RD Research Services, LLC | Compliance Expertise for IRBs & Institutions

Tag: human-subjects-research

  • National Advisory Committee on Human Research Protections (NACHRP): Interview with Julie Kaneshiro

    National Advisory Committee on Human Research Protections (NACHRP): Interview with Julie Kaneshiro

    Modified on March 5, 2026 to remove the “subscribe” option. This blog has been retired and replaced by the S.P.I.R.I.T. newsletter.

    Good morning, good afternoon, and good evening, Compliance Rockstars, Clinical Research Professionals, Ethics Enthusiasts, Legal Experts, and Investigators!

    330+ subscribers and counting!

    Interview with Julie Kaneshiro

    Written by Tasha Mohseni

    Today, we are going to learn about National Advisory Committee on Human Research Protections (NACHRP).

    In this candid interview with Julie Kaneshiro, we will learn about her journey when she first started in federal human research oversight. Then, we will shift the discussion towards NACHRP and what we can expect from this new organization.

    As a general reminder, these are my own interpretations. Any legal information discussed within this post should be discussed with your institution.

    Advertisements

    Table of Contents:

    I see youโ€™ve worked in the federal government industry throughout your entire career, specifically with OHRP from 2002 until June this year. What initially drew you into human research oversight?

    Julie suspects that her childhood exposure to the National Institutes of Health (NIH) through her motherโ€™s role as a social worker in the NIH Clinical Center that led to her interest in human research protections. In the early 1990s, she became an NIH management intern at NIH. Through this internship program, she learned about the Office of Human Research Protections’ (OHRP) predecessor office, the Office for Protection from Research Risks (OPRR).  The typical career path for a management intern at the time was research administration.

    However, she was interested in public policy and bioethics.

    Once she learned about OPRRโ€™s mission to protect research participants, she knew this is where she wanted to be. She expressed gratitude towards the people at OPRR who became her mentors, including Gary Ellis, Joan Porter, Bill Dommel, and Tom Puglisi. Julie joined soon after the Common Rule was adopted. The OPRR staff gave her invaluable experiences and opportunities to learn about these regulations and ethical issues that were present.

    (Back to the Contents)

    Iโ€™d like to learn how you became engaged with SACHRP (The Secretaryโ€™s Advisory Committee for Human Research Protections, but first why donโ€™t you give us a brief overview of who SACHRP was and their mission?

    SACHRP was created in 2003. This organization advised the Secretary of HHS about issues related to human research protections. Unfortunately, SACHRP was terminated in March 2025. SACHRPโ€™s recommendations were of great value to HHS, and especially to OHRP over this 22-year period.  The members of SACHRP and its subcommittees were some of the most knowledgeable people working in human research protections. They provided valuable recommendations to OHRP and other entities within HHS that have a role in the participant protections. HHS agencies include the Food and Drug Administration (FDA), NIH and the Office for Civil Rights (OCR).  OHRP was responsible for the management and support of SACHRP. Specifically, OHRP staff were involved with identifying topics that institutions would benefit from SACHRP and their subcommitteesโ€™ experience and expertise. 

    (Back to the Contents)

    When SACHRP was terminated in March 2025, how did you feel about this? Was the termination a surprise to you?

    Naturally, Julie was disappointed to learn about SACHRPโ€™s termination, but was not surprised.  It is not unusual for advisory committees to undergo change or be eliminated with a change in administration.  Prior to the establishment of SACHRP, there was the National Human Research Protections Advisory Committee which existed from 2000-2003. Their mission was comparable to SACHRP.

    (Back to the Contents)

    What were the main consequences (intended or unintended) of dissolving SACHRP for the human research protections community?

    The loss of SACHRP was not just a loss for OHRP and HHS, but also to:

    • The other Common Rule department and agencies,
    • The broader human research protections community and
    • The public more generally. 

    Though SACHRP wasn’t the only entity engaged in these crucial discussions, its important voice gave OHRP and others valuable insights. It is key that SACHRP was a FACA committee.

    FACA committees conduct meetings and deliberations in public, with the opportunity for public input.

    All of SACHRPโ€™s recommendations are available to the public. These recommendations remain an important resource for the human research protections community.

    (Back to the Contents)

    Letโ€™s shift the discussion to NACHRP (The National Advisory Committee on Human Research Protections). What is NACHRP?

    NACHRP is a volunteer-driven organization that aims to continue the tradition of the U.S. Department of Health and Human Services, Secretaryโ€™s Advisory Committee on Human Research Protections (SACHRP). NACHRP will:

    • Provide expert advice and practical recommendations to the human research community based on established ethical principles, including the Belmont Report and the Declaration of Helsinki.
    • Promote consistent interpretation and application of federal regulations and guidance in coordination with Institutional Review Boards (IRBs) and Human Research Protection Programs (HRPPs).
    • Respond to emerging challenges arising from advances in science, medicine, and technology, while anticipating future developments and supporting responsible innovation.
    • Commit to ethical vigilance and innovation in participant protections, and to honoring the trust placed in research with transparency, respect, and integrity.
    • Provide opportunities for community input and participation.

    (Back to the Contents)

    NACHRP is just beginning its work and is eager for input about what topics would be useful to address.

    NACHRPโ€™s first Town Hall meeting will be on Monday, December 8th from 10:00-11:30 PT (1:00-2:30 ET) on The Importance of โ€œUnchecking the Boxโ€:  A Primer on the Power of Regulatory Flexibility.

