A public key infrastructure (PKI) can make it possible to securely exchange data on the Internet. This introduction will help you understand the issues in PKI implementation.


The plane is waiting to take off in dense fog. Rick and Ilsa are planning to escape Casablanca on a flight to Lisbon. They are confident that they can, because they hold nonrescindable letters of transit signed by General DeGaulle (or is that Weygand?but that is another story). In the hangar, just before takeoff, Rick instructs Renault to put the names Mr. and Mrs. Victor Laszlo on the letters. What follows is perhaps the most famous film scene in historyRick and Ilsa saying goodbye on the runway, and Humphrey Bogart walking away with Claude Rains to the words, Louis, I think this is the beginning of a beautiful friendship.

Casablanca. A great movie and a great starting point for a discussion of public key infrastructure in organizations. Those letters of transit were central to the movie. They were a ticket out of Casablanca, because they were verifiably signed by a French general, and had absolute authority. They could not be rescinded (at least that was the premise of the film). Yet, none of the characters had ever met or spoken with the general. How did they know the letter was authentic? Why should a letter of transit have been created without naming the intended recipient? The characteristics of those letters of transit and the signature on them somehow proved the authenticity of the letters, and their origin. 

These very same issues are important to the transmission of electronic messages and transactions and can be addressed by the administration of digital certificates through public key infrastructures (PKIs). Before we launch into a discussion of PKIs, it is worth reviewing the general concepts of public key/private key encryption.


The use of public key/private key encryption allows the secure transmission of messages or data on the Internet, as discussed in a previous Technology Viewpoint column (Sign Here Please, Mr. Bond, August 2000, p. 28). Public keys and private keys are created as matching pairs through a sophisticated mathematical algorithm. The two keys are related to one another, but cannot be derived from one another. Each can be used to encrypt a message, turning it into unreadable coded characters. To properly use the keys, each person creating a pair of keys must keep the private key absolutely secret while publicizing the public key. 

Someone who wishes to have a message read only by a particular recipient will use the public key of the intended recipient to encrypt the message. Only the recipients private key can decrypt the message and unlock the original text. The recipient can be assured of the integrity of the message, since any alteration would prevent the message from being decrypted. However, the recipient has no guarantee of who sent the message, since anyone with the public key could have sent it. If senders want to guarantee to recipients that they (and nobody else) sent the message, they encrypt it with their own private key. 

The recipient (and for that matter, anyone else) can use the senders public key to decrypt the message and prove the identity of the recipient and guarantee the integrity of the message. Unfortunately, anyone who has access to the public key can also read the message. Creative combinations of these methodologies can allow the transmission of a secure, authenticated, and nonrepudiatable message. Nonrepudiatable is a term from the cryptography world that means that the sender of a message cannot deny that he or she did, indeed, send that message.


When you receive a message encrypted with someones private key, you must have his or her public key in order to decrypt it. How do you get that public key? Perhaps the sender sent it to you in a previous e-mail or in a letter? But there is no way to be sure of the identity of the person who actually sent you the key. Anyone can easily spoof an e-mail address and send an e-mail that appears to have come from someone else. Perhaps the sender posted it on his or her Web site. Can you be sure it is the senders Web site, and not someone masquerading as the sender? If it were an important issue, you would want the sender to give you the public key in person, while showing you his or her drivers license or passport to demonstrate his or her identity. This is, in fact, the standard that a notary public uses in authenticating a persons identity and signature.

As you can imagine, the requirement for person-to-person transfer of a public key is costly, cumbersome, and impractical. The entire idea of public key/private key encryption schemes is to allow transfer of private messages between strangers. The solution to this problem involves the creation of a public key infrastructure. A PKI is a system for the management of public keys, including their assignment to an individual, their publication, and their validation. It involves technology, standards, andmost importantlypolicies. Without any of these components, a PKI cannot establish and transmit trust, and therefore cannot be relied upon.


A fundamental component of a PKI is the digital certificate, which is the digital equivalent of a passport for an individual. The certificate is issued and digitally signed by a digital certificateissuing company or agency known as a certificate authority (CA), and at a bare minimum contains the name of an individual, the date range for which the certificate is valid, and the public key of that individual. The result is digital passports that absolutely identify individuals and link them to their public keys. Or do they? Lets look at the way that a digital certificate is issued in a hypothetical scenario.

