Training Basics - Legal Essentials for Clinical Trial Sites and PIs

Join Principal Attorney Darshan Kulkarni, Pharm.D., M.S., Esq. for a foundational conversation on the essential legal concepts governing clinical research compliance. Drawing on his extensive background in pharmacy, regulatory affairs, and law, Darshan breaks down complex laws like the Anti-Kickback Statute, STARK Law, and the False Claims Act and explains how they intersect when building or running a research program.

This episode clarifies the difference between regulations, guidances, and enforcement, delves into the DOJ's Evaluation of Corporate Compliance Programs, and examines the impact of the DOJ's new Bulk Data Rule on cross-border data sharing, especially with China. Darshan also shares critical, real-world examples of research misconduct (like the Sami Anwar case) and outlines the consequences of non-compliance—from delayed payments and blacklisting to civil penalties and criminal prosecution. Learn the seven elements of a robust compliance program and the key steps investigators must take to protect patient safety and data integrity.

www.kulkarnilawfirm.com

Transcript

Disclaimers

SPEAKER_00 0:02

Hey guys, welcome to the conversation on research compliance basics. My name is Darshan Klakarney. I am principal attorney at the Klakarney Law Firm. I'm really excited to be here because I get to talk to you guys about a variety of basic concepts that need to be considered, specifically the anti-kickback law, STARK Law, False Claims Act. How do they all fit together when you're building a research program? Let's start by some of the obvious ones. Obviously, it does not constitute a legal does not constitute legal advice, does not create an attorney-client relationship. Talking a little bit about myself, just from a pure uh educational standpoint, I have a doctor in pharmacy. Um worked for about 20 years in um various uh pharmacy-related um jobs, everything from um level one trauma centers to retail pharmacy and everything in between. Uh I'm an attorney. Um, and I also have a master's in quality assurance regulatory affairs uh from the Temple School of Pharmacy, which means that I was focusing on areas related to good manufacturing practices, good research practices, uh, good promotional practices, and other related compliance issues. Um bringing all of that together, I'm an attorney, uh, I'm a pharmacist, I do have experience uh in compliance, and I obviously work, um, I also teach at Drexel University as a professor, uh, as an adjunct professor. I taught, uh I've been teaching there since, I want to say plus or minus, 2020. For that, for about 12 years, I taught at the Philadelphia College of Pharmacy in their medical writing program as well. What I do want to start off uh by discussing is where do some of these rules come from? And when we talk about the rules, what is important to recognize is um how they all fit together. Because people throw the term guidances and regulations as if they all mean the same thing. They don't. Um, as we all know, you have the executive branch, that is the president. Um, and and as part of that, the president interprets laws by Congress and they execute those laws. And that can come in one of three specific ways. Uh, one is they will pass regulations. That means that they're going to interpret those laws, they'll have part 15 hearings, and they will come out with official binding regulations that's binding on both the agencies in question and on the um the individuals or the groups that are being regulated. Uh, that might, in this case, mean the pharmaceutical industry. Then there are guidances. Guidances are not the same as regulations. And what do I mean by that? Um, specifically, guidances are um are non-binding, but they are the agency's current thinking of the matter, uh, which means that they are looking at issues like um artificial intelligence right now. There are there's a fair bit of discussion going on right now that, okay, if something is artificial intelligence, why don't we get uh the new rules? Well, the fact is that Congress is still determining what those are, the US Copyright Office is still determining what they are. For the FDA to go out there and start saying, oh, we're here's how we're going to regulate um artificial intelligence, well, that would be hugely problematic uh because they don't know what the moving parts are yet. Remember, if you don't know what the rules are, you cannot enforce those rules. That's the decision that the Supreme Court came out with in Fox v FCC. So it's the FDA um or HHS or OIG's current issue, uh, current thinking on the matter. Then there's an issue of enforcement. So the the way they govern is through the guidances, through the regulations, and then by enforcement, uh, they will come down with deciding what issues are of importance to them at any given time. For example, right now, they have come out and said that clinical research is very important to them. And they came out with that in 2021, you're seeing enforcement still occurring based on some of those issues. The the um the Trump administration has come out and said that they see healthcare. They uh, and this was actually also the Biden administration, to be clear. They both came out and said that healthcare is very important to them, enforcement is very important to them. Um, in the same way, we had the legislative branch, which is um, and and that's not agencies. Um the legislative branch is Congress, they pass the rules that the agencies like HHS, DOJ, FTC, will interpret, and they will pass the laws that that come into play. So again, the legislative branch is Congress, and this is what's interpreted. The executive branch interprets what's given by Congress, um, by the House and the Senate, if you will, and they actually execute on those laws. And then finally, enforcement. We spoke a little bit about enforcement using the regulatory authority given to it by uh the president, but the actual enforcement will be by uh the Supreme Court, um, the federal appellate courts and district courts, and that's enforcement of the laws themselves. Um, and again, you obviously have the state supreme court, you have state appellate courts and district courts. Um, so you'll often get this issue of who is going to come in and who is going to execute and enforce. And it's often not clear because uh agencies have certain abilities to enforce, and then the courts themselves have the ability to enforce as well. Um, what kind of consequence consequences can you expect? Um, and there are a few different ones. One is delayed payment, non-payment, if you're talking contractual, um, penalties. Um, you might be able to terminate a contract, you might not get any more contracts, all of which would be termination. So if you are, for example, negotiating a clinical trial agreement um and you've agreed to adhere to all of these rules, um, you might be facing each of those. You might not get paid for the work you did. Um, you might not, you might be looking at penalties. Uh, the sponsor, uh, the pharmaceutical company in this case might decide to terminate the contract and you