Why Data Access Is Part of the Design
A sample size re-estimation rule is not defined only by a formula. It also depends on which people can see which data, which outputs they can receive, and who is allowed to act on them. A trial may intend to estimate a nuisance quantity using pooled, treatment-masked data. If an analyst or decision-maker can also see arm-specific outcomes, however, the process is no longer operationally blinded, even if treatment labels are replaced with codes.
This matters because treatment knowledge can affect more than the sample size. It can influence recruitment, clinical management, decisions to stop or continue, and how trial staff interpret accumulating results. A firewall is therefore a prespecified arrangement of people, permissions, data flows, and communications—not merely a promise to keep a result confidential.
Masking labels alone is not sufficient. If an analyst sees “Group A” and “Group B,” the treatment names may be hidden, but the analyst can still compare outcomes by group. Conversely, pooled information can sometimes reveal more than intended if it is accompanied by other reports, small subgroups, or knowledge of particular participants’ assignments. The relevant question is not only whether treatment names are visible; it is whether the data and outputs allow a treatment contrast to be inferred.
Assign Access Before the Interim Review
A sound operational plan starts by mapping each task to the minimum information it requires. For a blinded re-estimation, a statistician may need pooled outcome data and the inputs specified by the protocol, but not arm-specific summaries. A trial statistician preparing routine blinded reports may need treatment-masked data, while the sponsor’s clinical team may need only the resulting sample size recommendation. The person who implements a permitted sample size change does not necessarily need to know the interim arm means.
An independent unblinded statistician may be needed if the protocol calls for a decision based on arm-specific information. That role should be separated from staff responsible for recruitment, treatment delivery, endpoint assessment, and the final primary analysis. Assigning that statistician to a committee or procedure that can communicate only an authorized decision—not interim treatment estimates—can protect the blind of the wider team. The exact arrangement depends on the protocol and trial governance; the important requirement is to specify it before interim results are available.
State in the protocol which interim data and nuisance estimates enter the re-estimation rule, what decisions the rule can make, and any limits on the new sample size.
Name who prepares the data, who runs or verifies the calculation, who receives the recommendation, and who implements an allowed change. Restrict each role to the information it needs.
Specify the permitted report format, recipients, storage location, and communication route. Do not distribute arm-level results simply because they have been relabelled or described as confidential.
Record access, data transfers, code versions, calculation results, approvals, and any deviations. Confirm that the implemented decision follows the prespecified rule.
Worked Example: Assigning Roles for a Blinded Review
Suppose a hypothetical two-arm trial plans to review pooled interim outcomes and increase its recruitment target if a prespecified nuisance estimate exceeds a threshold. Treatment labels must remain concealed from the trial team. Consider four roles: a data manager, an independent statistician, the trial steering group, and the recruitment lead.
The data manager prepares the interim data using the protocol’s specified population and data-cleaning rules. The data manager may access the trial database, but should not add arm-level summaries to the report unless the re-estimation plan explicitly requires them.
The independent statistician receives the treatment-masked data needed for the pooled calculation, applies the prespecified rule, and checks the result. Under this blinded plan, the statistician does not need treatment-specific means to decide whether the threshold has been crossed.
The steering group receives only the authorized recommendation, such as “retain the current target” or “increase the target to 240.” It does not receive treatment-specific outcome summaries. The recruitment lead is told the approved target and implementation date, not the interim nuisance estimate or any arm-level result.
This allocation separates calculation, authorization, and implementation. It does not prove that disclosure is impossible: the statistician may still infer information from other available data, and staff may exchange information outside the planned route. That is why access controls, report review, and documented communication procedures are part of the design.
How Summaries Can Reveal a Contrast
A firewall can fail through a sequence of individually plausible reports. For example, a pooled total may appear harmless when provided alone. If an additional report reveals one subgroup’s total and the subgroup’s size, subtraction gives the complementary subgroup’s total. If those subgroups correspond to the treatment arms—or can be mapped to them—the arm-specific summaries can be reconstructed.
Worked Example: Reconstructing Arm Means From Separate Reports
In a hypothetical interim review, there are 24 participants with a fully observed continuous outcome. A pooled operations report gives a total outcome sum of 184. A second report gives a sum of 96 for a subgroup of 12 participants. Suppose the subgroup can be identified as treatment A, and the remaining 12 participants are treatment B.
The sum for treatment B is obtained by subtraction:
The arm means are therefore:
The observed difference in means is \(8-7.333=0.667\) outcome units, with the direction defined as treatment A minus treatment B. The original pooled report did not show arm means, but the combined reports revealed them. This is a disclosure risk whether the subgroup report was created deliberately or provided for another operational purpose.
A safeguard is to review reports together, not one at a time. The data-flow plan should identify combinations of totals, subgroup counts, site reports, time-period summaries, and other information that could isolate an arm or a small set of participants. Suppressing a label is not enough if the group can be inferred from the context.
