical data. These permissions can be fine grained and allow reading or writing a certain part of patient’s data.

	It is also possible to conduct much more complex preparations for a clinical trial, for example, transparently pairing donors of organs easier and more reliably than current methods. From a patient viewpoint, using this technology would be easy to know exactly where you stand in line and trust that you will stay there. That is why these systems could help drive collaboration between participants and researchers around medical innovation, for example, in population health management.

	The smart contract can also be very useful at the step of closing a clinical trial database, doing that automatically when conditions are met. Some outcomes can be calculated and reported completely automatically. Regulators and Contract Research Organizations (CROs) can have their own contracts automating what is possible to automate and making their work easier. Smart contracts are not legal contracts but can be used for validation of them, effectively replacing an arbiter or custody. They are also useful for claims adjudication and billing management, economizing money by eliminating the need for intermediaries and cutting administrative costs. It is known that 50% of clinical trials go unreported and often fail to share study results. Blockchain with smart contracts can significantly improve that situation and address the issues of outcome switching and selective reporting.

	Procuring clinical data privacy with blockchain storage

	We already discussed a case of storing trial data out of blockchain (the so called off-chain solution) but it is also possible to protect confidential clinical trial data by using a distributed storage on top of a blockchain. It avoids having two sets of permissions - one for reading off-chain data and another for conducting operations committing to the blockchain, thus simplifying the process and making it more secure. Pieces of kept data are encrypted and distributed between blockchain peers and no one besides the owner can decrypt it. In this case they are file servers competing in a storage marketplace for storage users’ money. So as an alternative to cloud storage, it claims better privacy and even better benefit-cost ratio. That approach also facilitates decentralized clinical research projects that can query big data in scalable manner. Speaking about big data, a perspective use of blockchain for clinical trials is genomic data management.

	In this approach, versioning of documents is not something external to the blockchain, so not only is each version notarized, it is also a succession of versions.

	1. Manning, Jim. “Blockchain Can Revolutionize Every Aspect Of Healthcare.” 

.Com, n.d. https://www.ethnews.com/blockchain-can-revolutionize-every-aspect-of-healthcare.

	2. Das, Reenita. “Does Blockchain Have A Place In Healthcare?” Accessed August 7, 2017. https://www.forbes.com/sites/reenitadas/2017/05/08/does-blockchain-have-a-place-in-healthcare/

	3. Benchoufi, Mehdi, and Philippe Ravaud. “Blockchain Technology for Improving Clinical Research Quality.” Trials 18, no. 1 (July 19, 2017): 335. doi:10.1186/s13063-017-2035-z.

	4. Nugent, Timothy, David Upton, and Mihai Cimpoesu. “Improving Data Transparency in Clinical Trials Using Blockchain Smart Contracts.” F1000Research 5 (2016): 2541. doi:10.12688/f1000research.9756.1.

	5. Melendez, Steven. “MIT’s New Blockchain Project Enigma Wants To Let You Share Your Data On Your Terms.” Fast Company, December 23, 2015. https://www.fastcompany.com/3054976/mits-new-blockchain-project-enigma-wants-to-let-you-share-your-data-on-your-terms

The clinical trials industry craves blockchain technology to provide data safety and authenticity.

	Garry Kasparov, one of the greatest chess players in human history, who lost to IBM Deep Blue in 1997, 

, “don’t fear intelligent machines, work with them… weak human + machine + better process was superior to a strong computer alone and, more remarkably, superior to a strong human + machine + inferior process.” 

	As the biopharmaceutical industry explores Risk-Based Monitoring (RBM) as a part of Risk-Based Quality Management (RBQM), many clinical project managers are becoming more involved with cross-functional teams to implement RBM and are learning how to manage risks in clinical studies.

	However, during the implementation of the RBM process, the inferior process becomes the largest risk. The team, usually not experienced with the methodology of risk assessment, makes mistakes. The most common pitfalls involve ignoring operational roles, or replacing a process with technology and vice versa.  As a result, a team overreacts on minor hazards and ignores the most probable events that exhibit a major impact on study results.

	As an example of best practice, presented by Bristol-Meyers-Squibb at 

, BMS consults with varying functions to comprehensively develop an RBM strategy (

). If one or several of those teams do not have the skillsets required to properly interpret and communicate risk, leverage RBM technology, and understand the RBM process, critical study risks may be missed, and studies would, subsequently, suffer.