may get no new contracts. On the other hand, if you're talking about administrative penalties, which means from the government itself, you may be looking at title and untitled letters. So those are often called things like warning letters, 483, something else. Um, and they sometimes may just be called title and untitled letters. Um, you may also be looking at permanent or temporary exclusions. Those come in a variety of different ways. There's the OIG list, the Office Inspector General, that has its own list of excluded uh persons or entities. There's the FDA debarment list, which are two separate lists. And this applies to people who are involved in research or clinical trials. So if you look at the OIG list, for example, that applies across HHS, which includes the FDA. The FDA list is primarily specific to um to people engaged in research itself. Then there's the OFAC uh specially designated individuals list. This applies to foreign-born um physicians or employees. And then state Medicare fraud units have their own Medicaid exclusion lists as well. And if you are a clinical trial site, you must have a process of checking these lists to ensure that you are not employing or retaining or contracting with physicians who are on any of these lists. Um, I was involved in a situation where there was a physician um who was quote unquote working, but for free. And the argument was well, he is involved in the research. We don't want to be associated with it, but they aren't even working for free, they're not getting any money from us, and that was still a huge issue that we had to face. Then there are civil penalties and criminal prosecution, all of which needs to be considered. It's also important to recognize that there are some other alternatives, other penalties that may be imposed that are not strictly by the book. And what I mean by that is uh the agency can choose to uh uh delay approvals, uh the agency can choose to uh prosecute uh individually. If you get into the bad reviews of the agency, uh individuals do come to find out, and it's often not worth it for sponsors to engage uh in those relationships. Um it may not be official, but I have seen situations where sponsors will effectively blacklist you. Um here are some set uh some relevant laws. There's the False Claims Act, the anti-kickback law, there's STARK, uh each of which we're gonna get into. There's the Civil Monetary Penalties Law, Food, Drugs, and Cosmetics Act, there's the Sunshine Act, there's HIPAA, and then there's state and local laws as well, that all of which need to be considered. Um these are some of the types of prosecutions and some of the issues you might face. Um, so let's start with the Department of Justice. That's the first agency we're going to talk about. They came out with an evaluation of corporate compliance program um that was updated in March 2023. This came from the criminal division of the DOJ, which is kind of important. Um, and they looked at things like compensation incentives and clawbacks and voluntary self-disclosure. What does that really mean? That means that in the case of uh individuals who are violating um the law or are not following compliance measures that you should have in place, um, they want to go after uh compensation of these individuals. They want to claw back money that's been given to these individuals. If you're not following the corporate compliance program, um they also want whistleblowers. Uh, and those whistleblowers can be within the company, which might be a type of self-disclosure. Um, or you can actually have a whistleblower who's now left and now is now complaining about the company. That's where a lot of the penalties uh come from. So you want to be careful when you when you look at these individuals. Um, I spoke a little bit about the criminal division, the evaluation of the corporate compliance program. Um, there are three major questions that you need to answer. Specifically, is the corporation's compliance program well designed? Is the program being applied earnestly and in good faith? I.e., is it appropriately resourced and empowered to function correctly and effectively? Um, and does the corporation's compliance program actually work in practice? The idea of just having a compliance program in place is not enough. You need to actually make sure that it's working, that people are actually using it, and that that it tends to work. Now, it's important to recognize that does it work in practice does not mean that you have no errors, there are no failures. It means that overall there is a program in place and that overall you're catching things. And that's the important part that you're catching things. Um, what else would you be looking at? They want you to be looking at risk assessment, they want you to have uh policies and procedures, they want you to have training and communications, they want to have some kind of confidential reporting structure and investigation. And finally, they are looking at having some kind of third-party management program as well. This is becoming more and more important when you start using things like um decentralized clinical trials, but you are using vendors, so you need to have some kind of third-party management program that that exists. Um, overall, you need to make sure that it's adequately resourced and empowered, like we said, which means that there are autonomous, there's autonomy and there are appropriate resources, and that there is a compensation structure and consequence management, which means that if someone's not following the rules, you don't just ignore it. You actually will enforce. You might be looking at training them, retraining them, or firing them. And in some cases, you might even go back and say you want to claw back on some of the uh terms of the employment agreement, which means that you want to be updating your employment agreements to reflect some of these concerns by the DOJ. The next question to ask is Is does the compliance program actually work in practice? So is there a continuous improvement, periodic testing and review program? Is there an investigation of misconduct? Is there any kind of analysis and remediation of that underlying misconduct? So all of those conversations need to be had. You need to have a quality compliance program in place that's considering, reviewing, and updating each of these. Uh, we then talked about the pilot program regarding compensation incentives and callbacks. So, what does this actually apply to? Um, it directs prosecutors to consider possible fine reductions where companies seek to recoup compensation from culpable individuals and employees and others who had supervisory authority over the employees and knew or were willfully blind to the misconduct. So I didn't know is not a good enough answer. I should have known is important to recognize, and therefore those individuals are held accountable. So, what criteria are you gonna be looking at? Um you might be looking at a prohibition on bonuses for employees who did not satisfy compliance performance requirements. You may be looking at disciplinary measures for employees who violate applicable laws, and