    This Town Hall will be hosted by the organization, Public Responsibility in Medicine and Research: Event Link

    • NACHRP appreciates and acknowledges the incredible breadth of subject matter expertise, creativity, and skill among those in the human research community.
    • If folks are interested in volunteering, NACHRP will issue periodic calls for those with specific, topical subject matter expertise to also help develop guidance.
    • Folks are welcome to submit their CV and top two specific areas of expertise at any time.

    (Back to the Contents)

    I hope you enjoyed this interview with Julie Kaneshiro!

  • Critical Clinical Trial Documents under ICH GCP E6(R3)

    Critical Clinical Trial Documents under ICH GCP E6(R3)

    Modified on March 5, 2026 to remove the “subscribe” option. This blog has been retired and replaced by the S.P.I.R.I.T. newsletter.

    Eager to skip ahead to today’s topic?

    Jump to the Table of Contents.

    Good morning, good afternoon, and good evening, Compliance Rockstars, Clinical Research Professionals, Ethics Enthusiasts, Legal Experts, and Investigators!

    330+ subscribers and counting!

    Authored By: Tasha Mohseni

    I’d like to dedicate today’s article to those who have served our country!

    Your sacrifices for our freedom can never be repaid.

    If any of my subscribers are veterans, please know that I recognize your patriotism, courage, and contributions. Regardless of the branch of military you serve, we see you. We may be honoring you today, but we keep you in our hearts forever. I know I always keep those family members of mine who have served in my heart daily.

    american flag on brown grass field
    Advertisements

    For today’s post, we are going to do further exploration on an ethical guideline.

    We will explore which documents are critical for clinical trials:

    • I will use ChatGPT to see what is considered a clinical trial document.
    • I will compare the ICH GCP E6(R3) document with ChatGPT’s analysis.

    As a general reminder, any legal information discussed within this post should be discussed with your institution.

    Table of Contents:

    Learning about critical clinical trial documents from ChatGPT

    As you may recall, I have a personal ChatGPT-4 account that I have used for various posts.

    Via the iterative prompting process, I’m going to share how I learned about critical documents in a clinical trial.

    Prompt 1: “What are critical documents in clinical trials?”

    ChatGPT provided the following response below:

    Critical documents in clinical trials are essential records required to ensure that a trial is conducted in compliance with Good Clinical Practice (GCP) and applicable regulatory requirements. These documents enable the evaluation of the conduct of the trial and the quality of the data produced. According to ICH E6(R2) GCP guidelines, critical documents should be maintained throughout the trial life cycle and are grouped into three categories:

    • Before the Clinical Trial Begins
    • During the Clinical Trial
    • After Completion or Termination
    ChatGPT has broken down the ICH GCP E6(R2) critical clinical trial documents into three phases: before, during, and after a clinical trial (or termination of a clinical trial). Each phase has a description of the type of documents present as well as a list of these documents.

    Please note this is a CREST graphic created via Google Slides (i.e., not ChatGPT).

    The purpose of these critical documents is to:

    • Ensure participant safety
    • Verify data integrity
    • Provide a trail for regulatory inspections
    • Support reproducibility and transparency

    Though this sounds like great information, I noticed one critical component.

    The above response is in accordance with ICH GCP E6(R2) guidelines.

    There are new guidelines that were adopted in January 2025: ICH GCP E6(R3).

    (Back to the Contents)

    Prompt 2: “What about in the ICH E6(R3) guidelines?“

    ChatGPT provided the following response below:

    Great question. The upcoming ICH E6(R3) Good Clinical Practice (GCP) guideline builds on the principles of ICH E6(R2) but takes a more flexible, risk-based, and modern approach to clinical trial documentation and conduct. While the core concept of critical documents remains, ICH E6(R3) shifts focus toward quality by design, fit-for-purpose documentation, and proportionality in managing trial records.

    What Are “Critical Documents” in ICH E6(R3)?
    ICH E6(R3) does not list a fixed inventory of critical documents (like R2 did with its Essential Documents list in Section 8). Instead, it emphasizes, Fit-for-purpose documentation:

    • Documentation should be proportional to the risk and complexity of the trial.
    • Only documents necessary to reconstruct and evaluate the trial are considered critical.
    • Sponsors and investigators are expected to identify which documents are critical for data reliability and participant protection.

    Key Shifts in R3 Regarding Documentation:

    There are three key shifts with respect to clinical trial documentation per the ICH GCP E6(R3): principle-based approach, quality management integration, and technology considerations. Each shift is described within this image.

    Please note this is a CREST graphic created via Google Slides (i.e., not ChatGPT).

    Instead of a fixed list, the types of documents likely to be considered critical still include:

    These examples of ICH GCP E6(R3) critical clinical trial documents fall under six categories: trial design, oversight & approval, participant safety, data integrity, accountability, and closure.

    Please note this is a CREST graphic created via Google Slides (i.e., not ChatGPT).

    Summary of Differences: ICH E6(R2) vs. R3 Table:

    AspectE6(R2)E6(R3)
    Document listFixed list of essential documents (Section 8)No fixed list; context-dependent
    FlexibilityLess flexibleMore flexible, risk-based
    EmphasisComplianceQuality-by-design
    TechnologyLimitedEmbraces digital systems, decentralized trials
    As stated within the table’s title, this table compares various aspects of documentation with respect to ICH GCP E6(R2) and ICH GCP E6(R3).

    Though I felt like I was getting closer to what I was looking for, I wasn’t quite there yet.

    (Back to the Contents)

    Prompt 3: “For Examples of Critical Documents under ICH E6(R3) can you define these in a bulleted list?”

