Why Access Should Be Designed by Role
An adaptation may require interim information that would otherwise remain masked. The central governance problem is not simply whether a trial is blinded: it is which person needs which information, for which task, and at what point. A site team may need information to care for participants, a sponsor team may need operational progress, an analyst may need data to calculate a prespecified quantity, and an independent reviewer may need results to assess an adaptation. Those tasks do not automatically justify the same access.
Earlier material on classifying interim information distinguishes pooled, arm-specific, treatment-identified, aggregate, and participant-level views. Here, those distinctions are used to construct access tiers. The tiers below are a planning framework, not a universal regulatory classification. A protocol and access plan should define the actual fields, reports, recipients, timing, and permitted uses for the particular trial.
The planning framework assumes that the trial has identified its adaptation tasks in advance, that treatment masking is intended for at least some roles, and that access can be limited and documented. It also assumes that data can be separated into views or reports; where a role must perform two incompatible tasks, separate personnel or controlled handoffs may be necessary. Access is not determined by job title alone. For example, “statistician” can describe a blinded reporting analyst or an analyst who must calculate treatment-linked interim results.
A Practical Set of Information Tiers
A useful plan names the information available at each tier rather than relying on vague labels such as “blinded” or “confidential.” The tiers below progress from operational information to more revealing outcome information. They are not always a single strict ladder: access to a participant’s own clinical record, for example, is a different purpose from access to a trial-wide participant-level outcome file.
| Tier | Interim information | Typical disclosure concern |
|---|---|---|
| T0: Operational | Recruitment, site activation, data completeness, and other operational summaries without comparative outcomes | Operational patterns may still suggest a treatment difference if linked to outcomes or allocation |
| T1: Pooled, masked | Trial-wide outcomes or nuisance estimates pooled across treatment groups, with no arm-specific breakdown | Pooling can conceal group differences, but allocation information or repeated reports can enable inference |
| T2: Arm-specific, masked | Separate results for groups labelled with non-identifying codes, without revealing which code is which treatment | Patterns may identify a treatment indirectly, especially when labels or external information are known |
| T3: Treatment-identified aggregate | Arm-specific summaries linked to actual treatment identities, without participant-level records | Direct access to comparative results can change decisions or influence trial conduct |
| T4: Treatment-identified participant-level | Participant-level records linked to actual treatment identity | Highest detail and disclosure risk; unnecessary fields or small subgroups can expose individuals |
Tier definitions should specify which outcomes, covariates, dates, group labels, and population summaries are included. They should also distinguish access to data from access to derived results. A role receiving a single approved summary does not necessarily need the underlying records used to calculate it.
Deriving a Pooled View’s Information Limit
A pooled estimate combines information across groups, so it generally cannot by itself determine each group’s outcome rate. For two groups with sizes \(n_A\) and \(n_B\), and event rates \(p_A\) and \(p_B\), the pooled rate is a weighted average:
This single equation contains two unknown group rates. Unless additional information is available, many pairs of rates can produce the same pooled value. That limits what can be recovered from the pooled result alone, but it does not guarantee that treatment effects cannot be inferred: unequal allocation, prior reports, external knowledge, small samples, or other linked information can constrain the possibilities. Thus “pooled” describes the report’s construction, not a guarantee of secrecy.
Worked Example: What a Pooled Event Rate Does and Does Not Reveal
Suppose a hypothetical two-group trial has 100 participants in group A and 50 in group B at an interim review. There are 28 events in A and 8 in B. A pooled-only recipient sees the total number of events and participants, but not the group counts.
The pooled event rate is:
If the recipient is told the allocation sizes but not the group event counts, the report gives the constraint \(100p_A+50p_B=36\) in event-count units. For example, event counts of 26 and 10 also total 36, as do 30 and 6. The pooled rate alone therefore does not identify the two group rates.
The person preparing the report can verify the underlying counts: \(28/100=28.0\%\) in A and \(8/50=16.0\%\) in B. Those arm-specific rates are not part of the pooled-only output. The example shows why a pooled report can be appropriate for some operational or nuisance-estimation tasks while still being insufficient for a task requiring a treatment comparison. It also shows why withholding group counts is not a promise that no other information could reveal them.
Assigning Roles to the Least Revealing Sufficient Tier
Start with the decision or task, not the person’s seniority. State what the role must accomplish, identify the minimum information necessary, and then check whether the proposed view could reveal more than intended through its labels, granularity, timing, or combination with other reports. The matrix is a working allocation, not a universal rule: a particular trial may justify a different tier if the task and safeguards are documented.
| Role | Example task | Starting access proposal | Boundary to document |
|---|---|---|---|
| Site personnel | Conduct visits, assess safety, and maintain participant records | Participant information needed for care and trial conduct; usually no comparative interim outcome report | Specify which clinical records are visible and whether treatment identity is masked at the site |
| Sponsor personnel | Manage trial operations, quality, and resources | T0 operational summaries; T1 pooled summaries only when needed | Separate operational oversight from receipt of treatment-linked comparative results |
| Analysts | Produce a prespecified summary or perform an interim calculation | T1 for pooled calculations; T2 or T3 only if the assigned calculation requires group-specific or treatment-identified data | Define which analysts can access each input and whether results may be passed to other roles |
| Independent reviewers | Review interim information for an authorized trial decision | The tier sufficient for the review, potentially T2, T3, or a restricted T4 extract | Specify the review question, permitted output, confidentiality, and limits on onward disclosure |
“Independent” describes separation from certain trial interests; it does not itself specify the information needed. Similarly, a site’s legitimate access to a participant’s clinical information does not imply a need for trial-wide comparative summaries. The plan should separate care-related access from access to analyses used for adaptation.