that means that did they have supervisory authority over the employees? Did they know of or were willfully blind to that misconduct? And finally, are there incentives for employees who demonstrate full comp full commitment to the compliance process? Um, each of which needs to be considered. Then let's talk about the voluntary self-disclosure policy. And in that context, you want to look at is it voluntary? What kind of timing do they have, and what kind of substance? So let's talk about each one. When we say voluntary, you want we want to ensure that um there's no pre-existing obligation to disclose. So is there like a deferred prosecution agreement? Is there a non-prosecution agreement? Is there a regulation? Is there a contract, any of which requires that voluntary disclosure? If not, the DOJ is going to look at you in a um in a good light, if you will. They want to look at timing. So was there actually an imminent threat of disclosure or government investigation, in which case they're not going to give you um that that good light, if you will. Um, was there a public disclosure or other uh was it otherwise known to the government? Well, and then your timing is not really completely altruistic. Um, how quickly did you disclose? Was there prompt? Um was it prompt right after you discovered the misconduct? Um and the burdens on you as the company to disclose to disclose and demonstrate compliance. Um, and then you want to look at the substances we mentioned, which means that all relevant facts concerning the misconduct that were known to the company are being disclosed. Um, again, you are allowed to say that this is just a preliminary preliminary disclosure uh based on a preliminary uh investigation, but it should be as forthcoming as possible and disclosure of the relevant facts as possible. So, why would you do it? Why would you go out there and put all this information out there? You would do that primarily because um if you do it right, the US Attorney's Office may actually choose not to impose a criminal penalty, and depending on the facts, they decide not to impose a uh and if they do decide to actually impose that uh criminal penalty, it may be 50% below the threshold of the US sentencing guidelines, which is great. Um, at this moment, let's talk about the DOJ's new bulk data rule and why it matters for anyone sharing safety data across borders, including with China. So in January 2025, the DOJ finalized a rule under Executive Order 14117. The executive order restricts or prohibits certain covered data transactions when they would give a country of concern, which includes China, Hong Kong, and Macau, access to Americans' government-related data or bulk-sensitive personal data. This took effect on April 8th, 2025. So, what constitutes bulk-sensitive personal data? The DOJ defines six categories personal health, personal financial, precise geolocation, biometric identifiers, human omic genomic data, and covered identifiers. And then it sets thresholds. So for example, personal health data on more than 10,000 US persons, precise geolocation on over a thousand US devices, biometrics on over a thousand US persons, uh, human genomic data or the like on a thousand US persons. Actually, genomic data is actually a hundred, uh, just general proteomic data, other omic data would be like a thousand people. Practically what this means is that vendors, employments, or investing um, or investment agreements that give China-based counterparty access to data, meeting these thresholds either can happen or it must satisfy CISA-specified security controls. So it's you need a pure data brokerage sale to cover persons who are flatly banned. Remember, there are civil and criminal penalties that may apply. Uh, here's a huge caveat for the life sciences. DOJ created targeted exemptions so essential that FDA regulated activities can continue. Um, the first one is that 202.510 lets you share regulatory approval data that's necessary to obtain or maintain authorization to research or market drugs, biologics, devices, or combinations, even with cover personnel, as long as the data is de-identified or pseudo-anonymized, consistent with FDA standards, and you get to keep required records. So this is going to be important because if you're going to be researching the data, you need to be working with de-identified or pseudo-anonymized data. Then there's 202.511, which exempts data transactions that are ordinarily incident to and part of clinical investigations that are regulated by the FDA. This includes collection and processing of post-marketing surveillance data, including pharmacovigilance, when necessary to support or maintain FD authorization. Again, it needs to be de-identified or pseudo-anonymized consistent with 21 CFR 314.80. So let's explain that. That means you can keep reporting adverse events, but you'll need to keep key coding and de-identifying and having robust controls and robust record keeping if cover persons are involved. So here's the key bottom line safety reporting can continue, but this is an era of routine cross-border access to US bulk health data. And that means that this era is over. So map where your pharmacovigilance data flows, identify any cover persons, hardened contracts and tech controls, document de-identification, and that's how you're going to stay fast and you're going to stay lawful. Then comes the Stark Law. This primarily applies to CROs, sites, and physicians. Technically speaking, it is a series of laws and governs self-referral. Now, what's important to recognize is that in many cases, the Stark Law itself is coming in in the context of um sort of payments when there are Medicaid, Medicare, Medicaid, and the like. However, it's just good practice to have that. We'll cover each of these individually, but specifically, what is actually prohibited? A physician cannot um may not make a referral to the entity that's furnishing the designated health services for which payment may otherwise be made under the title. So essentially, what does that mean? If you are a clinical trial site, you also own the lab, you say I'm going to refer you to the lab, you're double dipping. And that double dipping is something that the um DOJ tends to be wary of, that the that uh the off um that the OIG, the Officer Inspector General, tends to be wary of. It prohibits an entity from presenting a claim to Medicare, to Medicare or to any company, uh, to any person or other entity for designated health services that's provided that's provided under a prohibited referral. So let's look at that again. If you're a physician, you refer to a lab, and that lab then bills Medicare or Medicaid, that might be problematic. So what kind of uh penalty are you looking at? Um again, no Medicare uh payment may be made for these services as a result of a prohibited referral. Um, the entity must timely refund any amounts collected. So, again, if it's a study that's being done completely cash, that may not be a problem. However, if you have, for example, standard of care, in those cases, your study may be in trouble. Um, and again, civil penalties may also apply under some circumstances. Um, what