    ChatGPT provided the following response below:

    Absolutely! Here’s a bulleted list of examples of critical documents under ICH E6(R3), grouped by functional area. These reflect the risk-based, flexible approach of R3 while aligning with essential GCP principles:

    These are examples of ICH GCP E6(R3) critical clinical trial documents with respect to trial design and planning. Examples of these documents along with their definitions are provided.

    Please note this is a CREST graphic created via Google Slides (i.e., not ChatGPT).


    These are examples of ICH GCP E6(R3) critical clinical trial documents with respect to oversight and ethical approval. Examples of these documents along with their definitions are provided.

    Please note this is a CREST graphic created via Google Slides (i.e., not ChatGPT).


    These are examples of ICH GCP E6(R3) critical clinical trial documents with respect to participant safety and rights. Examples of these documents along with their definitions are provided.

    Please note this is a CREST graphic created via Google Slides (i.e., not ChatGPT).


    These are examples of ICH GCP E6(R3) critical clinical trial documents with respect to data collection and integrity. Examples of these documents along with their definitions are provided.

    Please note this is a CREST graphic created via Google Slides (i.e., not ChatGPT).


    These are examples of ICH GCP E6(R3) critical clinical trial documents with respect to investigational product management. Examples of these documents along with their definitions are provided.

    Please note this is a CREST graphic created via Google Slides (i.e., not ChatGPT).


    These are examples of ICH GCP E6(R3) critical clinical trial documents with respect to trial oversight and conduct. Examples of these documents along with their definitions are provided.

    Please note this is a CREST graphic created via Google Slides (i.e., not ChatGPT).


    These are examples of ICH GCP E6(R3) critical clinical trial documents with respect to trial closure and reporting. Examples of these documents along with their definitions are provided.

    Please note this is a CREST graphic created via Google Slides (i.e., not ChatGPT).

    (Back to the Contents)

    Reviewing the ICH GCP E6(R3) guidelines

    Now that I have a list to refer to from ChatGPT, it’s time to review the guidelines themselves!

    What is Good Clinical Practice (GCP)?

    “Good Clinical Practice (GCP) is an international, ethical, scientific and quality standard for the
    conduct of trials that involve human participants.”

    The above is a direct quote from the ICH GCP E6(R3) guidelines. A few other bullet points worth mentioning are listed below:

    • The objective of this ICH GCP Guideline is to provide a unified standard to facilitate the mutual acceptance of clinical trial data for ICH member countries and regions by applicable regulatory authorities
    • This guideline builds on key concepts outlined in ICH E8(R1) General Considerations for Clinical Studies which includes:
      • Fostering a quality culture and proactively designing quality into clinical trials and drug development planning,
      • Identifying factors critical to trial quality, engaging interested parties, as appropriate, and
      • Using a proportionate risk-based approach

    Please note that it is not within the scope of this blog to discuss the guidelines in its entirety.

    (Back to the Contents)

    Jumping to Appendix C within the ICH GCP E6(R3) guidelines

    Appendix C includes essential records for the conduct of a clinical trial.

    Though this is not an exhaustive list, I wanted to make note of the following with Appendix C:

    • The essential records permit and contribute to the evaluation of the conduct of a trial in relation to the compliance of the investigator and sponsor with Good Clinical Practice (GCP) and applicable regulatory requirements and the reliability of the results produced
    • These records are used by the sponsorโ€™s independent audit function and during inspections by regulatory authority(ies) to assess the trial conduct and the reliability of the trial results
    • Certain essential records may also be reviewed by the institutional review board/independent ethics committee (IRB/IEC) in accordance with applicable regulatory requirements
    • These essential records should be maintained in or referred to from repositories held by the sponsor and by the investigator/institution for their respective records
    • Certain essential records may not be specific to a trial but may be related to the investigational product, facilities or processes and systems, including computerized systems, involved in running multiple trials and retained outside the trial-specific repositories such as:
      • Investigatorโ€™s Brochure
      • Master services agreements
      • Standard operating procedures
      • Validation records

    “The assessment of whether a record is essential and has to be retained should take into account the criteria below.”

    As stated within the guidelines, an essential record:

