As biomedical research advances, the ethical principles governing informed consent have become increasingly stringent. The Personal taptap点点 Protection Law (PIPL) classifies medical health taptap点点 as sensitive personal taptap点点, indicating that data collected and processed by pharmaceutical companies during industry sponsored clinical trials (ISTs) contains a significant amount of sensitive personal taptap点点.

Ensuring compliance in the use of personal medical health data in ISTs has become a major concern for pharmaceutical companies. This article outlines the current legal regulations in China regarding the signing of informed consent forms (ICFs) for ISTs, and proposes an ICF compliance structure for handling personal data of IST human subjects in line with PIPL on sensitive personal taptap点点 processing.

These guidelines are intended to help pharmaceutical companies mitigate risks of non-compliance related to personal taptap点点 processing in ISTs.

As a guiding principle for ISTs, the Declaration of Helsinki, developed by the World Medical Association, prioritises the rights, interests and safety of human subjects over scientific and societal benefits, with informed consent being a crucial means of protecting these rights.

In the context of ISTs, informed consent involves informing subjects of all aspects that may influence their decision on participation and obtaining their voluntary agreement to participate. This process must be documented with a signed and dated ICF in written form.

Informed consent is a prerequisite for conducting ISTs and is an ongoing process. Throughout the research, the researcher is to continuously seek the subject’s consent, informing the subject of any changes in the research and other taptap点点 that may affect the subject’s decision to continue participating.

Based on the informed consent mechanisms outlined in the good clinical practice (GCP) international quality standard and the Measures for the Ethical Review of Biomedical Research Involving Humans, the PIPL has introduced more detailed compliance requirements for informed consent involving personal taptap点点.

Definition. Articles 4 and 28 of the PIPL distinguish between personal taptap点点 and sensitive personal taptap点点 (collectively “relevant personal taptap点点”). These articles clarify the types of activities in processing personal taptap点点, and stipulate necessary conditions for handling sensitive personal taptap点点.

Written consent. The PIPL mandates that consent must be given voluntarily and explicitly by individuals based on full taptap点点. If there are any changes in the processing of relevant personal taptap点点, fresh consent must be obtained from the individual.

Withdrawal. Article 15 of the PIPL stipulates that individuals have the right to withdraw their consent at any time. However, such withdrawal does not affect the validity of personal taptap点点 processing activities conducted prior to the withdrawal. Additionally, personal taptap点点 processors should provide convenient means for individuals to withdraw their consent.

During the conduct of ISTs, issues often arise with unclear notifications and lack of appropriate arrangements following the withdrawal of informed consent for relevant personal taptap点点 processing.

To address these concerns, the author recommends designing a compliance structure as below, which aligns with the informed consent mechanisms and ICF signing requirements outlined in the GCP and above-mentioned measures, as well as the informed consent compliance requirements for relevant personal taptap点点 under the PIPL. This approach aims to mitigate the risk of non-compliance in personal taptap点点 processing.

Distinguishing definitions. Differentiate the types of relevant personal taptap点点. Define human subjects’ basic personal taptap点点 that is collected, used and transmitted in ISTs as personal taptap点点, and classify their medical health data and taptap点点 on human genetic resources as sensitive personal taptap点点.

Identifying processors and accessors. List the personal taptap点点 processors and agents authorised to access relevant personal taptap点点. Also specify the security measures adopted to protect such taptap点点 being processed or accessed.

Protecting privacy. Clarify that personal taptap点点 processors will de-identify relevant personal taptap点点 to protect subjects’ privacy, along with the de-identification techniques specified.

Clarifying purposes. Specify the purpose and circumstances of personal taptap点点 processing, the duration of such processing, and the expected retention period of relevant personal taptap点点.

Confirming on reuse. Clarify whether the personal taptap点点 will be reused after the IST. In the case of taptap点点 reuse, it is recommended to clearly state that such taptap点点 will only be reused for medical or scientific research projects of the current IST drug. For research projects of other drugs, informed consent should be obtained from the subjects in written form separately.

Permissions after consent withdrawal. Clarify that relevant personal taptap点点 collected before the subject’s withdrawal of informed consent will be kept and used for the current IST. Provide options for full withdrawal and partial withdrawal, and explain the two options (differentiated by whether relevant personal taptap点点 will be collected in subsequent clinic visits or survival visits) for the subject to choose.

Built on the Cybersecurity Law, Data Security Law and the PIPL, the legal framework of personal medical health data protection has imposed higher compliance requirements on pharmaceutical companies. In strict observance of specific principles and requirements set out by the PIPL, pharmaceutical companies are to process relevant personal taptap点点 with due caution, ensuring legal compliance while effectively leveraging the value of medical health data.