are some possible improper relationships? Referrals, we just discussed those for a second. We also talk about uh we also can talk about space co-sharing. And you see that often where um the the lab, the the physician uh may be a clinical trial site. Part of it's being billed for using a physician is a clinical trial site, part of it's being built for as a separate group under another physician, and that other physician also has co-ownership, and you're not paying a fee, you're paying rent to this other physician. There's that co-ownership, there's that uh rent, um, and and the physician benefits from both relationships, and that's considered to be problematic. Is there co-ownership of the uh principal investigator and the MD office? That becomes a concern. Central labs becomes a concern. Um, how much money is being paid? So that fair market value, the bane of all clinical trial sites, if there's an insufficient assessment of that, that is a problem as well. Now, let's be clear when we talk about insufficient assessment of fair market value, that does not mean that you, as a small startup physician's office, is expected to engage in the same type of deep analysis that they'd expect from a multi-billion dollar pharmaceutical company. They are going to hold you responsible to an appropriate level of assessment. And you'll get a lot of clinical trial sites assert that, oh no, that's too much, that's too onerous. Truth is, this is where it comes from. The penalties are significant. When working with physicians, especially when payments or services are involved, the length of your contract matters more than people think. So under the federal anti-kickback statute 4142 USC 1320A27BB, and it relates to safe harbors, but there's one key protection, which is the personal services and management contract safe harbor. And I can provide citations if necessary. Feel free to reach out. Safe harbor requires that the agreement must be in writing, it must cover all services provided, and it must last for at least one year. So you might ask why this one-year rule. Remember, this is just the federal one. There are state levels as well, state level versions of this as well. So why the one-year rule? Because regulators don't want contracts that are adjusted every few months to reward or influence referrals. A year long term shows that the relationship was planned for legitimate business purposes and not to chase uh prescriptions or to trial uh or like induced trial enrollments. So, what does this mean in practice? It means that if you're paying a physician for consulting, training, speaker programs, protocol development, the contract must be in writing. It must specify services, compensation, and duration. And again, ideally, no less than 12 months. Now you can terminate early if needed, but you cannot replace it with a new agreement covering the same scope during that first year. So um, whether you're working in pharma, devices, clinical research, think long term, document your fair market value, stick to one-year commitments. That's what separates collaborative commitments that are compliant from risky kickback arrangements. Now let's talk about the anti-kickback law. What is prohibited? Specifically, the knowingly and willfully offering or paying remuneration. So it's both offering or paying, it's not the actual act of paying, to induce the referral federal healthcare program business, or soliciting or referring or receiving remuneration. Uh so it's either giving or receiving remuneration in exchange for the referral of a federal healthcare program business, both of which are problematic. So each of them, like I said, it's the offering or paying remuneration or the soliciting or receiving remuneration, both are problematic. So, what are some examples of anti-kickback violations? Working with hospitals and MD offices, again, there's that co-sharing, if you will. Uh in that specific instance, rental space becomes a concern, incentivized programs become a concern, and and what does that actually mean? Every so often you'll see um for a study that is um for a study where you're trying to enroll patients, you'll see incentives. And those incentives can come back to burn you. Specifically, oh, and if you enroll patients to my study, not into some other study, uh, we will give you additional money. Well, that could be seen to be a kickback. It may it can also be seen to be a violation of um certain other rules as well, but uh it may at the very least be a kickback. Um, from pharma companies, if you're doing investigator-initiated research, what kind of money are you giving to the physician to do this quote-unquote investigator-initiated research? Um, payments above fair market value, that can be problematic as well. Um, then let's talk a little bit about the False Claims Act. Again, the OIG can seek a penalty of up to$10,000 for each item of service improperly claimed, uh, plus an assessment of up to three times the amount uh improperly claimed. So people are like, oh, so my worst case scenario is like, I don't know,$200 plus$10,000. Maybe, but times the number of claims, and that can add up into billions of dollars. And it has added up into billions of dollars. So in each kickback case, the OIG may seek a penalty of up to$50,000 for improper actions and damages up to three times the amount of remuneration at issue, uh, regardless of whether the remuneration was for a lawful purpose. So the even if the actual act itself was okay, the kickback may actually make it problematic. So uh the Office Inspector General did put out in 2003 a compliance program which was updated um in, I want to say 2023, in November 2023 or so. Um, here are the seven elements of a compliance program. You want to have written policies, designating a compliance officer, conduct effective training, you need to have effective lines of communication. You want to have uh internal monitoring and auditing, you want to enforce uh standards through well-publicized disciplinary guidelines, and you want to promptly uh respond to detecting problems and and undertaking corrective actions. What's important to recognize is everyone talks about these seven elements of a compliance program. Uh, well, most lawyers do. I I don't see um consultants talk about it as much, but what you do need to do is you need to have your FDA um FDA quality program reconciled with these seven elements of compliance program, which should be reconciled with the DOJ's criminal division's program as well. So there are all these elements that have to come together and work cohesively. In the context of clinical research, why does any of this matter? To quote Arun Rao, who was the Deputy Assistant Attorney General in December 2021, clinical trial fraud is one of four areas of enforcement focused by the consumer protection branch of the USDOJ. He warned against dangerous consequences of research fraud, research misconduct, which serves to undermine confidence in the healthcare industry as a whole. So this is, and I continue to see uh continuing enforcement in this space. So, what is research misconduct? He talked about this research misconduct. What does that actually