    • Is a document that is submitted to or issued by the regulatory authority or IRB/IEC, including related correspondence and those documenting regulatory decisions or approvals/favorable opinions;
    • Is a trial-specific procedure or plan;
    • Is relevant correspondence or documentation of meetings related to important discussions and/or trial-related decisions that have been made related to the conduct of the trial and the processes being used;
    • Documents the conduct of relevant trial procedures (e.g., database lock checklist produced from following data management standard operating procedures (SOPs));
    • Documents the arrangements between parties and insurance/indemnity arrangements;
    • Documents the compliance with the requirements and any conditions of approval from the regulatory authority or the favorable opinion of the IRB/IEC;
    • Documents the composition and, where appropriate, the functions, correspondence and decisions of any committees involved in the trial approval or its conduct;
    • Demonstrates that a trial-specific computerized system is validated and that non-trial-specific systems (e.g., clinical practice computerized systems) have been assessed as fit for purpose for their intended use in the trial;
    • Is a document that has been authorized/signed by the sponsor and/or investigator to confirm review or approval;
    • Is, where necessary, documentation that demonstrates signatures/initials of staff undertaking significant trial-related activities; for example, completing data acquisition tools;
    • Documents what information was provided to potential trial participants and that participantsโ€™ informed consent was appropriately obtained and maintained;
    • Documents that sponsor personnel involved in the trial conduct and individuals performing significant trial-related activities on their behalf are qualified by education, training and experience to undertake their activities;
    • Documents that the investigator and those individuals delegated significant trial-related activities by the investigator are qualified by education, training and experience to undertake their activities, particularly where the activities are not part of their normal role;
    • Contains the data as well as relevant metadata that would be needed to allow the appropriate evaluation of the conduct of the trial;
    • Is a document related to the sponsor or investigator oversight of trial participant safety during the trial, including compliance with safety reporting requirements between sponsors and investigators, regulatory authorities and IRBs/IECs and informing trial participants of safety information as necessary;
    • Documents that service providers are suitably qualified for conducting their delegated or transferred activities;
    • Documents that laboratory activities and other tests used in the trial are fit for purpose;
    • Documents sponsor oversight of investigator site selection and monitoring and audit of the trial, where appropriate, and provides information on arising issues/noncompliance and deviations detected and implementation of corrective and preventative actions;
    • Documents the compliance with the protocol and/or procedures for management and statistical analysis of the data and production of any interim report and the final report;
    • Documents the collection, chain of custody, processing, analysis and retention or destruction of biological samples;
    • Provides relevant information on the investigational product and its labeling;
    • Provides information about the shipment, storage, packaging, dispensing, randomization and blinding of the investigational product;
    • Provides, where appropriate, traceability and accountability information about the investigational product from release from the manufacturer to dispensation, administration to trial participants, return and destruction or alternative disposition;
    • Provides information on the identity and quality of the investigational product used in the trial;
    • Documents processes and activities relating to unblinding;
    • Documents the recruitment, pre-trial screening and consenting process of trial participants and their identity and chronological enrollment as appropriate;
    • Documents the existence of the trial participants and substantiates the integrity of trial data collected. Includes source records related to the trial and medical treatments and history of the trial participants;
    • Defines processes/practices in place in the event of a security breach in order to protect participantsโ€™ rights, safety and well-being and the integrity of the data

    (Back to the Contents)

    Comparing essential ICH GCP E6(R3) records to ChatGPT critical clinical trial documents

    For ease of comparison, let’s review the essential records table from ICH GCP E6(R3) to ChatGPT’s critical clinical trial documents!

    I decided that a Google spreadsheet would be the best way to do this comparison. You can view and download the spreadsheet here: CT Document Table Comparison.

    Upon review:

    • ChatGPT only stated 26 clinical trial documents while the ICH guidelines stated 55 essential documents.
      • Please note that though there are 59 rows within the spreadsheet, three of the rows are grouped (rows 18-21).
    • In yellow, I highlighted documents that ChatGPT mentioned which appeared to be a direct match to the ICH guidelines.
      • 12 clinical trial documents were highlighted.
    • In orange, I highlighted documents that ChatGPT mentioned which appeared to be a partial match to the ICH guidelines.
      • Six clinical trial documents were highlighted.
    • Eight documents remained white (i.e., no color highlight) from the ChatGPT column.
      • These documents didn’t appear to match any of the essential records from the ICH guidelines column.

    Though ChatGPT gave me a starting point, I wouldn’t solely rely on this for learning purposes.

    You really need that specialized expertise to help get you started.

    (Back to the Contents)

    Advertisements

    I hope you found this post educational and useful!

  • DOJ Bulk Data Transfer Rule Brief

    DOJ Bulk Data Transfer Rule Brief

    Modified on March 5, 2026 to remove the “subscribe” option. This blog has been retired and replaced by the S.P.I.R.I.T. newsletter.

    Eager to skip ahead to today’s content?

    Jump to the Table of Contents.

    Good morning, good afternoon, and good evening, Compliance Rockstars, Clinical Research Professionals, Ethics Enthusiasts, Legal Experts, and Investigators!

    330+ subscribers and counting!

    Authored By: Tasha Mohseni

    Can’t believe we are already through November! As much as this year has gone slow for me, it also feels unbelievably fast…

    As I’ve mentioned in numerous posts, we have endured MANY changes this CY25 that have impacted FY26. Ideally, a central repository would be best to review all regulatory updates (at least in my opinion).

    brown wooden ruler and colored pencils on papers

    For now though, I will do my best to keep up with these changes in this evolving landscape! It truly lifts my spirits to spread knowledge to the research compliance community.

    Did anyone attend CITI Program’s webinar that discussed the DOJ Bulk Data Transfer Rule last month?

    I thought the presentation was fabulous! The speaker was informative and had great slides to explain this rule. If you weren’t able to attend, I’m really glad you’re here! For today’s post let’s learn about DOJ’s Bulk Data Transfer Rule. Specifically, I’d like to touch on:

    • What is this rule?
    • When is the rule effective?
    • Why is this rule necessary?
    • What resources are available to better understand this rule?

    Please note that I will NOT be sharing presentation slides or describing the presentation verbatim. Though it gave me background on this topic, I have spent quite some time researching this rule myself. I always want to provide my readers a comprehensive overview of any topic I write about!

    As a general reminder, these are my own interpretations. Any legal information discussed within this post should be discussed with your institution.

    Advertisements

    Table of Contents:

    1. DOJ Rule Matrix
    2. DOJ Rule Timeline
      1. EO 14117: Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern
      2. CISA Publication: Security Requirements for Restricted Transactions
      3. Key Dates and Actions
    3. DOJ Rule Applicability
      1. Data Types Defined Under the DOJ Rule
        1. Biometric Identifiers
        2. Covered Personal Identifiers
        3. Goverment-related Data
        4. Human Biospecimens
        5. Human’omic Data
        6. Personal Financial Data
        7. Personal Health Data
        8. Precise Geolocation Data
      2. Data Transactions Defined Under the DOJ Rule
        1. Transaction
        2. Exempt Transactions
        3. Prohibited Transactions
        4. Restricted Transactions
      3. Other Important Definitions Under the DOJ Rule
        1. Bulk U.S. Sensitive Personal Data
        2. Covered Data Transaction
          1. Access
          2. Countries of Concern
          3. Covered Person
          4. Data Brokerage
          5. Vendor Agreement
          6. Employee Agreement
          7. Investment Agreement
      4. Piecing it Together: Applying the DOJ Rule

    DOJ Rule Matrix

    The DOJ Rule Matrix provides key highlights of the final rule.

