ISO/IEC 27001: Protecting Blinding, Data Integrity and Chain of Custody in Imaging Trials

ISO/IEC 27001 Requirements

ISO/IEC 27001 is the international standard for information security management. It requires an organization to identify the information it holds, to assess the risks to its confidentiality, integrity and availability, to address those risks with selected controls, and to confirm through monitoring, internal audit and management review that the controls work. The standard provides a reference list of controls in four groups, each of which has a direct application in an imaging core lab:

• Organizational: policies, roles, inventory and classification of information, access rules and access rights, supplier and cloud service security, incident management, legal and contractual compliance, and protection of records and personal information.
• People: screening, terms of employment, awareness and training, confidentiality agreements, and remote working, all of which apply to employees and to the physician readers a core lab engages.
• Physical: secure areas, controlled entry, protection of equipment and storage media, and secure disposal.
• Technological: endpoint devices, privileged access, restricted access to information, secure authentication, malware protection, vulnerability and configuration management, deletion and masking of data, prevention of data leakage, backup and redundancy, logging and monitoring, synchronized clocks, cryptography, secure development, and change management.

The standard does not dictate which controls an organization must use. It requires the selection to follow from a documented risk assessment, every control on the list to be either applied or excluded with a stated reason, and the result to be audited. This is why certification carries weight: the auditor checks not only that a control exists but that it fits the risk and is operating.

Why It's Relevant to an Imaging Core Lab

Regulators ask three questions of an imaging endpoint: whether the read was blinded, whether every result can be traced to its source and to the person who produced it, and whether the data have been changed since. Each is an information security question. Blinding is access control, traceability is identification and logging, and freedom from alteration is integrity protection, audit trail and change control, which is also what 21 CFR Part 11 requires of electronic records. ISO/IEC 27001 is the framework under which an imaging core lab designs, implements and independently verifies these properties. Intrinsic Imaging's Quality Management page describes the result as end-to-end controls over access, transmission, encryption and audit logging that keep DICOM data, reads and trial endpoints secure and aligned with 21 CFR Part 11.

Where the Standard Resolves Real Imaging Problems

Blinding That Depends on Good Behavior

In a poorly designed reading system, a reader could see the order of time points, another reader's assessment, the site's local report, or metadata that reveals the treatment arm. ISO/IEC 27001 requires the imaging core lab to govern access to information through written rules based on its requirements, to grant and review access rights against those rules, and to restrict access accordingly. In Intrinsic Imaging's reading environment, these controls enforce blinding technically: each reader role sees only the images, time points and forms the read design allows, adjudicators see the discordant reads and nothing more, and project staff who communicate with sites have no access to the reading queue. Blinding no longer depends on a reader's discretion but becomes a property of the system that an auditor can test.

An Audit Trail That Would Not Withstand an Inspection

An inspector asks who entered a measurement, when it was changed, by whom and why, and whether the clock on the reading system can be trusted. The standard requires the imaging core lab to log activities, exceptions and other relevant events, to protect the logs from alteration and review them, to monitor its systems for unusual behavior, and to synchronize its clocks to an approved time source. Intrinsic Imaging's reading platform therefore records every assessment, change and sign-off with an authenticated user and a synchronized timestamp, and the log cannot be altered, including by administrators. The record meets the audit trail requirements of 21 CFR Part 11 because the controls that produce it were designed to.

Two Sponsors With Competing Programs in the Same Core Lab

Sponsors developing competing therapies in the same indication often use the same imaging core lab, and each needs assurance that its images, reads and results cannot be seen by anyone working on the other's study. ISO/IEC 27001 requires the core lab to classify and label its information, to restrict access according to that classification, and to segregate networks and systems as its requirements dictate. At Intrinsic Imaging's core lab, study data are separated logically, access is granted per study and per role, and a review of access rights shows exactly who could see what.

What Certification Means for a Sponsor

A sponsor that entrusts blinded images and an endpoint to an imaging core lab is relying on controls it cannot inspect from outside. Intrinsic Imaging's ISO/IEC 27001 certification means that an accredited body has verified that the core lab has assessed the risks to the confidentiality, integrity and availability of every sponsor's data, has selected and justified its controls against the full reference list, and operates them, including blinding enforced by access control, an audit trail that meets 21 CFR Part 11, encrypted transfer, de-identification at intake, separation between sponsors, managed incident response, controlled change, and a controlled cloud supplier. The endpoint the sponsor receives can be shown to be blinded, traceable and unaltered, which is what a regulator will ask.