This edition of RADLAW examines the regulatory and legal considerations of the Alzheimer’s Network for Treatment and Diagnostics.
This edition of RADLAW examines the regulatory and legal considerations of the Alzheimer’s Network for Treatment and Diagnostics.
By the ACR Center for Research and Innovation™ Legal Team
The Alzheimer’s Network for Treatment and Diagnostics (ALZ-NET) is a national, longitudinal, provider-enrolled patient registry built to generate real-world evidence on the effectiveness, safety and use of novel, FDA-approved Alzheimer’s disease therapies. Sponsored by the Alzheimer’s Association and operated by the ACR Center for Research and Innovation™ (CRI), ALZ-NET is designed to collect regulatory-grade clinical data, neuroradiology and (in future phases) biospecimens across diverse care settings and patient populations. Its affiliated Coverage with Evidence Development (CED) study specifically evaluates anti-amyloid monoclonal antibodies (mAbs) under CMS’s National Coverage Determination, linking Medicare coverage to the generation of evidence on clinical benefit and harms in broad community practice.
This edition of RADLAW provides an overview of ALZ-NET’s legal and regulatory framework, with a focus on the interplay among FDA post-marketing expectations, CMS CED requirements, human-subjects protections and health privacy. It then examines ALZ-NET’s data-governance model that covers data access, sharing and future secondary use. Additionally, it evaluates the registry’s data-protection approach, including HIPAA compliance, de-identification and security controls.
ALZ-NET sits at the convergence of:
Notably, the prescribing information for recent anti-amyloid agents encourages participation in ALZ-NET, and CMS has approved the ALZ-NET-affiliated CED protocol to address required questions on benefits, harms (including amyloid-related imaging abnormalities (ARIA)), heterogeneity of treatment effect and durability of outcomes.
ALZ-NET is a prospective, minimal-risk, provider-enrolled registry with retrospective and prospective elements.
ALZ-NET is a prospective, minimal-risk, provider-enrolled registry with retrospective and prospective elements. It employs a central Institutional Review Board (IRB) of record, streamlining compliance with the revised Common Rule’s single-IRB mandate for multisite research. The ACR CRI functions as the operations center and data steward; Brown University’s Center for Statistical Sciences serves as statistical center; and governance is provided by co-principal investigators (PIs) and a project team with subcommittees for data access and management, imaging, education and communications. This governance model is aligned with the good clinical practice guidelines from the International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use as well as agency standards of scientific integrity, and it supports both core registry objectives and appending affiliated studies that reuse registry infrastructure while minimizing incremental site and participant burden.
The affiliated CED study satisfies CMS’s protocol-design specifications, including representative enrollment, standardized cognitive and functional outcome measures, and safety surveillance (including ascertaining ARIA via MRI reports and DICOM image collection). Other design specifications include appropriate follow-up (baseline; six, 12, 18 and 24 months; and then annually), public release of prespecified outcomes and analytic plans capable of addressing heterogeneity and time-varying effects. Comparator cohorts from the Alzheimer’s Disease Neuroimaging Initiative and the National Alzheimer’s Coordinating Center provide historical controls to benchmark real-world trajectories.
A core ALZ-NET feature is strict separation of clinical decision making from research participation. Treatment initiation and monitoring occur per FDA labeling and appropriate use recommendations, independent of ALZ-NET enrollment. This separation reduces physician inducement concerns and supports ethical validity by ensuring registry data reflect actual standards of care rather than study-driven interventions.
CMS’s use of CED has withstood scrutiny when protocols are scientifically sound, ethically governed and time-bound, with transparent public reporting. ALZ-NET’s publication commitments, central IRB oversight and alignment to the Agency for Healthcare Research and Quality’s scientific integrity criteria mitigate legal risk and enhance legitimacy. However, continued attention to timely dissemination and stakeholder engagement will be critical to sustain public trust. The ALZ-NET operation team and legal staff at the ACR CRI play an important role in closely monitoring and managing this.
ALZ NET’s dual-posture HIPAA-compliant data stewardship and Common Rule–compliant human-subjects oversight are fit for the registry purpose. However, as biospecimens and advanced omics are introduced, expert determination for de-identification and expanded consent models (for example, broad consent with governance guarantees) will merit reassessment to balance utility and privacy.
A data-usage agreement codifies non-reidentification, prohibition of linkage with external identifiable datasets, breach notification, audit rights, derivative data handling and publication and attribution standards. For international harmony, alignment with the Organization for Economic Co-operation and Development privacy principles and, where applicable, the E.U.’s General Data Protection Regulation’s appropriate safeguards for de-identified or pseudonymized data may facilitate cross-border scientific collaboration without importing non-U.S. legal regimes.
On the intellectual property and publication side, the data access and publication policy requires leadership consent for publication of registry-derived results and complete contribution of site-generated data. This centralizes quality control, reduces selective reporting risk and preserves data integrity. At the same time, policies ensure reasonable and non-discriminatory access to datasets for qualified researchers.