Joe Smith would like to obtain a digital certificate. He contacts a registration authority (RA) that is responsible for assuring his identity and informing the CA of that identity. In many PKI schemas, the CA also performs the RA function. Once the identity is confirmed, the RA requests a certificate from the CA and the CA validates the request. It issues a certificate containing Joe Smiths public key and signs the certificate with the CAs private key.

If you think about this scenario carefully, several questions should immediately pop to mind. First, who is this certificate authority, anyway? Is it Steves Certificate Authority, or VeriSign (a well-known certificate authority), or some other trusted third party? A company that plans to use the PKI can perform the CA function. Others have suggested that governmental agencies might serve as a CA; however, the risks of this strategy are of grave concern to privacy advocates and those concerned with civil liberties. The degree to which you can trust the identity of individuals and their public keys is completely dependent on trust of the certificate authority. A dishonest employee at a certificate authority could destroy the trust in any digital certificate issued by that authority. If a CAs private key is not kept under the strictest controls, it can lead to the issuance of fraudulent certificates.

Next, how do you ensure that the person identified on the digital certificate is the person that you think it is? A certificate containing Joe Smiths public key may be useful in a small organization where there is only one Joe Smith, but PKIs are intended to manage transactions between strangers in large groups, or even between people with no previous association. Other identifying information may be needed. In addition, how can you be sure that the RA carefully checked the identity of the individual? In fact, verification of identities is one of the key policies that must be understood concerning PKIs. Identity checks can be done loosely, through the exchange of e-mails. Obviously, only limited information about an individual can be obtained by this low-assurance method. A high-assurance PKI policy could require individuals to actually physically present themselves to the RA along with a passport or drivers license. Obviously, this form of identity checking is much more reliable than e-mail exchanges.

Another question that you might ask is, how well do individuals control their private keys? Use of a private key is controlled by some form of authentication, typically a username-password or a pass phrase. If an individual shares that authentication information with a co-worker (for example, by posting the username-password on a yellow sticky note on his or her own computer), there is no way to know who is using the digital certificate. An obvious solution to this problem is biometric authentication, which is not yet reliably deployed on a large scale. (See Sign Here Please, Mr. Bond, August 2000, p. 28.)

Finally, how can you be sure that the certificate is still valid? If a digital certificate is issued, but is then compromised by sharing a password, or by bad private key management at a CA, it is necessary to somehow notify interested parties that the certificate is invalid. Otherwise, people could continue to trust a compromised digital certificate. Therefore, the recipient of a certificate needs to validate the certificate before accepting it. One way of doing this is to check (or have your software check) with the CA each time the certificate is used. The CA would keep a list of revoked certificates, and only valid certificates would pass the check. Unfortunately, this check with the CA may not be practical in some instances. An alternative is the creation of a certificate revocation list (CRL) that contains a list of all revoked certificates. It is periodically signed and issued by the CA. The problem with a CRL is that a certificate may be revoked, but the CRL list may not yet be issued. There would be no way for users to know that they were being presented with an invalid certificate. In addition, the CRL would grow very large over time. Other, more sophisticated methods are beyond the scope of this brief introduction. 


As you can see, the use of a PKI for digital certificates is quite complex, and requires careful consideration of policy in its administration to establish trust. An organization considering PKI must deal with important questions about how the certificates will be used. For example, a company might be interested in issuing digital certificates to its employees that allow the employees to engage in secure transactions with people from other companies. To do this, the company could have an existing CA issue certificates for each employee. Alternatively, the CA could issue a digital certificate for the company, and give it the authority to serve as a CA itself. Now the company could issue, revoke, and control digital certificates. The CA confers trust upon the company through issuance of the digital certificate. Transactions can take place between any two individuals whose certificates ultimately derive trust from the root CA, whether they are in the same or different companies. In fact, two CAs can agree to trust one another, and to trust the certificates issued by any CA that derives trust from the root CA. This represents a top-down hierarchy for a PKI, which can be difficult and cumbersome to administer. The design of a PKI hierarchy can determine the degree of scalability. 