    DOJ Bulk Data Transfer RuleDownload
    • In general, this rule prohibits and restricts certain sensitive health, genomic, and personal data transactions with certain countries or persons.
    • This rule heavily relies on understanding definitions to determine appropriate applicability and compliance.
    • The rule was finalized in January 2025 with two effective dates (which will be discussed in the subsequent sections).
    • Each resource listed within the matrix will also be described in the subsequent sections.

    (Back to Contents)

    DOJ Rule Timeline

    The timeline for rule creation and implementation stemmed from EO 14117 in February 2024.

    DOJ Rule TimelineDownload

    (Back to Contents)

    CISA Publication: Security Requirements for Restricted Transactions

    • As directed by EO 14117, CISA developed security requirements to apply to classes of restricted transactions identified in the DOJ regulation.
    • The security requirements require that U.S. persons engaging in restricted transactions comply with organizational-, system-, and data-level requirements to prevent covered persons and countries of concern from accessing covered data that is linkable, identifiable, unencrypted, or decryptable using commonly available technology.

    (Back to Contents)

    Key Dates and Actions

    (Back to Contents)

    Now, we have a better background as to why this rule was created. Further, we’ve reviewed supporting publications prior to the issuance of the DOJ rule. In the final section, we will dive into:

    • Key terms that will help us understand when the rule applies
    • Rule applicability

    (Back to Contents)

    Advertisements

    DOJ Rule Applicability

    There are many terms we need to work through prior to applying this rule.

    Data Types Defined Under the DOJ Rule

    DOJ Rule DataDownload

    Note that “Sensitive Personal Data” will be described in the next section as it is based off many terms.

    Biometric Identifiers

    • Measurable physical characteristics or behaviors used to recognize or verify the identity of an individual, including facial images, voice prints and patterns, retina and iris scans, palm prints and fingerprints, gait, and keyboard usage patterns that are enrolled in a biometric system and the templates created by the system

    Covered Personal Identifiers

    • Any listed identifier:
      • In combination with any other listed identifier; or
      • In combination with other data that is disclosed by a transacting party pursuant to the transaction such that the listed identifier is linked or linkable to other listed identifiers or to other sensitive personal data.
    • There are also several exclusions and examples listed within this term within the rule

    Goverment-related Data

    • Any precise geolocation data, regardless of volume, for any location within any area enumerated on the Government-Related Location Data List in ยงโ€‰202.1401 which the Attorney General has determined poses a heightened risk of being exploited by a country of concern to reveal insights about locations controlled by the Federal Government, including insights about facilities, activities, or populations in those locations, to the detriment of national security, because of the nature of those locations or the personnel who work there; and
    • Any sensitive personal data, regardless of volume, that a transacting party markets as linked or linkable to current or recent former employees or contractors, or former senior officials, of the United States Government, including the military and Intelligence Community

    Human Biospecimens

    • Means a quantity of tissue, blood, urine, or other human-derived material, including such material classified under any of the following 10-digit Harmonized System-based Schedule B numbers

    Human’omic Data

    • Represents the following human data types:
      • Genomic data
      • Epigenomic data
      • Proteomic data
      • Transcriptomic data
    • Excludes pathogen-specific data embedded in human `omic data sets

    Personal Financial Data

    • Data about an individual’s credit, charge, or debit card, or bank account, including purchases and payment history; data in a bank, credit, or other financial statement, including assets, liabilities, debts, or trades in a securities portfolio; or data in a credit report or in a โ€œconsumer report”

    Personal Health Data

    • Health information that indicates, reveals, or describes the past, present, or future physical or mental health or condition of an individual; the provision of healthcare to an individual; or the past, present, or future payment for the provision of healthcare to an individual.

    Precise Geolocation Data

    • Includes data, whether real-time or historical, that identifies the physical location of an individual or a device with a precision of within 1,000 meters

    (Back to Contents)

    Data Transactions Defined Under the DOJ Rule

    Note that “Covered Data Transaction” will be described in the next section as it is based off many terms.

    DOJ Rule Data TransactionsDownload

    Transaction

    • Any acquisition, holding, use, transfer, transportation, exportation of, or dealing in any property in which a foreign country or national thereof has an interest.

    Exempt Transactions

    • A data transaction that is subject to one or more exemptions described in subpart E of this part.
    • This will be described in the last section.

    Prohibited Transactions

    • A data transaction that is subject to one or more exemptions described in subpart C of this part.
    • This will be described in the last section.

    Restricted Transactions

    • A data transaction that is subject to one or more exemptions described in subpart D of this part.
    • This will be described in the last section.