mean? Fabricate fabrication, falsification, plagiarism. So uh in proposing, performing, or reviewing research, or in reporting research results, and you'll see some of these uh issues come up all the time. So fabrication is making up the data, falsification is manipulating the research materials, equipment, or processes. Um, plagiarism is the appropriation of some other person's ideas, processes, results, or words without giving appropriate credit. Um, obviously, honest errors is not the is not the problem. This becomes even more complicated in a world where you've got AI. So keep that in mind as well. Um, in the context of federal grants, you have multiple other issues that pop up for influence. You're seeing that more and more. Um, misrepresenting data that forms a basis of funding, misrepresenting data that arises from the grants. Um, you want to worry about plagiarism. So, what is plagiarism? Again, is the appropriate uh appropriation of another person's ideas. Uh, data falsification, you're seeing that more and more. So that's right here: manipulating research uh materials and equipment and processes. Um, and then the use of grant funds themselves. So keep all of this in mind. Um, the use of grant funds was something that they were not intended for. I can't tell you the number of times you'll see a grant being requested for ABC. Um, and once that grant comes in, they use it for paym uh catch-up for previous stuff, not for what they promised they'd use the money for. And that comes back to haunt um investigators all the time. Um, this is going back to 2022. Ohio State paid$875,000 to resolve allegations that failed to disclose a professor's foreign government support. Um, you saw this with uh Ming Qing Zhao uh in 2022 as well. Data falsification. This I'd done a screen grab in 2023. You're seeing these 24 and 25 as well. And it's not just it's everything from Yale to um to Rosalind Franklin University, and this is again research misconduct for plagiarism and for uh recklessly intentionally or falsely uh recklessly falsifying or fabricating data. So there are Duke, for example, uh in 2019 paid 112.5 million, um, which continues to be a problem, obviously. Then there's the use of uh use of grants in this specific instance. Uh Parsons improperly invoiced personal expenses uh to a NIH for the NIH funds. Basically, he took this$9,000 in retention bonuses. Uh, he submitted uh false timekeeping records, um, and he used it uh and he violated certifications that it would be only used for research and academic purposes. Obviously, it was not in this specific instance. Uh, instead, he actually used it to pay for uh staff time working on projects unrelated to the NIH grants. So, what are examples of problems and and how do you avoid those problems? Um, so the big issues you see in kickbacks are arguments over fair market value. And despite what a lot of small site owners will tell you, fair market value is a very important issue. Um, now there's an argument to be made, and the Trump administration's made it. Is the overhead cost appropriate? And there might need to be a reassessment of what would be fair market value, because what used to be considered to be part of overhead may need to come into the actual payment structure. But that is an overall discussion. Um, and that does not go to whether you should overpay physicians uh inappropriately. Another type of kickback, inappropriate or excessive grants, uh, which might be a uh payment of get over fair market value, or it could be seating trials. And you'll see these every so often. The goal of the trial is really to just go, well, I want to get these physicians used to prescribing my product. Um in the context of problems, you want to make sure that they fit into a safe harbor. There are, in the case of the anti-kickback law, I think there are like 22 different exceptions. You want to make sure that um these uh any any kind of structure you have fits into one of these exceptions. For example, if you have a physician who's working with you and you are a larger academic institution, what you want to make sure is that that contract is not for less than one year, because that is one of the exemptions in the context of the personal services exception, and that has to be at least one year. Um, and that's just under the federal law. You might have state laws that are slightly different. You need to reconcile both of those. Um, so we spoke about a variety of different laws so far. Um, we talked about the anti-kickback law, we talked about the um Stark law. But talking about all these laws overall, you want to contextualize that. We talked about the um Arun Rao coming out and saying that the DOJ is targeting companies uh and um sites for research fraud. Let's talk about what that could look like. Um, inadequate informed consent form, failure to obtain or document subject consent, inadequate drug accountability, inadequate records, failure to follow the investigational plan, all of which would be considered to be problematic. Um, if you are a clinical investigator, these are the types of issues they were looking at up to 2022. Uh this is currently 2025, as you as you know. Uh, they don't always put out the information. I haven't seen the 2024. 2023 came out, but I haven't had a chance to update this, these slides. But overall, what you'll notice is that 2017, 2018, 2019 were sort of normal. Then 20 2020 and 2021 was COVID. So you are seeing um more remote inspections, uh, which are not reflected here. Uh, and then there was 2022 again. What are the what are the most common inspectional observations? Uh, failure to comply with Form 1572 requirements, failure to follow the investigational plan. One of the big questions you might start asking nowadays is um if you're using AI, do you list the AI as part of the 1572? Um the what kind of inadequate or inaccurate case histories do you have? Um, and that becomes a common problem. Inadequate accountability of the investigational products. I've gone out there, I've inspected um pharmacies, and what you end up seeing is that uh large academic institutions often have problems with their pharmacy control. Um, inadequate subject protection and informed consent issues, all of which are present. Um, sponsor investigator inspections. Uh 2017, 2018, again, you're seeing um this pop up. I'm seeing more and more uh sponsored investigators. And what I mean by that are essentially investigator-initiated research. So uh that's why the numbers are not as big as when you're doing invest uh you're you're seeing like giant spot pharmaceutical companies being the sponsor, so the numbers are much smaller. Um, I expect that number to go up over time. We are seeing the rise of um of citizen research, if you will, but just keep that in mind. Um, common sponsor investigator problems that they see, failure to maintain records, accountability is a major problem, failure to select qualified investigators or monitors, failure to submit an IND, inadequate subject protection or informed consent, and failure to notify the FDA of the termination of an investigator. Um then there they conducted uh regulatory research, uh