Another company might wish to create a PKI for its employees alone, and may not care about transactions outside the company. The company could declare itself as the root CA and issue certificates to employees. With any model, the most difficult task is the policies and procedures around the administration of the digital certificates. 

A final model is one used by the software PGP (which stands for pretty good privacy). This software allows users to act as their own CAs by issuing digital certificates to themselves. They can post these on a Web site. This alone may give little comfort to the user of such a certificate. However, another PGP digital certificate holder can sign the certificate. If you trust the signer, you can trust the signed certificate. Multiple signers can sign individual digital certificates, increasing the likelihood that you will trust one of the signers. Thus, PGP relies on a web of trust. It is a highly unstructured PKI, but can be very successfully used. 


One very controversial issue is that of key escrow. Key escrow entails placing ones private key with a trusted authority. A proper authority can obtain the key if it is ever necessary to retrieve encrypted information in the absence of the original key owner. In a criminal investigation, for example, a person might refuse to release his or her private key to allow the reading of a message encrypted with the public key. If the key is in escrow, the police can obtain it and read the information. However, the use of key escrow seriously strengthens the ability of senders to repudiate a messagethey can simply say that someone obtained their private key and encrypted a message with it.


It should be clear that use of a PKI does not guarantee security or privacy in any way. It must be properly thought through, planned, and administered to allow the secure transmission of messages or data in clinical trials, or anywhere else. Going back to those letters of transit, you now should understand the serious error that was made. The combined RA/CA failed to identify an individual for whom the letters were produced, thereby creating certificates that were compromised from the start. Fortunately for Victor and Ilsa, nobody much caredthey escaped to Lisbon and lived happily ever after.            

Articles

Technology Viewpoint

Public Key Infrastructure: The Beginning of a Beautiful Friendship?

As the debate on clinical research policy continues, FDA is setting standards for pediatric studies and encouraging more sex-specific analysis of clinical data.


After more than five years of deliberations, the National Bioethics Advisory Commission issued final recommendations in May for ethical research involving human subjectsEthical and Policy Issues in Research Involving Human Participantsto be available at www.bioethics.gov this summer. The commission aims to ensure that No person in the United States should be enrolled in research without the twin protections of informed consent by an authorized person and independent review of the risks and benefits of the researcha unanimous resolution adopted in 1997. 

The panel calls for extending research protections to all studies sponsored by either public or private entities and for closing loopholes in the Common Rule that governs most federally funded human research. NBAC (National Bioethics Advisory Commission) found that some federal agencies fail to fully implement protections and that existing rules dont adequately protect all study subjects, particularly those in privately funded research not governed by Food and Drug Administration (FDA) regulation. 

The most controversial proposal is to establish a central government agency to enforce federal protections across the research community. Although this and other recommendations surprise no one who has been following the debate, and it may merely gather dust in government offices, the document provides a benchmark for further deliberations on these topics. 

The panels proposed National Office for Human Research Oversight (NOHRO) would be independent of the Department of Health and Human Services (HHS) and would develop regulations and guidance covering all types of human participant research. It would review monitoring systems, encourage ethics education, and enforce requirements and standards. Congress would have to enact legislation to create NOHRO if it is to have authority over the private sector and government agencies outside of HHS.

Not surprisingly, this new oversight plan has drawn opposition. Other government agencies consider it unnecessary and say that HHS Office for Human Research Protections (OHRP) is doing a fine job. At a meeting earlier this year, for example, an official with the Veterans Health Administration raised concerns about creating a czar of human research protections. The Federation of American Societies for Experimental Biology (FASEB) has suggested that the benefits of stronger central oversight of all human subjects research could be accomplished by expanding OHRP instead of creating a new entity. Others have questioned how OHRP, FDA, and the National Institutes of Health (NIH) would relate to something like NOHRO to avoid overlapping duties and divergent policies. 

The NBAC report offers numerous other suggestions for strengthening research conduct and oversight: 

	Issue guidance for how researchers should provide informed consent information to prospective study subjects and promote individual comprehension of the information. 

	Require investigators to document that they have obtained voluntary informed consent. 

	Examine mechanisms to enable investigators and institutions to ensure privacy and confidentiality.

	Define conflicts of interest and issue guidance to ensure that conflicts do not undermine the rights and welfare of research subjects. Sponsors and institutions should develop policies to identify and manage conflicts of interest, to specify prohibited relationships, and to ensure disclosure of conflicts to participants. 