    (Back to Contents)

    Advertisements

    Other Important Definitions Under the DOJ Rule

    Bulk U.S. Sensitive Personal Data

    Bulk US SP DataDownload
    • As notated in the rule, “bulk” is equivalent to a sensitive personal data threshold.
      • There are seven thresholds:
        • Human `omic data
        • Biometric identifiers
        • Precise geolocation data
        • Personal health data
        • Personal financial data
        • Covered personal identifiers
        • Combination of all data types above

    Covered Data Transaction

    Covered Data TransactionDownload

    Note that the following terms have been defined:

    • Transaction,
    • Government-related data, and
    • Bulk U.S. sensitive personal data
    Access
    • Logical or physical access, including the ability to obtain, read, copy, decrypt, edit, divert, release, affect, alter the state of, or otherwise view or receive, in any form, including through information systems, information technology systems, cloud-computing platforms, networks, security systems, equipment, or software
      • For purposes of determining whether a transaction is a covered data transaction, access is determined without regard for the application or effect of any security requirements
    Countries of Concern
    • Cuba, Venezuela, Russia, North Korea, China, and Iran are countries of concern
    • From the rule, these are any foreign government that, as determined by the Attorney General with the concurrence of the Secretary of State and the Secretary of Commerce:
      • Has engaged in a long-term pattern or serious instances of conduct significantly adverse to the national security of the United States or security and safety of United States persons; and
      • Poses a significant risk of exploiting government-related data or bulk U.S. sensitive personal data to the detriment of the national security of the United States or security and safety of U.S. persons
    Covered Person
    • There are five types listed within this definition along with their associated examples within the rule
    • From the webinar, a covered person can be anyone who is from any of the countries of concern (resident, national, official) and also could mean a corporate person/entity from these countries
      • Considering this person’s affiliation is crucial
    Data Brokerage
    • The sale of data, licensing of access to data, or similar commercial transactions, excluding an employment agreement, investment agreement, or a vendor agreement, involving the transfer of data from any person (the provider) to any other person (the recipient), where the recipient did not collect or process the data directly from the individuals linked or linkable to the collected or processed data.
    Vendor Agreement
    • Any agreement or arrangement, other than an employment agreement, in which any person provides goods or services to another person, including cloud-computing services, in exchange for payment or other consideration.
    Employee Agreement
    • Any agreement or arrangement in which an individual, other than as an independent contractor, performs work or performs job functions directly for a person in exchange for payment or other consideration, including employment on a board or committee, executive-level arrangements or services, and employment services at an operational level.
    Investment Agreement
    • An agreement or arrangement in which any person, in exchange for payment or other consideration, obtains direct or indirect ownership interests in or rights in relation to:
      • Real estate located in the United States; or
      • A U.S. legal entity.

    (Back to Contents)

    Piecing it Together: Applying the DOJ Rule

    Though this was shared earlier in this post, the following resource is recommended to review to ensure compliance and understanding of this rule: Data Security Program: Compliance Guide

    • In general, you should complete an inventory of your data
      • You should review the type of data in question and where it is being transferred to, so rule applicability can be assessed
    • Subparts C-E are critical in understanding data transactions as some of these data transactions are exempt from this rule
    • The guide and rule itself should be reviewed for specific reporting, record keeping, and auditing requirements

    (Back to Contents)

    I hope this article helped you better understand the DOJ’s Bulk Data Transfer Rule! If you did attend the CITI Program webinar, then this post should have been a nice resource to complement what you learned.

  • Subscriber Spotlight: Confessions of a Research Compliance Professional

    Subscriber Spotlight: Confessions of a Research Compliance Professional

    Modified on March 5, 2026 to remove the “subscribe” option. This blog has been retired and replaced by the S.P.I.R.I.T. newsletter.

    Eager to skip ahead to today’s content?

    Jump to the Table of Contents.

    Good morning, good afternoon, and good evening, Compliance Rockstars, Clinical Research Professionals, Ethics Enthusiasts, Legal Experts, and Investigators!

    330+ subscribers and counting!

    Written by Kelsey Miller

    Reviewed by Tasha Mohseni

    We’ve made it to November folks! I bet you’re ready for a much needed holiday break at the end of the month (aka Thanksgiving).

    I always love using that week/weekend for family time and connecting with loved ones. However, it’s just as important to recharge your OWN batteries. I can’t stress enough how important it is to practice self care. Life in itself can be difficult. Even if life is going smoothly, our profession can be burdensome. Whether you’re in IRB, IACUC, or any other compliance area, you might feel that we have a heavy burden. And by burden, I don’t mean feeling weighed down. I mean our burden (and responsibility) to protect those who choose to participate in research.

    a woman wearing a sleep mask

    If you feel overwhelmed or unsure your daily tasks, this article is for you: Top Career Hacks for Compliance Professionals.

    For today, first, I’d like to welcome you back to the Subscriber Spotlight blog series!

    For these posts, you can expect to read:

    • An introduction of the valued subscriber,
    • How long the individual has been a subscriber,
    • Relevant social media and/or publications, and
    • A brief description of today’s topic.
    Advertisements

    Who is Kelsey Miller?

    Kelsey Miller is compliance program manager with a focus on collaborative approaches to enhance the research enterprise who has been a CREST subscriber since.

    • She has experience working in the laboratory research industry in a cross functional research management and compliance role.
    • She’s highly skilled in areas of human subjects research, animal research, committee coordination, internal and external communication, and protocol development.
    • She’s adept in team leadership, facilitation, project management, training, and presentation of scientific concepts.
    • Lastly, Kelsey’s passionate about human health and research-driven solutions.

    Kelsey will share her perspective as a research compliance professional and the importance of building community in this space.

    Without further ado, let’s get started! As a general reminder, any legal information discussed within this post should be discussed with your institution. The views in this post are of the authors alone and not their employers.