remote regulatory assessments. Those specific instances they were looking at a variety of programs, whether it's bioavailability, clinical investigators, GLPs, uh, adverse event protection, uh REMs, and they found these types of issues. Um let's go back and identify if you're an investigator, what your responsibility is. An investigator is responsible for ensuring that an investigation is conducted according to the protocol and all applicable regulations. That means protecting the rights, safety, and welfare of the subjects under the investigator's care and controlling the drugs under investigation. So both of these two things need to happen. If you are a small site, this may not be as big an issue. If you are a large academic institution, do you have controls in place to ensure that you are managing and monitoring research appropriately? Um, that's what the 1572 is doing. You're personally certifying to the FDA on Form 1572 that you'll comply with all applicable requirements. You'll personally conduct or directly supervise all aspects of the study, and you will assume responsibility for the health and safety of the participants and the accuracy of the data. So if you are a large, if you are a PI, make sure that you have the controls in place to make all of that happen. Well, what happens if you don't follow these rules? And I'll get this every so often from the physician, because they will say things like, look, I can't do all of this. This is why we have a research team. How can I be held responsible for um for what my research team does? Well, under the regulations, you as the PI are responsible. That does not mean that your research team is not responsible, but it does mean that you are responsible. So let's let's explore some of those. Um, if you look at the Florida Medical Medical Clinic one uh in 2015 to through 2018, they fabricated research data at um AMB Research Center. Um, they enrolled patients even though they those patients failed to meet eligibility criteria. They falsified subject results, they falsified subject medical records, and falsely represented uh that the subjects were taking the drug being studied. Uh, in this specific instance, Montalvo and Garmendia were co-owners of AMB, um, where one was a lead coordinator and the other one was uh served as a study coordinator. Portella was a pharmacy technician, then they were all charged. So this is from 2022. Um, then let's talk a little bit about the Sami Anwar case. Now, Sami Anwar was not a licensed medical doctor, he used the names of medical doctors who were PIs in name only, and you'll see this every so often, where uh you'll get an individual saying that, oh, I am a uh medical doctor. Uh turns out they are not qualified, and that becomes a huge problem. Um, he falsified uh and forged their signatures in the 1572, and the doctors he used as PIs didn't even know about the studies. I was recently involved in a situation where the PI did not know about the study. In other situations, they were vaguely aware that studies were taking place, but they thought that the studies were only attempting to secure the patients at that time, the subjects at that time. Um, however, on war, and I was actually very recently involved in a situation like this where the PI didn't even know that certain um steps were being taken, certain screening visits were being taken, and that's problematic. Luckily, no subjects were enrolled in that specific instance. Um, however, it is important as the PI to maintain the oversight as often as you can. Anwar filled the study with subjects without regard to the eligibility and whether or not they had the requisite medical condition being studied. He also posed as the PI on the phone and sent uh sent emails from the PI's email accounts. He required his staff to come with him to research-related uh concerns and forbade them from contacting or speaking to his PIs unless he was present. By Anwar's design, research subjects had no interaction with the PI that was allegedly treating them uh and supposedly conducting the research. When the CRO monitors came to the PI, they they were in it, they were invariably told that he was that they were unavailable, that the PIs were unavailable because they were seeing patients. In the end, uh the CROs and sponsors had grave concerns about the site's efforts. And because the FDA regulations placed responsibility in the PI, the concerns were expressed to the PI that on paper that were actually responsible on paper. Um, some sponsors took action to block uh Unwar's PIs from any further study with their sponsor. At one point, the FDA placed Unwar's company and one of his supposed PIs on his public warning list. And when they found when they found this happen, Unwar went and found another puppet PI whose license he could use by targeting a doctor whose family practice was financially underwater. And that was problematic. He then created a new company and thus the warning letter was thwarted, allowing the fraud to continue. Um, so this is hugely problematic. And again, I'm seeing this still happen. Um, what is informed consent? Again, informed consent is more than just the documents, more than just the signature that's on there. It has to be a continuing process that begins before research is conducted and continues until the research study ends. What is the goal? The goal is that the prospective subject has a legal right to be fully informed of the risks and the benefits and the harm to the study medication. A prospective subject must have the opportunity to have questions or concerns addressed by the medical professional. Minors must have parents participate in the informed consent process. And during the course of the study, a subject may withdraw consent at any time. So, again, why don't you want to be like Sammy? Um, in his case, Unwar did not allow the PS to actually participate in the informed consent process. He did not let his uh staff take the time to sit down with these prospective subjects. Um, in fact, he he had study coordinators who were not knowledgeable about the study and had no research background, simply asked the potential subjects to land up signing the paperwork. If the prospective subjects had any concerns or they refused to sign the paperwork, they would fetch quote-unquote Dr. Anwar, who was not only who was not actually a licensed medical doctor, and he would pose uh as one with the ability to sign. Um, and then sponsors and the IRB could not meet directly with the subjects due to privacy laws, and therefore they were sort of kept away. Um, but they could compare the signatures. Um, and even though they were not they were not handwriting experts, they had no way to verify whether or not any meaningful informed consent actually took place. That's what triggered concerns. Um again, uh PIs are required to personally conduct and supervise the studies, they're not expected to conduct the research alone. So we recognize this. Um, the rules contemplated that other individuals like study coordinators will be involved. Um, PIs are required to certify um in the Form 1572 that they will ensure that any associates, colleagues, and employees