	Establish a uniform system for reporting and evaluating adverse events occurring in research to clarify the responsibilities of all parties. Recommend a compensation policy for research-related injuries. 

	Require all institutions and sponsors involved in human research to provide ethics education for officials, investigators, institutional review board (IRB) members, and staff. 

	Require certification of all investigators and IRB members and staff who conduct or review human research. 

	Establish accreditation programs and standards for sponsors, institutions, and IRBs that do not duplicate the federal assurance process or federal registration requirements for research institutions and IRBs.

	Establish standards for IRB member selection and board composition to ensure that at least 25% are nonscientific and unaffiliated with the institution. This proposal has drawn criticism that including too many nonscientists on IRB panels may complicate reviews and decision-making. 

	Set policy for how sponsors, institutions, and investigators should monitor ongoing research. Clarify when continuing review of a study by an IRB is required and when an IRB should review and approve protocol changes. 

	Permit use of a central or lead IRB for multisite studies.

	Develop a research agenda to discuss emerging human research protection issues.

While advocating stronger rules and enforcement programs, the commission offers some leeway in policy implementation. Regulations should reflect the level of risk of a given study, with less oversight for research that poses minimal risk, but possibly supplementary review for studies that involve novel or controversial ethical issues. The report emphasizes a need to focus on the process of informed consent and calls for flexible policies for how investigators verify informed consent, particularly if requiring a participants signature might block enrollment in a study. The panel also wants to allow IRBs to be able to waive informed consent in situations where there is minimal risk, where data confidentiality will be protected, and where benefits gained from the study outweigh harm from not seeking consent. 

This latest report from the bioethics commission may culminate the panels work. The NBAC charter was signed in 1995 but expires this October and may not be renewed by the Bush administration. During its tenure, the commission has tackled important ethical issues such as human cloning, human tissue collection, and the conduct of clinical studies overseas (see 

 View from Washington, July 2001). Further deliberations will be needed on these important, controversial topics as well as options for stronger oversight of all research involving human participants, but they may be carried on by other organizations. 


The NBAC report also calls for the inclusion of all segments of society in research, while protecting groups vulnerable to harm or coercion. A main theme in much of the commissions work has been to ensure the rights of vulnerable populationspeople who are mentally impaired, elderly, uninformed, or very young. In 1998, NBAC issued a report recommending policies to ensure thorough IRB review of research studies involving people with mental disorders. 

The recent surge in clinical studies involving children has generated policies to provide additional safeguards for young participants in biomedical research. Much of this interest has been spurred by the pediatric exclusivity program in the FDA Modernization Act (FDAMA) of 1997, which provides six-month patent extensions for pharmaceutical companies that conduct research to provide pediatric labeling information on prescription drugs. As a result, manufacturers have conducted nearly 60 pediatric studies in the past three years and are looking to launch more than 100 studies that could involve more than 20,000 children. The exclusivity program has to be renewed by Congress by the end of this year, and its expected continuation is likely to spur more interest in pediatric research. 

In response, Congress enacted legislation last year (Childrens Health Act of 2000) that required FDA to develop rules to protect children participating in clinical trials. In April, FDA issued an interim rule designed to bring FDA-regulated pediatric trials into compliance with the Common Rule. HHS also is conducting a broad review of how the Common Rule (commonly referred to as Subpart D) provides adequate and appropriate protection for children participating in research, which may lead to changes in Subpart D and in FDAs interim rule. 

For now, FDA policy sets basic criteria for pediatric research, while offering some leeway to IRBs and FDA in approving studies.

	offer direct benefit to individuals if it does involve more than minimal risk.

	lead to greater knowledge about the subjects disorder or condition, if the protocol does not meet the first two requirements. FDA indicates that it will take a broad view of who may benefit from a study, even seeing benefit for pediatric subjects receiving placebos in some cases. 