    Table of Contents:

    Research compliance found me

    I hear this kind of sentiment regularly around the field. Most of us arrive in our first IRB, IACUC, or other compliance role without having known it existed previously. This field isnโ€™t on a list of careers in high school or college. It isn’t something typically โ€œfallen intoโ€ based on interest in research or general administrative ability. What Iโ€™ve found in my first decade in this field is a profession that deserves to be defined.

    This is community that I could not be more proud to count myself among.

    We have an opportunity, perhaps a responsibility, to continue the growth of this community by:

    • Defining our professional identity and core skill sets,
    • Supporting the continued development and standardization of best practices, and
    • Finding our communal voice as a cohesive field.

    (Back to the Contents)

    Our professional identity is difficult to define

    Sometimes we are defined by the term โ€œcomplianceโ€ as playing the hall monitor or security guard role, catching bad behavior.

    Letโ€™s all agree here, catching bad behavior is NOT why we came to this field!

    If youโ€™re like me, you connect most with the vision of finding the best way to harmonize the requirements, research, and reality (aka constraints) with the larger mission of helping humankind through ethical scientific discovery! Our shared identity may then be better defined by:

    • The communities we bring together,
    • The regulatory complexities we navigate, and
    • The ethical values we are charged to prioritize within our roles.

    (Back to the Contents)

    The ability to bridge

    The foundational competency of a successful Research Compliance Professional, I believe, is best defined as the ability to bridge.

    Bridging the gap between science and the realities of people impacted, between the complexity of the requirements and the chaos of the research environment, between whatโ€™s most ethical and whatโ€™s actually possible, between what the researcher wants to do and what they actually wrote in a protocol๐Ÿ˜‰. This competency is much more than simply memorizing regulations, it is rooted in an understanding of both people and language, blossoming through collaborative facilitation of interconnected yet fragmented systems. I believe our professionโ€™s defining characteristic is as complexity navigators!

    Our certifications, professional communities, and career development focus should therefore reflect this foundation as a collection of many more skills and abilities than regulatory knowledge. Todayโ€™s drivers of change are many (e.g., AI, regulatory uncertainty, changes to research systems, etc), but the research compliance profession is founded in this ability to navigate complex perspectives and fragmented systems. By supporting these professionals more holistically, our untapped capacity to navigate and connect systems can drive the research environment of the future.

    (Back to the Contents)

    We must prioritize connection and collaboration

    As the field takes this defining next step in recreating our professional identity, we must prioritize creating spaces for connection and sharing.

    Communities are a necessity to establish innovative best practices designed to take on our future challenges. I have had the privilege of talking with many in this community, and each individual voice brings a different experience. From the small institution where a weary one-person office juggles five compliance roles to the manager of two dozen staff focused only on the huge workload of a human subjects research program.

    Our shared knowledge has the potential to create significant advances and define the next generation of our professional identity, but we must bring these voices together.

    In celebrating the diverse experiences of our field and the complex skillset we develop, it should not be lost that sharing and cocreation requires many different forums. By supporting networking and information sharing both within and across regional groups and regulatory areas, our communal identity can begin to shape the development of the field as a whole. The complexity of these fragmented systems necessitates wider connections between institutions for standardization and specialization as needed in organizations both large and small, health-centered and academic, for-profit and public, etc. 

    (Back to the Contents)

    Share your voice with the community

    If thereโ€™s one message I hope to convey, it is to encourage readers to add their voice as well as learn from the wider community.

    There are so many opportunities to engage! For the last three years, Iโ€™ve had the honor of facilitating a group of professionals from small human subject programs, the Small HRPP Community. In this community we:

    • Focus on keeping up-to-date on regulatory changes (thanks for your help CREST!) and
    • Open discussion of local challenges within our programs.

    We are able to focus on solutions that are specific to small programs with 1 or 2 staff members, provide support for particular challenges we face in lack of resources or historical precedent, and come together to share innovations and best practices. This year, Iโ€™ve begun a new initiative to create a similar community for animal research programs. If you havenโ€™t found the community that fits your needs, start one! The more opportunities we take to share, the stronger our identity grows.

    (Back to the Contents)

    Final thoughts

    We are in a foundational moment as our profession matures, and our regulatory and research environments change.

    Our strength is in our diverse experience and shared knowledge, our ability to bridge across complexities and perspectives. By supporting each other through community, we have the opportunity to emerge as a unified voice for reasonable, ethical research practices in an environment desperate for complexity navigators!

    (Back to the Contents)

    I hope you enjoyed reading this post from Kelsey Miller!

  • Followup: Open FDA Investigation on Alleged Non-Consensual Human Experimentation

    Followup: Open FDA Investigation on Alleged Non-Consensual Human Experimentation

    Modified on March 5, 2026 to remove the “subscribe” option. This blog has been retired and replaced by the S.P.I.R.I.T. newsletter.

    Eager to skip ahead to today’s content?

    Jump to the Table of Contents.

    Good morning, good afternoon, and good evening, Compliance Rockstars, Clinical Research Professionals, Ethics Enthusiasts, Legal Experts, and Investigators!

    330+ subscribers and counting!

    Authored By: Tasha Mohseni

    It’s not often that I post twice in one week.