Applying a Blinded Rule Without Expanding Access
A blinded decision should be tied to a written rule that identifies the interim quantity, calculation method, timing, and permitted action. The decision-maker should receive only what is needed to apply that rule. For instance, a protocol can specify that a blinded pooled estimate above a threshold triggers a fixed target increase, while a value at or below the threshold leaves the target unchanged. The threshold and allowable targets must be fixed in advance; they should not be selected after inspecting interim results.
Worked Example: Applying a Prespecified Pooled-Estimate Rule
Consider a hypothetical continuous-outcome trial with a prespecified blinded rule: if the pooled interim standard deviation exceeds 12 outcome units, increase the total recruitment target from 200 to 240; otherwise retain 200. The independent blinded statistician reports a pooled standard deviation of 12.4 units, without arm-specific means.
The comparison is:
The condition is met, so the rule gives a revised target of 240 participants. This decision follows from the specified nuisance estimate and threshold; it does not require the steering group or recruitment lead to see an interim treatment difference. The calculation is valid as an operational example only because the rule, threshold, and permitted target were defined before the interim result was examined.
The statistician should retain the calculation record and communicate the authorized target through the specified route. If the rule’s input is unavailable, inconsistent with the protocol, or produced using an unapproved analysis, the team should follow the prespecified contingency process rather than improvise a new threshold or request extra arm-level summaries.
Blinded and Unblinded Firewalls Compared
A blinded pooled re-estimation and a segregated unblinded review are different operating strategies. Neither removes the need for prespecification and oversight. The first limits access to pooled information and can preserve a broad operational blind; the second deliberately allows a small authorized group to inspect arm-specific information while separating it from the trial team.
| Feature | Blinded pooled re-estimation | Segregated unblinded review |
|---|---|---|
| Information available to the re-estimation analyst | Pooled, treatment-masked inputs specified by the rule | Arm-specific interim information, if required by the rule |
| Main operational protection | Limit data and outputs so no arm comparison is available to decision-makers | Confine arm-specific access to independent, authorized personnel |
| Key vulnerability | Pooling, subgroup reports, or external knowledge may still permit inference | Information can leak or influence the conduct of staff who should remain blinded |
| Communication to the wider team | Usually a permitted target or action, rather than interim arm summaries | Only the authorized decision or implementation instruction, unless governance specifies otherwise |
A blinded plan is not automatically safe just because the data are pooled: treatment effects, known allocations, and auxiliary information can make pooled information informative about arm differences. An unblinded plan is not automatically invalid just because an independent analyst sees arm-level data: its operational acceptability depends on the prespecified procedure, separation of roles, controlled communication, and appropriate trial oversight. In either case, the re-estimation process must not become an informal opportunity to examine treatment effects beyond the authorized decision.
Diagnostics, Failure Modes, and Limitations
Before the interim review, test the information flow as if you were trying to infer the hidden contrast. Review every planned output and ask whether its combination with earlier or routine reports could identify arm-level outcomes. Check who can access the randomization code, treatment-masked data, analysis code, interim reports, and meeting materials. Confirm that file permissions and automated report templates match the written plan.
- Code names mistaken for blinding. “A” and “B” are not protective if the analyst can compare the groups or infer which code represents which treatment.
- Uncontrolled secondary reports. Site, subgroup, time-period, or cumulative summaries can enable reconstruction when combined with pooled totals or participant counts.
- Decision-makers receive too much. A steering group may need to authorize an action without receiving the interim treatment-specific evidence behind it.
- Unrecorded access or communication. Shared folders, meeting slides, email attachments, and informal discussions can bypass intended role separation.
- Rule changes after viewing results. Changing the threshold, calculation, or permitted action in response to an observed interim value undermines the prespecified decision process.
A firewall reduces the opportunity for disclosure; it cannot guarantee that no person can infer anything about treatment differences. Pooled data may carry indirect information, and contextual knowledge may be informative. In addition, a process that is operationally blinded may still require a careful statistical justification for its design. Access control cannot substitute for that justification, and it does not cure a misspecified or incorrectly implemented re-estimation rule.
Check Your Understanding
Answer each question, then check the brief solutions below.
- A blinded analyst receives group-specific means labelled only “A” and “B.” Is the review operationally blinded? Explain.
- A report gives a combined outcome sum of 300 and a treatment A sum of 158. If each arm has 20 participants, calculate treatment B’s sum and both means.
- Why might a recruitment lead receive a revised sample size target but not the interim pooled estimate?
- Name two ways that separate reports could jointly reveal arm-specific outcomes.
- What should a team do if the prespecified nuisance estimate cannot be calculated using the planned data and code?
Solutions. (1) No. The labels conceal treatment names, but the analyst can compare arm-specific means and observe their difference. (2) Treatment B’s sum is \(300-158=142\). Its mean is \(142/20=7.1\), while treatment A’s mean is \(158/20=7.9\). (3) The lead needs the approved target to implement recruitment, but generally does not need interim statistical information; limiting access reduces unnecessary disclosure. (4) For example, a pooled total combined with one subgroup’s total, or site-level summaries combined with participant counts and allocation information. (5) Follow the prespecified contingency and escalation process, document the issue, and do not invent a new calculation or request arm-specific data unless an authorized amendment and governance process permit it.