A sponsor may be able to conduct a study that does not meet the traditional standards if the trial could prevent or alleviate an important health problem in children and if investigators follow sound ethical principles and solicit assent from children and informed consent from parents or guardians. In order for FDA and an IRB to assess the need for such a questionable study, FDA notes that sponsors would have to be willing to disclose trade secret or confidential information so that the agency may discuss relevant ethical issues with advisory committees and other experts. FDA officials expect that very few studies would be involved with such disclosure, but the agency may seek congressional authority to disclose proprietary information under specific circumstances as part of legislation to renew the pediatric exclusivity program. 


Although women may not be considered vulnerable populations, policy makers want to ensure that clinical studies address the needs of women and other population subgroups. FDA issued a rule in February 1998 that requires sponsors to submit safety and efficacy analyses for race, age, and sex subgroups included in clinical trials. The rule does not require trials to enroll enough subjects to support subgroup analysis to demonstrate safety and efficacy for each group, however, and many New Drug Applications (NDAs) fail to do so. 

In April 2001, the FDA Office of Womens Health issued a study on inclusion of women in clinical trials for biological products.

 The report examined 63 Biologics License Applications (BLAs) approved by the Center for Biologics Evaluation and Research (CBER) from 1995 to 1999. It found that inclusion rates were similar for female and male subjects and that enrollment reflected the population that will receive the biological product. Analysis by sex, however, was not consistent in the applications, possibly because most clinical trials were not designed to evaluate potential differences. Data on product safety and effectiveness was not presented according to sex and the only female-specific information on the product label was that discussing pregnancy. 

Consequently, FDA officials are looking to close loopholes in the 1998 policy. One proposal is for sponsors to include women routinely in pharmacokinetic (PK) and pharmacodynamic (PD) studies performed in Phase 1 and Phase 2 clinical trials in order to refine dosages for larger trials. An FDA analysis indicates that early PK and PD studies are conducted primarily in men, particularly for biotech therapies. FDAs Center for Drug Evaluation and Research (CDER) also is testing a new standardized format for NDA reviews. It requires all review divisions to examine analysis by sex as one way to ensure that sponsors submit this information in applications.

FDA is examining the need to issue more guidance or regulation to ensure adequate representation and analysis of women in clinical studies, while Congress General Accounting Office is reviewing these issues. A recent report from the Institute of MedicineExploring the Biological Contributions to Human Health; Does Sex Matter?highlighted the importance of full representation of both men and women in biomedical research.

 The panel concluded that sex does matter a great deal in how diseases and conditions affect men and women throughout the life cycle. These differences influence behavior, perception, and health and warrant an increase in sex-based biomedical research. The report recommends that sex-specific data should be more readily available, that data from longitudinal studies should be analyzed by sex, and that policy makers should clarify the terms sex and gender. The sexes may be equal, but they may sometimes require different pharmaceutical and medical treatment. 


1.	Food and Drug Administration, Additional Safeguards for Children in Clinical Investigations of FDA-Regulated Products, Federal Register, Vol. 66, No. 79, 24 April 2001, p. 20589, available at www.fda.gov/OHRMS/DOCKETS/98fr/042401a.htm.

2.	FDA Office of Womens Health, Participation of Females in Clinical Trials and Gender Analysis of Data in Biologic Product Applications, April 2001, available at www.fda.gov/cber/clinical/femclin.htm.

3.	Institute of Medicine, Exploring the Biological Contributions to Human Health; Does Sex Matter? April 2001, available at www.iom.edu.            

View from Washington

Ethics, Kids, and Sex

The demand in clinical research for additional training and education continues to grow at an exponential rate. With the emergence of knowledge-based culture in the industry comes the challenge of continuing to develop qualified teams of research experts on a global scale. The importance of training has emerged as a dominant theme in auditing for research excellence in the industry. 

The acceptance and implementation of the International Conference on Harmonisation (ICH) guidelines and the current trends in Food and Drug Administration (FDA) regulations have emphasized the requirement for qualified and well-trained clinical research personnel. FDA and the Office for Human Research Protections (OHRP) in the United States, and the ICH guidelines, identify training as a key component of the regulatory audit checklist.

 Good clinical practice (GCP) training followed by certification may become a requirement as a symbol of research excellence. 

Many of us have experienced the burden of initiating a clinical research study only to discover the lack of expertise of the research teamoften when it is too late. Poorly trained or untrained clinical research personnel create a huge burden on the industry in time, safety, and expenditures. When sites are terminated, the effects are costly to all parties involvednot only financially but also ethically. At a research site, the training and experience of the research team are indicators of quality in performance. 

