From internal communication and management systems to tools sponsors deploy to improve operations and results, technology is everywhere in the clinical trial landscape. However, these technologies are only as good as the security measures that surround them. In this blog, we share Cognivia’s approach to IT infrastructure and security.

Despite the prevalence of technology across all facets of society, many sponsors tend to err on the side of caution when incorporating new technology into their studies. This is because with more technology comes greater risk for security issues – and clinical trial data is as sensitive as data can get. 

There are many pharmaceutical regulatory constraints that technology providers have to work within, but this security liability is still understandably a concern for sponsors.

We’re here to help ease some of those concerns with regard to our own technology – Placebell©™. 

What is Placebell Technology? 

Placebell is a machine learning-based method that predicts and accounts for individual patients’ placebo responsiveness in clinical trials. To do this, studies need:

1. A trained ML model in the indication of interest
2. A validated approach that collects individual patient characteristics (personality traits, expectations and other factors)

The combination of the trained ML model fed with patients characteristics produces a prognostic covariate (a score) that study statisticians can use as a baseline covariate to cut through the noise and determine true treatment efficacy. 

The opportunity Placebell presents to decrease variance and increase study power is paramount. Truly, Placebell helps de-risk trials. However, the very nature of the ML model and questionnaire require a lot of data for the service to truly de-risk. Data security and the quality of our infrastructure must be on par with this service by not introducing new risks.

Managing IT infrastructure and security is a behind-the-scenes job where we must continually improve the system without disturbing other services. Here’s what this looks like.

Cognivia’s Approach to IT Infrastructure & Security

At Cognivia, our IT team is responsible for managing a flexible, high-performing and secure IT infrastructure. Ultimately, our secured infrastructure focuses most on protecting our customers’ data. Our IT team also secures our applications, communications and site-to-site communications.

There are three major categories in the organization of our IT: 

1. Internal Infrastructure: All of the hardware (servers, laptops, desktop computers), software and network configurations we need to manage internal communications, customer relationships, etc. 
2. Unik-me platform: How clinical trial sponsors administer questionnaires to patients easily and seamlessly. To protect data collected through unik-me, we create a new instance of the system with a dedicated database for each and every customer. When the study is finished, the data is transferred to our internal storage and is no longer accessible through the SaaS platform.
3. Data storage: How we store data and conduct analysis. To protect this data, we host it on a data center that is only accessible by VPN to selected staff members.

We have four different axes to manage IT security for the above three categories. Here’s what we do under each: 

#1. Hardware & Software

• Implement redundant infrastructure and firewalls
• Develop an annual disaster recovery plan
• Maintain a good hardware and software inventory for quick patch management

#2. Data Protection & Access

• Implement a 3-2-1 backup strategy
• Encrypt data 
• Implement multi-factor authentication 
• Enforce a strong password policy
• Develop a data integrity process

#3. Monitoring & CVE Follow-Up

• Monitor network traffic with tools like Splunk
• Monitor documentation and secure Cognivia platforms with Microsoft Defender

#4. Training 

• Conduct regular training for the IT team
• Sensitize and educate Cognivia employees about IT security and the risks of ransomware, phishing, etc.

Cognivia’s Approach to Regulatory Guidelines

The pharmaceutical industry is one of the most tightly regulated spaces when it comes to technology and data integrity. Cognivia is very conscious of these regulations, including 21 CFR Part 11, Annex 11 and GAMP 5. 

• 21 CFR Part 11: The FDA’s regulation on electronic records and signatures. 
• Eudralex Volume 4 Annex 11: The European equivalent of 21 CFR Part 11, providing a more practical approach to electronic records and signatures. 
• GAMP 5: Provides a framework for validation activities to ensure technologies are fully validated according to 21 CFR Part 11 and Annex 11. 

Here’s how we incorporate these guidelines into everything we do: 

• By following and improving Cognivia’s standard operating procedures.
• By following continuous training courses in security.
• By working with cybersecurity specialists who help and train us.
• By meeting the requirements of internal and external audits.
• By requesting annual penetration, disaster recovery plan and business continuity plan tests.
• By continuously monitoring IT infrastructure.

Conclusion

Previously, we discussed how our Placebell technology adds value without adding burden to study operations or patients. Similarly, it’s important to examine how all this infrastructure is secured to maximize protection for all the data we host.

In practice, we continuously improve our security based on continuous training and education. We also adapt our infrastructure following the comments made by our customers during audits to meet their security requirements. We are well-prepared for these audits and willing to adjust our approach in order to meet your unique requirements. 

With Cognivia, your clinical trial data is secure. Let us know how we can help you with your next trial.