Figure 1: Cross-Functional RBM Team at BMS

	Apart from poor understanding of the core concepts of risk management and KRIs/KPIs, commonly chosen technologies that do not incorporate RBM process burden study teams, rather than facilitate the process. This means that quality risk management plans may lack solid foundation.

	In such circumstances, it is very important to provide examples based on my experience training multi-functional biopharmaceutical professionals on Risk-Based Quality Management (RBQM) as a guest lecturer at the 

. The unique feature of this one module in the Project Management (PM) for the Life Science Professional course was to explore the RBQM theory with the application of professional RBM technology in practice. The main goal for students was to create a retrospective quality risk management plan for previously failed industry studies.

	With the collaboration of Lisa Palladino Kim, lead Professor of the PM course,  the students learned the basics of risk management from a general industry standpoint, i.e., the broad concepts and definitions of risk, differentiating between qualitative and quantitative risk, risk types, how the risks interact, risk categorization, KRIs/KPIs, risk mitigation, and force field analyses.

	Clinical trial-specific topics went into matrix diagrams, and how they apply to TransCelerate RACT, TransCelerate RACT categories, and an example of how TransCelerate RACT was used to identify risks in protocols.

	Finally, and importantly, we discussed the topics covered in ICH E6 (R2) addendum on RBQM, EMA’s reflection paper on risk-based quality management in clinical trials, and vital components of a quality risk management plan.

Selection RBM Technology and Demonstration

	As our educational goal was to prepare students for a real-world situation, we leveraged the 

 -@RACT, which offers a set of customizable components for educational purposes. The main driver for my decision to use Cyntegrity was that the system guided students through the RACT exercise in a simple way, without unnecessary complexities that typically come with other technologies. Specifically, the risk methodology upgrades TransCelerate RACT by essentially requiring risk-managers to document risks, which includes the “event, cause, and impact” approach (

Figure 2: Example of Cyntegrity Risk Statement

	Moreover, the Cyntegrity platform was flexible to enable the administrator to turn sections of the RACT on/off, so the educational experience was customized for students, allowing them to focus on sections relevant to the lesson.

Select Exercise Protocols and Specify Sections

	The Cyntegrity platform offers students protocols from succeeded and failed studies provided by 

 for educational purposes, which exposes students to real-world protocols. While those protocols added application experience to the lesson, many of the protocols were more than 100 pages in length, and to perform a RACT exercise containing all 13 TransCelerate RACT sections was not feasible; not all students had relevant experience in all RACT sections. The selective approach enforced the productive and collaborative effort between the multifunctional groups of students.

	The purpose of the exercise was to expose students to real-world risk management applications and to enable them to understand how to categorize and manage risk. Correspondingly, the pre-selected protocol sections provided students with sufficient exposure, and equipped them with required skill sets to efficiently and holistically perform RACT in their functions.

	With a thorough understanding of risk management concepts, the facilitation of risk identification via RBM technology, and guidance on writing quality risk management plans, students (in a team setting) were required to compare their RACT results from Cyntegrity, and draft their own quality risk management plans.

	On review of the students’ quality risk management plans; they far exceeded expectations, especially knowing that most students had minimal prior exposure to risk management. Firstly, there were not many questions on the RBM technology received, because the technology was self-intuitive and user-friendly, and it efficiently facilitated RBM-specific processes. Secondly, due to the multi-functional approach in team settings, students were able to identify risks that I had not thought of, and created their own customized key risk and performance indicators, proving the axiom that the involvement of many stakeholders 

.  Moreover, the students went beyond by proposing impressive risk mitigation techniques.  If these procedures and strategies were implemented to those failed studies in the past, perhaps some of those studies might have succeeded, or go/no go decisions were made earlier.

	The main lesson learned from this experience was that biopharmaceutical professionals who have minimal experience in risk management, if educated sufficiently and empowered with the right process-driven technology, can contribute significant value to a risk identification and risk assessment exercise. They can be superior to other teams, who do not apply technology and process. With the described educational approach, biopharmaceutical professionals can better translate their experience and expertise into an actionable risk management plan and empower study teams to execute quality risk management correctly, and greatly reduce the probability of a study’s failure.

https://hbr.org/2010/02/like-a-lot-of-people

This article discusses the adoption of RBQM in academic settings and the lessons that were learned.

Adoption of RBQM in Academic Settings: Lessons Learned

The monitoring of clinical trials is responsible for 22%-30% of overall clinical study costs.