are adequately trained and informed. Uh, in the in the case of uh SAMI, don't you don't want to be like SAMI, um these PIs were PIs in name only. They were not sufficiently trained, they were not sufficiently informed, they were only used for the medical licenses. And Unwar, rather than the PI, um taught the coordinators how to conduct the study. They uh UNWAR made all the decisions, he supervised them, and by hiring study coordinators with no research or professional background, often from just minimum wage, food service, or retail jobs, kept costs low, and he ensured that the that his word regarding the studies would go unquestioned. It took months for a new study coordinator to learn enough about the studies to know that they were actually committing fraud. Um, then there's the adverse event reporting. Um, what are adverse events? Adverse events were documented. Um they're basically what some people call side effects. Um, but if they're serious adverse events, obviously they have to be reported immediately to the sponsor or the IRB. Um why would someone choose not to report adverse events? Again, reporting adverse events and protocol deviations can cause trials to be suspended, they can cause patients to be discontinued. In the case of SAMI, that would mean loss of revenue. Um, and again, it would also probably mean increased research scrutiny and review of research. Um, since um since SAMI was basically a PI and everything, but name, um, SAMI was functionally in control of all reporting. He'd direct his staff not to report adverse events and protocol deviations, even if they were significant. There was one patient who actually had liver cirrhosis. That means their liver was not functioning well. Um, he experienced highs in the study medication. He directed his employees not to report this in an Alzheimer's study uh because uh because the patient actually experienced a violent episode where he attacked his spouse. Anwar instead directed his employees not to report that either. When the same subject passed away from kidney failure while enrolled in multiple simultaneous studies, which is usually a no-no, he directed his employees not to report that either. Then he actually had a participant attempt suicide during a study, um, even though that product was known to cause suicidal ideations. And again, Anwar told his employees not to report that. In retrospect, study sponsors and CRS frequently identify the lack of adverse events as being a red flag, but during these studies, they were unable to find that. And this was his way, this was Anwar's way of keeping that money, money keeping on flowing. That was problematic. Uh, another big question is the inclusion and exclusion criteria. Um, the goal of inclusion and exclusion criteria is to ensure that study participants have the appropriate disease conditions and other factors being studied. Um, you do not want to have a situation where other conditions or circumstances that could skew the data or jeopardize the patient's health is in play. It's not sufficient to simply check a box saying that the subject meets these inclusion-exclusion criteria. What you are required to do as a research site is you want to obtain medical records, you want to obtain other documentation, and you want to ensure inclusion in the study is pursuant to the criteria in the protocol. So why not do it? Well, the fact is that if you use the inclusion-exclusion criteria, um, you may not get paid because sponsors only pay on a per-subject basis. So if you are trying, like Sammy was, to make sure that as many patients as possible were enrolled, well, exclusion criteria would prevent that. So, what did uh Mr. Anwar do? Uh, he directed his staff to ignore these inclusion-exclusion criteria. He admitted as many subjects as possible into the study with that regard to whether they qualified. Um, in one case, there was um an exclusion criteria that's very, very um one of the typical exclusion criteria is that you shouldn't be enrolled in other studies at the same time. He would ignore that. Um, there was one situation where subject did not have the requisite disease state or other inclusion criteria. That subject was still in the study. So I don't know what how you can have a subject who doesn't have the disease state be in a study about the disease state. And then there's the creation and alteration of fraudulent medical documentation to support the patient's inclusion in the study. So we talked about falsification and fraud. This is an example of that. Um, then there's drug accountability. So what you're required to do, and we saw that in some of the issues that the FDA said continues to be a problem, you are required to maintain drug accountability. Uh PIs must maintain and document control of the investigational products and make sure it's only given under the PI's direct supervision, the PI being the principal investigator. CROs must routinely audit drug accountability and verify on site that the number of empty vials or blister packs matches the exact number of doses reflected in the um the um in the system. Um so that so that would be a way of making sure that you know what, I gave you 10 pills, it's 10 days after you're taking the one pill a day, you should be out of 10 pills. What's going on? Um, so what would Sammy do? Uh most of the subjects in on our studies did not have the disease state being studied, or was not, or were not legitimately participating in the study. They were frequently not taking the investigational drugs at all. So he would throw away the drugs, he'd pour them down the drain, he'd falsely certify that they that the drugs had been dispensed, dispensed, he'd save the empty container to show the CROs for drug accountability. Um, there was a situation where you had controlled substances. This was buprenorphine. Um at Sami Unwar's direction, it was simply deposited down the drain, and the participants were given a daily regimen of hydrocodone, which is again a controlled substance, to take as needed when the study medication wore off. Um over time, they'd need less and less hydrocodone than those receiving placebo. Umwar directed that the hydrocodone uh pills be removed from the bottles and hoarded in large resealable bags, which were placed in an attic area. Uh, and then he'd showed the empty bottle. So again, committing fraud the whole time. Um, when the search warrant was executed at Sami's business, they found thousands of hydrocodon pills in large resealable containers in the attic and thousands and hundreds of uh hydrocodon pills in a bag in Anwar's desk. Obviously, a continuing problem. Um, we spoke uh another one is obviously record retention, patient integrity, and data integrity. The goal is that you must maintain an appropriate documentation on records, showing that the research is being appropriately conducted. Uh, CROs routinely compare on-site records to the data entered into the electronic data capture system uh to ensure that the study data is accurate, supported, and can be relied on. It's part of the on-site documentation. Some study protocols also require patients to complete their own diaries, journals, or other