Write the action or decision the role is authorized to support, and identify when it occurs.
List outcomes, group labels, participant-level fields, and operational variables required for that task.
Choose the least revealing sufficient view, and state whether the role may receive raw data, a derived result, or only a decision-relevant summary.
Check small counts, repeated snapshots, allocation ratios, labels, and information shared by other roles for indirect identification.
Document authorized recipients, timing, storage, onward sharing, and what happens if access is mistakenly broader than planned.
Worked Example: Separating Site and Sponsor Views
In a hypothetical masked trial, 80 participants have completed an interim visit. Across both groups there are 12 recorded events among 60 participants with evaluable follow-up. Site teams need to manage participant visits and safety follow-up; sponsor operations staff need to assess data completion. Neither task requires a treatment comparison.
The pooled event proportion is \(12/60=0.200\), or 20.0%. A trial-wide report of this proportion is T1. A completion report could state, for example, that \(72/80=0.900\), or 90.0%, of participants have an interim visit record. That operational summary is T0 if it contains no outcome breakdown that would expose group patterns.
The site view should contain the clinical and visit information needed for its participants, while excluding trial-wide interim event comparisons. Sponsor operations can receive the 90.0% completion summary and, if justified, the pooled 20.0% event proportion; they do not receive group-specific event counts under this plan. These assignments follow the tasks rather than assuming that every site employee or sponsor employee has identical access.
Before approving the reports, the trial team should check whether site-level completion or event summaries are so small or uneven that they indirectly reveal group-specific results. If they do, the summaries may need aggregation, delayed release, or restriction to another role.
Worked Example: Giving an Analyst Only the Information Required
Consider a hypothetical adaptation review requiring a treatment-specific response comparison. At the interim cutoff, group X has 36 responses among 80 participants and group Y has 25 among 80. The analyst assigned to calculate the comparison needs treatment-identified aggregate data for this task; an analyst preparing only a pooled event-rate report would not.
The response proportions are:
The observed difference, defined here as X minus Y, is \(0.450-0.3125=0.1375\), or 13.75 percentage points. This is a descriptive interim contrast, not by itself a final efficacy conclusion. The calculation illustrates why this particular analyst task requires T3 information and why the output should be restricted to the authorized review pathway. Sponsor operations and sites do not need these treatment-identified rates merely because the analyst does.
Checks, Alternatives, and Limitations
A role matrix is working only if the actual reports and data systems follow it. Warning signs include unexplained treatment labels in a report, group-specific counts sent to an ostensibly pooled recipient, small site-level cells, repeated snapshots that allow differences to be reconstructed, or one person receiving both a masked summary and a key that unmasks it. Review access logs and report specifications against the plan, not just the intended policy.
Three common approaches illustrate the trade-offs:
| Approach | Advantage | Main limitation |
|---|---|---|
| Uniform restricted access | Simple to administer and can reduce accidental disclosure | May prevent authorized roles from completing necessary tasks or encourage informal workarounds |
| Role-based tiers | Matches access to task and can preserve masking for roles that do not need comparative results | Requires careful definitions, consistent systems, and monitoring of indirect disclosure |
| Broad unblinded access | Convenient where many roles genuinely need treatment-identified information | Increases opportunities for operational influence, selective interpretation, and loss of masking |
The wrong reasoning is: “This person is senior, independent, or a statistician, so they should see all interim results.” The correction is: identify the task, then provide only the information needed to perform it. Conversely, minimizing access must not block safety care or an authorized review. A tier plan cannot eliminate inference from outside information, guarantee that masking is maintained, or replace a prespecified adaptation procedure. Nor does an access tier determine whether a statistical method controls error rates; those properties depend on the design and analysis procedures.
Check Your Understanding
Answer each question, then compare with the solutions below.
- A pooled report gives 18 events among 120 participants. What is the pooled event proportion, and can it alone identify both arm-specific event rates?
- A site team needs participant safety records but has no adaptation-review task. Which information distinction should the access plan make?
- An analyst is assigned to calculate a treatment-identified comparison. Which tier is generally required, and why is a pooled-only view insufficient?
- Name two ways a sequence of individually masked reports could reveal interim group differences.
Solutions. (1) \(18/120=0.150\), or 15.0%. One pooled equation does not generally identify two arm-specific rates. (2) Separate care-related participant information from trial-wide comparative summaries; the site’s clinical need does not automatically imply access to comparative results. (3) T3 is generally required for an aggregate treatment-identified comparison because the analyst needs both group outcomes and their treatment identities. (4) Repeated totals can be differenced to recover newly accrued outcomes, and small subgroup or site summaries can expose group patterns, especially when allocation or other reports are known.