    But when I do…it’s for a good reason! This is also the first time I am following up on a topic that I have recently written about. I’m unsure how many of you all are also writers, but I love revisiting my old articles. There are several reasons why I enjoy doing this:

    clear light bulb placed on chalkboard
    1. You get to see how your writing style has evolved.
      • You get to see if your writing has improved (or may need improvement). You might even pick up on mistakes you’ve made to correct for next time.
      • Better yet, maybe you will come across something you felt you wrote really well. Maybe you liked how you communicated a certain topic and you want to follow that writing style again.
    2. You get to see how the design of your website has changed.
      • I’m still finalizing my “blog template”, so to speak. In other words, I review my old articles to see how I can optimize my blog layout for my readers.
        • I’m always open to suggestions, so please feel free to reach out!
    3. You can learn a lot by reviewing your old content.
      • Sometimes you can think of new content to generate from old content.
      • Other times, you may challenge your old content. Maybe what you originally wrote is either:
        • Incorrect or
        • You should have thought about it differently

    Without further ado, let’s dive into today’s topic!

    For today, I am going to follow up with my original post regarding the open FDA investigation on alleged non-consensual human experimentation.

    As a general reminder, these are my own interpretations. Any legal information discussed within this post should be discussed with your institution.

    Advertisements

    Table of Contents:

    1. A comment from a subscriber
    2. Let’s review the petition again
    3. A very important lesson is to be learned here
    4. Distinguishing between research and practice
    5. Final Thoughts

    A comment from a subscriber

    A special thank you to Erica Heath for your commentary!

    I’ll say it again for the people in the back, I LOVE receiving feedback from CREST subscribers. When Erica reached out to me, she made a very interesting point:

    "This is very strange. All I see is the petition which, in one page, says nothing and the one page journal entry which is about bad treatment but not research.  Is there a study?  In your analysis, none of these apply if there is no research. There is a significant difference between experimentation and research."

    This was my exact expression…it was as if my mind blew up on itself! It didn’t even dawn on me that there wasn’t a study number referenced. I thought to myself,

    Hmmm…it’s not like me to miss something like that.

    First, I checked to see if there were new documents in the docket. There were none. Then, I thoroughly went through the files within the docket again. No study ID found.

    (Back to the Contents)

    Let’s review the petition again

    This can be reviewed here: FDA-2025-P-5514-0003: Citizen’s Petition Documentation to be attached to Procedural Citizen’s Petition to FDA – Redacted

    As a recap, the petition states:

    • Alleged ongoing use of electrophysiological stimulation and electromagnetic exposure causing pain, seizure-like events, and neurological harm amounting to Electroconvulsive Shock Torture (ECST)
    • ECST is distinct from Electroconvulsive Therapy (ECT) which is a regulated medical treatment
    • Citing federal regulations mentioned above and that human experimentation cannot be performed without consent

    In greater detail, the petitioner states the following methods are being used against her:

    • Electroconvulsive Shock Torture (ECST):
      • Non-consensual, abusive use intended to inflict pain, seizures, cognitive disruption, and trauma
      • Conducted at voltages higher than those used in Electroconvulsive Therapy (ECT), without safegaurds
    • Electromagnetic torture:
      • Pressure, pain, and disruption of neurological processes, including simulated seizures and cardiovascular distress
    • Human-to-Human interface and psychological torment:
      • Harassment, defamation, ridicule, and interference with personal relationships
      • Continuous verbal torment designed to destabilize her socially and psychologically

    (Back to the Contents)

    A very important lesson is to be learned here

    So, no study ID was mentioned. We just verified this. Now, what does this mean?

    When I first saw this petition, I automatically assumed this was human subjects research. I saw “non-consensual”, took it, and ran with it. I saw “FDA investigation” and thought I hit the jackpot. I thought I found a recent research ethics violation case. And maybe I still did. But without that study ID, I can’t assume this is human subjects research.

    (Back to the Contents)

    Distinguishing between research and practice

    Let’s revisit the Belmont Report.

    When I traditionally think of the Belmont Report, I think of only Parts B and C. These parts are where the principles are introduced as well as application of these principles. However, there is another very important part, Part A. In Part A of the Belmont Report, the distinction between research and practice is noted.

    "It is important to distinguish between biomedical and behavioral research, on the one hand, and the practice of accepted therapy on the other, in order to know what activities ought to undergo review for the protection of human subjects of research."

    Let’s define these terms:

    • Practice
      • Refers to interventions that are designed solely to enhance the well-being of an individual patient or client and that have a reasonable expectation of success.
      • The purpose of medical or behavioral practice is to provide diagnosis, preventive treatment or therapy to particular individuals.
    • Research
      • An activity designed to test an hypothesis, permit conclusions to be drawn, and thereby to develop or contribute to generalizable knowledge (expressed, for example, in theories, principles, and statements of relationships).
      • Usually described in a formal protocol that sets forth an objective and a set of procedures designed to reach that objective.

    I’d like to pull another important quote from the Belmont Report:

    "When a clinician departs in a significant way from standard or accepted practice, the innovation does not, in and of itself, constitute research. The fact that a procedure is 'experimental', in the sense of new, untested or different, does not automatically place it in the category of research."

    The report continues with stating that new procedures of this description should be considered formal research at an early stage to determine whether they are safe and effective. Further, it is the responsibility of medical practice committees to insist that a major innovation be classified as research. Research and practice may be carried on together when research is designed to evaluate the safety and efficacy of a therapy. The general rule is that if there is any element of research in an activity, that activity should undergo review for the protection of human subjects.

    (Back to the Contents)

    Final Thoughts

    Unless we know for certain that we are investigating human subjects research, then these research ethic tenets wouldn’t be applicable to this docket.

    If I see another docket of this nature, you bet your bottom dollar that will be the first thing I do. I will see if there is an ethics board and/or study ID mentioned. I also wanted to share some relevant links I found during my research if you’d like to further dive into the topic:

    (Back to the Contents)

    I hope you enjoyed my follow-up post to this open FDA investigation!