documentation as necessary. These data points were entered into the EDC as well. Uh, and this is all good things. So, what did SAMI actually do? He would fabricate data, he would forge the PI's signature, he'd direct that the same data and points, um same data points be entered into the EDC so that they could match. Uh, if blood testing was required, he'd pass off subjects' data uh with the blood of unwitting patients and and unwitting employees. Uh, with regard to patient diaries and the opioid back study, there's so there was a there was a say case where opioids were being used, um, patients were required to complete this this weekly journal. Now, if you actually had patients who were not actually enrolled, umwar would actually forge their signatures as well. He'd forge these diaries and he'd hold the uh hold a pen in a different hand and he'd try to fill them out. And obviously that was problematic as well. And when patients were not legitimately participating in the study, he directed that his staff fabricate data and documentation to make it appear as if they were actually taking part in the study as well. So, all of which is hugely problematic. Um, now another one is the issue of um whistleblowing and retaliation. So, what you have is a situation that in the case of um whistleblowing, in addition to being able to report misconduct or fraud to a sponsor or to an IRB, one critical safeguard is that there is a reporting hotline through which concerns can be anonymously anonymously communicated by the phone or email to the FDA's Office of Scientific Investigators. Investigations. If an employee is concerned that a sponsor or CR is reluctant to take action regarding misconduct, that employee can report concerns directly to the FDA or the IRB. So what would what would SAMI do? Uh Unwar would correctly surmise that his greatest risk was one of his employees would turn him turn him in. And this was exactly how it happened, actually. A courageous whistleblower who could not stop the thought that fraudulent studies were hurting patients actually brought him down. During Unwar's trial, dozens of his former employees, including PIs, expressed concerns that they were involved in research fraud at Anwar's direction. Many of these employees also testified that Anwar engaged in concerted harassment, intimidation, and retaliation to prevent them from notifying people. So here are some examples of what he did. Um, he electronically surveilled his employees by installing cameras and recorders everywhere in the facility and told these people that they were being watched and discouraged them from openly communicating. He regularly surveilled their work emails for some of his key employees and phone communications. He regularly threatened his employees that he would lose, use his connections to ensure that they never worked in the clinical research world. Um auditors showed up, he took steps to ensure that they did not have access to the employees that he doubted were sufficiently loyal or that he considered to be bad liars. When employees left or Anwar was concerned that they would leave, um, he'd report them. Uh he'd take he'd take steps to discredit them by making false complaints that they harassed employees or patients. Uh he filed false reports with local police. He stalked one employee, he threatened another employee. Um, and uh one employee who he found uh disloyal found her car tires mysteriously slashed. One employee who he correctly surmised to be a whistleblower found herself framed for theft and reported to the cops, which was obviously problematic. So um so in March 2025, there were other cases that we can even talk about. For example, the owners of ANR pled guilty to conspiracy to commit wire fraud, they admitted falsifying eligibility, case histories, spirometry, uh echocardiograms, uh, all data in um on another type of data in asthma drug trials, and providing that fraudulent data to the sponsor and to the to the FDA. The PI pled guilty to making false statements to an FDA investigator. This demonstrates that site misconduct can trigger both uh administrative penalties and criminal penalties. Then you can talk about the 2023 case of AMB Research Center in Miami. It's always Florida, right? It always feels like it's Florida. Uh the last case, the AR research case, was in Weston. Uh, this AMB case is in Miami. Um in that case, it was a clinic owner, uh, it was a clinic owner and a pharmacy technician. They were sentenced for conducting a clinical trial fraud scheme again. They used names of family and friends as subjects who never actually participated. They fabricated enrollment data and submitted invoices totaling about$278,000 from a sponsor. This highlights how even modest dollar amounts can lead to prison sentences when data integrity is undermined. Then let's take another case. Again, Florida. This was Moffitt. Uh, in that Moffitt agreed to pay about$19.56 million to resolve civil liability under the False Claims Act, that they were billing Medicare and Medicaid for patient care items and services provided during research studies that should have been billed to the trial sponsor. So make sure that you are looking at who should be billed appropriately. Again, the case emphasized the overlap between research billing, federal health care programs, and clinical trial misconduct. The key takeaway is that the FDA is going to step in when clinical research involves regulated products and obligations like good clinical practices. Human subject protection and data integrity must always be considered. Again, the key thing is non-compliance risks include rejected data, disqualification of sites, investigators, and reputational harm. And what you don't want to do is land up in a situation where administrative penalties are being escalated to actual criminal penalties. As we continue, what we are seeing is a situation where this type of this type of situation is ripe for AI to come in. There is hope, but it will become problematic. The big thing that you have to consider is that AI is now cutting costs. They are going to be used in things like protocol development, uh, study startup, trial performance co-pilots. This is coming from McKinsey, by the way. Uh, study management, patient trial companions, and more, as you can tell on this screen. Um, the question is, how are you going to use it at your site? How are you going to ensure that if you're a sponsor, you're using these tools to address compliance, to address issues with data falsification, all of which can be checked using AI. So you want to have the appropriate controls in place. I have a whole presentation on AI and clinical research. I just gave that a couple of days ago. Um, but feel free to reach out and I'm happy to talk through it with you. Uh again, my name is Darshan Klakarney. Um, I'm I am uh attorney at the Klakarney law firm. Um you can check out my podcast as well where I talk about life sciences issues. Again, this was not legal advice, it does not create an attorney-client relationship. But if you continue to have questions or problems, feel free to reach out. Thank you so much for participating in this talk.