The Cybersecurity Blind Spot in Decentralized Clinical Trials

When a sponsor adds decentralized elements to a study, the cybersecurity conversation almost always runs in one direction. More endpoints. More home networks. More devices nobody enrolled in mobile device management. That conversation is worth having, but it covers half the attack surface. A trial running across fifteen states does not just distribute its data. It distributes its people, and the systems that govern those people sit outside the security team’s field of view.

Both footprints expand together, on the same map, at the same time. Most organizations instrument only the first one. The gap between them is where identity governance quietly fails.

What actually moves when a trial decentralizes

The FDA finalized its recommendations for conducting clinical trials with decentralized elements in September 2024, describing trial activities that happen somewhere other than a traditional site: telehealth visits with trial personnel, in-home visits, and appointments with local healthcare providers. The agency was direct about one thing. Regulatory requirements are identical whether or not a trial includes decentralized elements. Nothing gets relaxed because a visit happened in a participant’s kitchen.

The guidance also asks that study records indicate when a visit was conducted by telehealth, including the date and the name of the person who conducted it. That detail is easy to skim past, and security teams shouldn’t. It means the identity of every remote worker who interacted with a participant becomes part of the regulatory record, not just an HR fact sitting in a payroll system.

None of this would be practical without infrastructure that has already matured elsewhere in healthcare. Telehealth and patient-facing digital tools moved from pandemic stopgap to standing capability, which is what let trial sponsors treat remote visits as a design choice rather than an emergency measure.

The data attack surface widens while the compliance bar stays put

Wherever a visit happens, the data lands in the same structure. Protocol-driven electronic case report forms define which fields exist, which validation rules fire, and which values trigger a query, because every field traces back to a specific objective in the study protocol. A home visit and a site visit produce the same standardized record, run through the same edit checks, and write to the same audit trail. Decentralization changes the collection point. It does not loosen the form.

AI is compressing that build phase hard. Platforms now generate protocol-aligned forms from a draft document, turning configuration work that used to take roughly a month into a job measured in days. The clinical benefit is obvious. The security consequence is less discussed: when a startup collapses from thirty days to two, the access provisioning that used to happen inside a long setup window now happens all at once, often before anyone has defined role scopes or run a review. Governance built around slow timelines does not survive fast ones.

That structure is also what makes remote monitoring workable. Sponsors and data managers review entries as they arrive, raise queries inside the platform, and resolve discrepancies without waiting for a monitor to sit at a site. The tradeoff is that oversight now depends entirely on the platform being available, accurate, and correctly permissioned. When monitoring was physical, a system outage was an inconvenience. When it is remote, an outage is a gap in oversight that has to be explained later.

What does change is the path the data travels before it gets there. Trial personnel work from home offices, cars, and participants’ living rooms, on connections that nobody in IT provisioned. Tablets sit in bags overnight. Personal hotspots fill coverage gaps. The controls that used to be a property of the building now have to be a property of the device and the session.

For sponsors and sites handling protected health information, that shift raises the documentation burden as much as the technical one. Regulators expect evidence of HIPAA safeguards, not assurances that safeguards exist, and that evidence now has to account for equipment your team may never physically handle. Proving encryption at rest on a laptop in another state is a different exercise than proving it on a machine in your own server room.

The identity system of record moves outside the perimeter

A trial with mobile nurses in twelve states is an employer in twelve states, and that fragments along lines security teams rarely watch. Payroll tax registration, unemployment insurance accounts, state leave mandates, and workers’ compensation classification all split apart at exactly the moment the data footprint does.

Workers’ compensation is the sharpest example. A phlebotomist driving between participants’ homes carries a different risk profile than a coordinator at a desk; classification rules differ by state, and premium exposure follows the classification. Get it wrong in one jurisdiction, and you find out during an audit.

Small sponsors and site networks rarely build that capability internally, and most don’t try. They rely on co-employment and employer of record arrangements, where an outside organization becomes the employer of record, files payroll taxes under its own employer identification number, and carries workers’ compensation coverage while the sponsor keeps full operational control of the team. NAPEO estimates that 14% of US employers with 20 to 499 employees already work this way, which covers most of the sponsor and site organizations running decentralized studies.

That arrangement solves a real multi-state problem, and it creates a third-party risk question that belongs on the security team’s list rather than finance’s. The authoritative record of who works here now lives in an external platform, alongside Social Security numbers, bank routing details, and benefits enrollment for the entire workforce. By any standard vendor risk taxonomy, that is a tier one custodian of workforce data. It is almost never assessed like one, because it arrived through an HR procurement path that never crossed a security review.

Where the two footprints collide

The first collision is deprovisioning. Joiner, mover, and leaver processes assume the identity source of truth is something IT controls. When it is an external HR platform, the trigger that revokes a departing coordinator’s access to the trial data system lives somewhere your team may not administer and may not receive alerts from. Termination gets processed correctly for payroll purposes on a Friday, and the trial database account stays live until someone notices.

In most enterprise contexts, that is an access control failure. In a clinical trial, it is also a data integrity failure. Every entry is attributed to a named user with a timestamp, so an account that outlives its owner produces records signed by someone who left in March. That is the kind of finding inspectors write up, and it is not fixable after the fact.

Device custody has the same shape. A field nurse in another state holds a tablet and possibly a printed visit schedule with participant initials on it. Recovering that equipment is an HR and logistics task that runs through whoever manages the employment relationship, but the risk it creates is entirely the sponsor’s. Offboarding checklists written for office staff rarely include a shipping label, and unreturned equipment tends to become a quiet standing exposure rather than a tracked one.

The second collision is jurisdictional, and it runs in the opposite direction from what most people assume. The IAPP counts twenty comprehensive state privacy laws now in effect, and most of them carve out data collected under the Common Rule or already regulated by HIPAA. Employee data usually gets no such exemption, and California covers it outright. So a sponsor can easily end up in a state where the trial data is exempt, and the workforce data is not.

State telehealth licensure and practice standards add a third layer. They still vary meaningfully, which means applying one protocol uniformly across state lines takes deliberate effort rather than assumption. The clinical team knows this. The security team often doesn’t hear about it until a visit modality changes mid-study.

Bring both footprints under one risk register

The fix isn’t complicated, but it does require someone to own both halves. Build one list of states where the study operates, then run both questions against it: what data obligations attach here, and what employment obligations attach here. Those lists overlap more than most risk registers admit, and the gaps between them are where incidents start.

Ask the trial data platform and the employment partner the same diligence questions. Both hold regulated records. Both need defined breach notification timelines written into the contract rather than negotiated during an incident. Both should be able to explain their access review cadence without a follow-up call.

Then tie account provisioning and deprovisioning to HR events with an actual integration or, failing that, a documented weekly reconciliation between the employment record and the trial system user list. A spreadsheet checked every Monday beats an elegant automation that nobody built. The point is that the two systems have to talk, because the regulator, the auditor, and eventually the attacker will treat them as one organization, regardless of who administers what.