The challenge of educating researchers on a global scale contributes to a need for up-to-date information delivery. Innovative educational programs initiated in combination with technological advances are beginning to meet this need. 

The Internet is a vehicle to deliver information in an environment that enhances virtual place and virtual time learning. It allows training of larger groups of research teams and presents endless opportunities. It offers an avenue for continued education and a venue for providing educational credits. Accreditation and validation of information retention can be done via the Internet through examinations or shorter tests/quizzes online. 

Certificates can then be delivered over the Internet and printed as documentation to verify learning. Technology offers updated information delivered routinely by e-mail or online newsletters. Internet knowledge-sharing and networking can take place online to encourage international peer learning. 

The implementation of an online learning program involves both financial expense and time. What are the steps that you should take to develop an online training environment? 

The e-learning process. Complete an online education feasibility assessment at your company or clinical research site. If your company staff or research team members have a desire to learn but a lack of time or other obstacles to learning, you might find an online training program useful. Convenience for learners and cost effectiveness are the primary advantages of online technology training (see box).

Ask your management or training team, Will an online learning program assist our staff? Will our employees benefit from an online training program? 

The actual construction of an online program involves many steps. The traditional live course should be assessed for the appropriate transfer of content onto the Internet. Then decide the delivery method of that content by evaluating your companys or sites online infrastructure. 

In designing the program, you need to decide what features are important to include in the online course. People usually want a program that is both convenient for learners and intellectually stimulating. The learners should have a rigorous learning experience and feel as if they have had a good workout of the mind. 

The online atmosphere should encourage attendees to create individual learning plans and should enhance online interaction. Capturing the live classroom interaction is a challenge in online education. 

Adult learners strive as researchers do to be self-directed, analytical, and hypothetical. The online environment should reflect these theories about adult learning as well as encourage interaction.

Interactive learning can be achieved by setting up a knowledge-sharing environment in which learners share information or analyze situations online through the use of chat rooms, bulletin boards, and e-mail. In this way, Web-based peer learning can enhance problem-solving skills. Learners can be encouraged to discuss group issues and to develop strategies to implement new learning in real research practice. 

The program must also meet your organizations learning objectives and goals. You must determine your companys or sites educational philosophy and ask, Will this online program achieve our educational mission? If your company pedagogy involves the interactive transfer of information, then your program should allow your learners to network online. 

Clinical research learning is a high order of learning, which includes analysis, synthesis, and evaluation in contrast to the more rigid didactic method of learning. Two types of learner or attendee interaction should be considered for adult learnersinformation interaction and interpersonal interaction. Both can involve two online techniques: 

These forms of positive engagement can be achieved through a combination of advanced technology and media such as teleconferencing or video stream over the Internet. Solutions to e-learning can be expensive. So be cautious! Quotes for e-learning solutions will range tremendously. Consider possible costs and technology tips in setting up a virtual classroom:

	Hire a good HTML coder for your company.

	Work with a technology consulting group.

	Obtain several quotes breaking down all details of services provided.

	Outline which features you want to implement.

	Learn technology lingoHTML coding, Java Scripts, Cold Fusion, Flash.

Be aware that prices for e-learning solutions will vary depending on use of time, phases of development, and the level of experience of the coders and designers. And before investing in expensive technology, 

	develop your goals and timelines for the online project.

	get deadlines and commitments in writing.

	find out what costs will accrue for changes made throughout the running of the program.

	ask if these changes can be made in-house by your staff.

By 2002, there will be 40 million users on the World Wide Web, and online learning is predicted to become the largest sector in information technology transfer. Welcome to the new knowledge-based society! 


1. David LePay, Director, Office for Human Research Trials (OHRT), Keynote Address, Association of Clinical Research Professionals (ACRP) Annual Meeting, San Francisco, CA, 30 April 2001.

SIDEBAR: Advantages of Technology Training

	Learners choose the course time schedule

	Learning networksgroup learning forumscan be developed online 

	Study opportunities 24 hours a day, 7 days a week

	No travel to attend courses, or travel costs

	Up-to-date and ongoing information through membership fees.