 The practice involves several stakeholders and clinical monitors with specialized skills. However, many researchers have traditionally hesitated over its efficiency and claimed that a more centralized and adaptive risk-based approach to monitoring can be a better alternative.

 And now, due to regulatory changes in clinical trials, such as the introduction of the addendum to the ICH GCP E6(R2), new FDA guidelines for industry on risk-based monitoring (RBM), and the European Medicines Agency’s (EMA) reflection paper on risk-based quality management, the urgency of the RBM process implementation has increased in most biopharma establishments. This has sparked a whole range of internal projects industry-wide, despite the lack of standardization and guidance concerning many RBM procedural aspects. Thus, neither academia nor industry are able to offer a clear description of a holistic, unified, and standardized process for RBM, comprising centralized monitoring procedures. Therefore, such RBM process definition, together with derived roles and function descriptions, as well as the required tools and documents, are more relevant than ever.

	As a result, two pharma-related companies and two academic institutions initiated in 2014 a research project (code name: PUEKS), the aim of which was the development of a holistic system via process integration to effectively control clinical trial risks beyond isolated RBM strategies.

	The PUEKS project started in December 2014 as a winner from the research and development project applications in the framework of the Hessen ModellProjekte (Germany), and was completed in November 2016. The Hessen ModellProjekte program is coordinated by Hessen Agentur, a fully state-owned organization. The objective of this program is the promotion of innovative R&D projects. The project selection criteria are the degree of innovation, exploitation potential, and technology transfer of the project as well as the competencies of the involved partners.

	PUEKS complements other cross-stakeholder collaborations such as the Clinical Trial Transformation Initiative (CTTI),

 and the Metrics Champions Consortium (MCC)

 to innovate and improve clinical trial quality management. The initiatives of these three non-profit organizations depict the need of a common understanding and standardization of risk-based quality management approaches in clinical research.

	This project depicts the importance of the collaborative efforts between industry, research institutes, and academia. Thus, the project initiative of the consortium manager, Cyntegrity, a company specialized in cloud solutions for RBM, has been joined by PPH plus, a contract research organization (CRO) offering clinical development project and medical leadership and consultancy services; the Institute of Biostatistics and Mathematical Modeling at the Goethe University; and the Fraunhofer IME Project Group TMP, sited at the University Hospital, Goethe-University; all located in Frankfurt am Main, Germany.

	The integration of risk-based clinical trial management processes entails a collaborative effort between company departments, academics, and across multiple clinical operations functions. Well-organized teamwork has been streamlined and boosted with fluent risk communication systems supported by online cloud platforms and shared visualizations, to capture, monitor, control, and report not only on clinical trial risks but also on clinical trial overall performance beyond the clinical operations department.

	International regulations, standards (ISO) and guidance concerning clinical trials (ICH,

), previous and contemporary projects on RBM procedures (ADAMON,

), and international risk assessment scoring systems (e.g., TransCelerate Biopharma RBM initiative,

 MRC/DH/MHRA Joint Project for the development of risk-adapted approaches to the management of clinical trials of investigational medicinal products

) have been reviewed and used for ensuring compliance with clinical research regulations and guidelines and adjustment to the variable clinical study requirements. RBM benchmarking sources have been consulted for detecting the pros and cons of the currently available RBM solutions.

	The PUEKS project has been developed in observance of the recent addendum to the ICH GCP guideline, E6(R2),

 the EMA reflection paper on risk-based quality management,

and the FDA guidance for industry concerning RBM.

The outcomes of the project relate to each of the main risk-based quality management system (QMS) processes mentioned in the ICH Good Clinical Practice (GCP) addendum E6(R2):

		Critical process and data identification

	Thus, the PUEKS project has aimed at filling the gaps of the-up-till-now available methods or procedures implemented in each of the above-mentioned processes.

	The PUEKS project has devoted two years to the evaluation and optimization of RBM. For this purpose, PUEKS used data already available from ongoing clinical studies to select substantiated key performance and risk indicators (KPIs, KRIs). Thus, the obtained data-driven KRIs have been tested with real clinical data. The power of the selected KRIs (see Table 1) in terms of risk identification and mitigation has been tested, comprising not only an evaluation of KRIs, but also site risk profiles and performance indicators.

