Drug Evaluation Committee 2023-36 Handling of personal information when using ePRO
Related classification: Other
Date of first publication: Feb 2024
Question.
Recently, we have seen an increase in PRO evaluations and patient diaries in clinical trials, where patients access the site via a dedicated tablet or their own smartphone to complete the diaries and questionnaires.
We would appreciate it if you could provide us with any points to keep in mind when using your own smartphone and registering your personal e-mail address.
We would also appreciate it if you could tell us what we need to do, such as confirming with the sponsor in advance, clearly stating in the consent document, and responding to the IRB, when downloading the application to your own smartphone or registering your personal e-mail address in a smartphone dedicated to your logbook.
We would be grateful if we could understand what the facility should keep in mind from the perspective of protecting personal information.
Pharmaceutical Association's Opinion
The following is our opinion on points to keep in mind when registering individual patient e-mail addresses.If a specific individual can be identified from the user name and domain name of the e-mail address (e.g., Seiyaku_kyoko@example.com), the e-mail address itself constitutes personal information by itself. Even in other cases, if a specific individual can be easily identified by cross-checking with other information, then the information as a whole together with such information may fall under the category of personal information.
If the information falls under the category of personal information, it must also comply with the Personal Information Protection Law. In other words, the following points should be noted
1) The purpose for which personal information is obtained must be specified, and the information must be used within the scope of that purpose. The purpose of use should be notified to the subject and consent obtained. 2.
(2) Personal information should be stored and managed appropriately to prevent leakage. (3) If personal information is provided to a third party, it should be provided to a third party.
When providing personal information to a third party, consent should be obtained from the subject in advance. If the country of provision has been determined, make sure that the name of the foreign country, information on the system for protection of personal information in that country, and information on the measures to be taken by the third party to protect personal information are included in the explanatory document. Even if the country of provision cannot be specified at the time of obtaining consent, confirm that a statement to the effect that the country of provision cannot be specified and the reason for this is included. 4.
(4) If there is a request for disclosure, etc. from the subject himself/herself, this shall be responded to.
For this reason, it is important that the explanatory documents for the relevant clinical trial not only describe the items to comply with the Personal Information Protection Law mentioned above, but also describe what information will be obtained when the subject's smartphone is used and how that information will be handled in the explanatory documents, and obtain consent appropriately from the subject. We believe that it is important to obtain consent from subjects appropriately.
If necessary, please also refer to the Guidelines for the Safe Management of Medical Information Systems, Version 6.0 (May 2023).