BScN, RN, MEd, CCRC, CCRA, is president of CreateNet, Inc., 1484 Carlton St., Halifax, NS B3H 3B7, Canada, (902) 425-3038, fax (902) 425-6879, pjwright@createnetinc.com.

Notes from the Field

Clinical Research Training on the Web

The EMEA updates its positions on placebos, Crohns disease trials, and postmarketing surveillance of drugs used by pregnant women.


The European Union is trying to stay abreast of the world that changes around it. The last few weeks before the summer saw a flurry of activity from European regulators as they sought to update the rules they impose on drug development so that European medicines stay competitive and Europes subjects stay protected.

One of the moves was provoked by the recent revision of the Declaration of Helsinki. The European Agency for the Evaluation of Medicinal Products (EMEA) believes that the new version of Helsinkiwhich was issued in October 2000could rule out placebo trials, so it has issued its own position statement making sure that the door is left open in Europe to such an approach, contrary to any more restrictive interpretation of Helsinki.

View from Brussels

The EMEA updates its positions on placebos, Crohn?s disease trials, and postmarketing surveillance of drugs used by pregnant women.

The EMEA Keeps Up-to-Date

Outsourcing and data-sharing technologies are creating virtual pharmaceutical companies. Soon, you may be only as good as your network.


Currently, the data from more than 95% of all clinical trials is recorded in pen-and-paper format. Cleaning up human errors can take as long as six monthsa process that costs millions of dollars in lost sales for every day of delay. But the paper-based method may be headed for the recycle bin. The rising demand for ethical pharmaceuticals, the aging population, and the increased supply of compounds made possible by high-throughput screening and genomics are pressuring pharmaceutical companies to enlarge their pipelines. But as pipelines enlarge, the amount of clinical data and the effort required to collect, verify, and analyze that data will grow exponentially. 

Because of these demands, many companies will soon conduct every phase of their clinical trials via a global technological infrastructure. The Internet, for example, can be used to assist with subject and investigator recruitment, safety monitoring, regulatory submissions, and the management of clinical sites and data. Using the Internet and other information technologies, pharmaceutical companies can streamline operations, reduce costs and time to market, and maintain quality. 

But just adopting new technologies is not enough. To meet the demands for new products in the future, pharmaceutical companies will have to reinvent themselves and the ways they do business. Already, some pharmaceutical companiesparticularly start-upshave begun to migrate to a virtual company model to decrease drug development costs and speed time to market. 


A virtual company uses strategic partners to conduct trials and produce regulatory submissions. The pharmaceutical company functions as a backbone, integrating and managing the activities of its partners through the use of data-sharing technology. In a virtual organization, the lines between internal and external, research and development, and acquisition and analysis disappear. Both strategic and nonstrategic functions are outsourced to electronically integrated networks of partners, which may form long-term relationships or come together for a single project. Because each partner focuses exclusively on one business need or core competency, such as subject enrollment or investigator selection, these specialized partner companies can function far more efficiently than a conventional pharmaceutical company. 

Though drug development will continue to be a time-consuming and complex process, outsourcing functions to partners who share data in real time has the potential to dramatically improve efficiency during drug discovery, development, registration, and commercialization, saving millions of dollars in development costs and shaving years off development time. 

The virtual company model also changes the way pharmaceutical companies talk to regulators. Dialogue with regulators can begin during the start-up phase and continue at critical decision points throughout the drug development and marketing life cycle. In short, the virtual model can be vital to controlling clinical trial costs, reducing time to market, managing complexity, and improving product development success rates.

Despite this prospect of efficiency, most pharmaceutical companies have been slow to embrace online collection and sharing of data. The challenge of integrating and migrating data from existing systems into new ones, and the difficulty of winning acceptance and approval from a global user base, have hindered adoption of these technologies. But those willing to invest in new technology will see the pace of their drug development efforts significantly increase. And the benefits are not confined to clinical trials. Technology now in development will make it possible for every part of a compounds journeydiscovery, development, manufacturing, distribution, marketing, and salesto be electronically driven.


Once technological change and the demands of the marketplace have done their work, the pharmaceutical industry will comprise three different types of companies:

	A small number of global and highly networked pharmaceutical companies

	A large number of small, highly focused niche pharmaceutical companies

	The outsourced strategic partners, serving the first two groups, who specialize in a particular aspect of drug discovery, development, or manufacture. 