	In the frame of the PUEKS project, data from two investigator-initiated clinical trials (IIT) on autoimmune diseases (studies A and B) have been analyzed with an RBM cloud solution created by Cyntegrity:

		Study A (Phase III, randomized, parallel, multicenter clinical trial, four-year duration) involved the placebo-controlled use of a new combination of two licensed drugs, with the initiation of 44 sites and inclusion of 180 patients.

		Study B (medical device study meeting the German Medical Devices Act §23b requirements, multicenter clinical trial, 18-month duration) was comparing the sensitivity of a diagnostic method utilizing an approved device against the standard of care in a given indication, with participation of 12 sites and inclusion of 31 patients.

		Additionally, Cyntegrity’s database, comprising data from publicly available clinical trial records, has been utilized for the testing and adjustment of RBM procedures and KRIs.

	For study A, PPH plus performed an analysis of the clinical study protocol, the monitoring plan, and other essential documents (e.g., informed consent form) in order to identify and select the most suitable risk indicators, as well as to develop sound standard operating procedures (SOPs) on risk-based quality management and RBM.

	Based on the type of data to be captured and the related data capture system, Cyntegrity, the Institute of Biostatistics and Mathematical Modeling at the Goethe University, and PPH plus identified and developed further KRIs.

	Study B has been used to detect further needs concerning SOP clarification and to enhance risk-reporting procedures.

	The main list of KRIs that have been developed, tested, and implemented is shown in Table 1.

	These KRIs have been complemented by centralized statistical monitoring (CSM) tools such as case report form (CRF) completeness reports, to inform about the ratio of missing critical data, and further CRF data inconsistency analysis (e.g., concerning inconsistent serious adverse event [SAE] reporting, unexpected patient visit schedules, or suspected protocol deviations).

1.  Critical process and data identification

	According to the ICH GCP addendum, EMA and FDA guidance documents, critical data, and critical processes are those which may threaten patient safety and rights, as well as data integrity or reliability.

	Analyzing Cyntegrity’s database, as well as studies A and B, PUEKS has identified critical processes that may be inefficiently supervised by traditional monitoring methodology. Thus, quality management gaps were analyzed by a retrospective analysis of essential documents, including captured data, and clinical study procedures (i.e., data collection and informed consent). Thus, as an example, the requirements of paper and electronic data capture (EDC) systems have been checked to identify what aspects of the design of data capture systems may enhance monitoring.

	Critical processes and data have been evaluated at two levels:

 Adequate data capture systems, document updating systems, and investigational medicinal product (IMP)-handling procedures (i.e., GCP-compliant systems and procedures).

 Study-specific terminology clearly defined in the clinical study protocol, adequate EDC adjustment (configuration) to clinical trial requirements.

	To improve critical processes and data identification, PUEKS methodology advises biopharma to implement the following tools:

		Register of audit findings, corrective action preventive action (CAPA) and lessons learned, comprising the timely communication of known audit findings and quality assurance outcomes to entire study teams, as well as preventive and corrective actions.

		Expert and experienced personnel input: Analysis of previous pitfalls and the impact of each of them on providing evidence of what processes and data are critical.

	Likewise, the outcomes of continuous reviews of clinical monitoring outcomes, during clinical trial conduct, should be shared in a timely manner with all operative clinical research teams and relevant functions, beyond the particular study team. An asset for biopharma will be a list of critical processes and data provided by experts from the involved functions, similar to the Critical-to-Quality Factors Principles document created by the CTTI.

Before identifying any risks, it is essential to understand which clinical trial design factors are enhancing or diminishing trial success.

	Team members involved in risk identification should, above all, focus on identification of risks threatening:

		Critical data of the pertinent clinical study,

		IT systems (e. g., communication tools, electronic files, data capture systems)

 a non-profit organization comprising the world’s leading biopharmaceutical companies, has created an RBM knowledge center freely available online. This knowledge center includes the risk assessment and categorization Tool (RACT) used mainly for risk identification and evaluation based on the failure mode effects analysis (FMEA) method.

	Although the RACT is a sufficient tool for systematically reviewing all study-critical aspects for risk evaluation and identification, it has its drawbacks.

 The major one is that the risk levels are assessed with high subjectivity and in disagreement with other study team members’ evaluations. This generates a bias in the risk prioritization process.