Pharmaceutical companies functioning in this virtual world will place a high priority on developing their information management infrastructures. The ability to access and integrate information from numerous partners and make that information readily available to key decision-makers in an organization will be critical to success. Each virtual company will cherish a group of technicians responsible for managing the data and technological systems necessary for decision support, information sharing, and collaboration. These specialists will enable different parts of an organization and its outsourced partners to communicate in real time and across geography. The sponsor and development partners will be able to access the same data, coordinate responsibilities, make decisions, and verify the status of specific projects in real time.

Finally, although investment in hardware, software, and IT staff will be a high priority for virtual pharmaceutical companies, the individualand the knowledge to which he or she has accesswill become increasingly significant to the success of future research and development efforts. The companies that will surviveand thrivein the future industry landscape will be those that not only keep up with technology, but also let their staff use the technology to support better decision making, knowledge sharing, and collaboration across all parts of the organization.

is a partner at Barnett International, Rose Tree Corporate Center, Ste. 2000, 1400 N. Providence Rd., Media, PA 19063, (610) 565-2622.

Feature Article

The Virtual Organization: Is It the Future Industry Landscape?

Work practice guides and regulatory review


I read with great interest the article on work practice guidelines (Work Practice Guides, 

, May 2001). I think it makes a valuable contribution to the increasing number of resources that have been published on SOPs to which the article relates.

The author writes: As for any other instructions that guide clinical practice (SOPs, protocol), work practice guidelines are subject to regulatory review, and it is important to be prepared to justify any deviations to auditors and regulators. I wonder if she could help me to better understand that statement.

I agree that in many organizations, it is standard practice for internal compliance auditors to review WPGs (and other materials associated with SOPs). If regulatory authorities find problems during an audit, of course they will request WPGs. But standard practice is different from the requirement for regulatory review. Is there a specific regulatory reference or guideline that she has in mind with regard to regulatory review of WPGs?

President, Shefrin & Associates
Menlo Park, CA 


Thank you for your interest in the article about work practice guides in the May issue of ACT. You pose an interesting question about their regulatory review. Standard operating procedures (SOPs) provide procedural information about what needs to be completed to fulfill the obligations of the regulations and provide auditors and regulatory authority inspectors a tool to monitor adherence.

Work practice guides (WPGs) are not intended to be regulatory in nature. They provide the necessary information and level of detail to guide day-to-day clinical practice decisions and actions.

They promote efficiency within a groupespecially when forms and templates are developedand promote a consistent approach to work activities. For example, a monitoring WPG may include information on the format of the monitoring report, how many days after the monitoring visit the report should be completed, etc. This is especially helpful when several CRAs are monitoring the same study. The WPGs give suggestions that guide practice rather than mandate practice.

Work instructions, on the other hand, are open for FDA inspection as they are used to satisfy FDA regulatory requirements. A clinical research department needs to determine if supportive procedural information is intended to mandate practice (work instructions) or guide practice (WPG).

In an inspection situation, the FDA normally uses the SOPs and work instructions as its reference. FDA would not review guidance documents unless the SOP specifically refers to them. Guidance documents are open for FDA inspection if they are used to satisfy FDA regulatory compliance requirements that are referenced in the SOPs. Another reason inspectors might review WPGs is if SOPs or work instructions are unclear and you suggest that they look at your guidance documents. That would make the WPGs auditable. I hope this clarifies this issue. 

Clinical Research Associate
3M Health Care, St. Paul, MN

Letters to the Editor

Readers respond to articles and columnists

Maintaining minimum standards can compromise the quality of your data and the rights and safety of study subjects.

Do You "Go the Extra Mile" or Adopt a Minimalist Mindset

Meet the EAB

Sabritt recalls the challenge of building a data management organization from the ground up while striving to retain the pioneering spirit, flexibility, and rapid decision-making capabilities or a startup culture.

David Sabritt

Are the virtual pharmaceutcal companies created by outsourcing and today's data-sharing technologies a sign of the industry's future direction?

The Virtual Organization

Let's start taking "e" for granted and look instead at the features we really need in clinical technology applications.

Applied Clinical Trials-08-01-2001