	PUEKS found the need of a consensus for risk level assignments that the RACT has not been covering. Thus, PUEKS developed a risk assessment tool based on an enhanced version of the RACT originally created by TransCelerate, with the incorporation of objective definitions for low, medium, and high risk levels for each risk concerning three risk attributes:

	The enhanced risk assessment tool is a list of questions that facilitate the identification as well as the qualitative assessment of clinical trial risks, organized in 13 risk categories (as per TransCelerate’s RACT): safety, study phase, study complexity, subject population, technology, data collection procedures, study endpoints, organizational experience, IMP, IMP supply chain, blinding, operational complexity, and geography. The enhanced RACT enables the study team to identify risks and to evaluate the severity of risk impact (I), probability of occurrence (P), and detectability (D) by assigning a score (from 1 to 3, higher scores meaning higher risk) to each of these three attributes (same as the RACT). I, P, and D scores are multiplied to obtain a single score for each risk, the so-called risk priority number (RPN). The assigned risk scores permit single and grouped risk prioritization and the calculation of a total risk score for each clinical study.

	Importantly, the enhanced RACT enables the objective assignment of risk scores regardless of the individual (team member) who is deploying it. As an example, an excerpt from the enhanced RACT is provided in Table 2 and Table 3.

	In the frame of the PUEKS project, Cyntegrity has developed a publicly available cloud 

 of the RACT. This electronic tool offers different risk identification and assessment catalogs to adjust to the need of different clinical trials and diverse requirements of biopharma, CROs, and clinical research institutions. The cloud tool comprises as well a catalog with standardized risk level definitions developed by PPH plus (as per the enhanced RACT) to streamline risk score assignments via a more objective evaluation of risks.

	Full risk identification and analysis have been performed in PUEKS for study B, which has served both the development and optimization of the enhanced RACT. The objectivity of the definitions has been verified by getting different project leaders to complete the risk assessment separately. In those cases for which the selected risk scores were in disagreement, the definitions had been revised and updated until all project managers opted for exactly the same scores. Thus, the standardization of the responses enables a more objective risk prioritization. During study conduct, the risk priorities may be automatically adjusted according to risk occurrence or the frequency of alerts triggered by the risk monitoring system or risk monitor.

A look at the results of the recently completed project, which aimed to develop an holistic monitoring system via process integration to more effectively control clinical trial risks beyond isolated RBM strategies.
  

The PUEKS Project: Process Innovation in Clinical Trial Monitoring

	The biopharmaceutical industry is starting to adopt TransCelerate’s Risk Assessment Categorization Tool (RACT) in order to identify risks and plan a comprehensive clinical trial risk mitigation strategy. We recently wrote about the 

, and the advantages of using such systems. Some of these advantages include the ability for study teams to evaluate R&D portfolio risks by collecting and analyzing RACT data in aggregate. In this article, we will leverage industry-wide RACT data (provided by Cyntegrity) to see what are the most common study-related risks that people choose. 

	In October 2015, Cyntegrity launched @RACT, a free cloud-based RACT tool that has been deployed across the industry. Over the span of seven months, the @RACT database collected 2,185 RACT data points from 28 RACTs from about 20 small and large pharmaceutical companies. It is important to emphasize that this data cannot be used as a reference for a particular trial, it demonstrates only the global trends in risk assessments, and may not truly represent actual study risks; it is highly advisable for study teams to evaluate their own study risks by completing their own RACTs.
	 

	If you are new to the RACT, the tool essentially analyzes risk from 13 categories (Figure 1), and helps study teams uncover critical study risks in a simple, structured, and standardized way.

	Study teams are required to assess Impact, Probability and Detectability measures from a variety of questions from each category in the RACT, in order to generate a risk score for that category. Figure 2 demonstrates that clinical trial Endpoints, Complexity, and Blinding posed the highest risk scores (in red) compared to other categories.

The biopharmaceutical industry is starting to adopt TransCelerate’s Risk Assessment Categorization Tool (RACT) in order to identify risks and plan a comprehensive clinical trial risk mitigation strategy. We recently wrote about the RACT moving to the cloud, and the advantages of using such systems. Some of these advantages include the ability for study teams to evaluate R&D portfolio risks by collecting and analyzing RACT data in aggregate.

Artem Andrianov, PhD

Articles

BlockChain in Clinical Trials—the Ultimate Data Notary

Risk Based Budgeting

BlockChain in Clinical Trials—the Ultimate Data Notary

Adoption of RBQM in Academic Settings: Lessons Learned

The PUEKS Project: Process Innovation in Clinical Trial Monitoring

Data from Global RACT Analysis Reveals Subjectivity