The ACR CRI’s activities in its role as operations center may involve the use of and access to individually identifiable protected health information (PHI) of research participants, as defined under HIPAA2 and in accordance with the authorization in the informed consent form executed by research participants.
ALZ-NET employs eConsent that is IRB-approved and compliant with 21 Code of Federal Regulations Part 11, and it permits in-person or remote consent, including consent via a legally authorized representative where capacity is impaired. The consent delineates core data collection, optional components (for example, biospecimen banking or future contact via TrialMatch) and authorization for retrieval of health insurance claims up to five years pre-enrollment and prospectively thereafter.
Enrollment is open to adults evaluated for, initiating or already treated with novel FDA-approved Alzheimer’s disease therapies where that disease is suspected as contributing pathology. The protocol explicitly aims to improve representation of historically under-enrolled racial and ethnic groups by leveraging site networks (IDEAS/New IDEAS) that have demonstrated feasible, inclusive recruitment. The CED protocol anticipates large sample sizes (target ≥20,000 per drug), enabling subgroup analyses by age, sex and gender, race and ethnicity, education, apolipoprotein E genotype, comorbidities and social determinants (for example, via the Area Deprivation Index).
Participants may withdraw at any time without affecting care. Upon withdrawal, previously collected data are retained as permitted by consent and law. However, the ACR CRI will collect no further data.
ALZ-NET collects adverse events and serious adverse events for research purposes but does not serve as the channel for time-critical safety reporting required by manufacturers or the FDA’s MedWatch. Other sites remain responsible for real-time safety reporting per product labeling, a clarifying safeguard to avoid role confusion and ensure regulatory obligations are met.
Clinical data flow through Medidata Rave, imaging through ACR Transfer of Images and Data (TRIAD) and ACR Connect as well as structured interfaces (HL7 listener, sFTP, APIs, webforms) enable EHR-to-registry ingestion with validation, parsing and de identification.
ALZ-NET’s minimum dataset encompasses:
The imaging repository stores DICOM studies and radiology reports for safety adjudication and future research.
With explicit authorization by the informed consent and HIPAA authorization forms, the ACR CRI and Brown University obtain health insurance claims for five years pre enrollment and prospectively to assess use and outcomes. Importantly, ACR and Brown keep claims outside the primary sharable dataset, mitigating re-identification risk while enabling robust health economics and outcomes research.
A central aim is responsible transparency. ALZ-NET plans periodic public availability of de-identified datasets, compliant with HIPAA de-identification safe harbor or expert determination. Affiliated CED results are to be made public within 24 months after end of data collection (or in line with ICMJE timelines), with negative and early-terminated outcomes included. External access is governed by a data access and publication policy, with data-usage agreements, dataset curation and oversight by a Data Access/Management Committee, which consists of ACR CRI staff and PIs from the research sites with the data-usage agreement negotiated and facilitated by ACR CRI legal staff.
The platform anticipates co-enrollment and reuse by affiliated studies that can draw on the minimum dataset without duplicate entry, reducing burden while maintaining consistent data standards. The inclusion of raw DICOM imaging and plan for a biorepository (optional) enable future multimodal discovery, contingent on consent scope and governance.
ALZ-NET treats the ACR CRI as the custodian of PHI necessary for operations (for example, claims linkage or imaging routing). PHI is encrypted, segregated from analytic datasets and access-controlled. The registry’s analytic files are de-identified under HIPAA privacy and security regulations. ACR maintains identifiers in a separate master key accessible only to authorized ACR personnel and the enrolling site.
ACR TRIAD and ACR Connect implement configurable DICOM de-identification conformant with DICOM PS3.15 Application-Level Confidentiality Profiles, removing or modifying direct and quasi-identifiers in headers and associated objects while retaining analytic utility for safety and research. For non-DICOM data, de-identification follows HIPAA safe-harbor standards or expert determination, depending on use.
Optional consent enables referral of contact information to the Alzheimer’s Association’s TrialMatch for future research opportunities approved by ALZ-NET investigators. File exchanges use encrypted channels with separate password transmission. When the biorepository launches, clear consent segmentation and material transfer agreements should govern biospecimen distribution, return-of-results policies and downstream data sharing.
ALZ-NET’s architecture—integrating compliant governance, rigorous data stewardship and a proactive data sharing posture—is positioned to deliver the kind of regulatory-grade real-world evidence upon which the FDA and CMS increasingly rely to steward the life-cycle of complex therapies. By coupling robust privacy and security controls with scientifically credible methods and equitable enrollment, ALZ-NET can accelerate collective learning about anti-amyloid therapies’ real-world benefits, risks and value. The registry’s success will hinge on careful execution of its data-protection program, transparent dissemination of results and continued alignment with evolving regulatory expectations.
By way of ALZ-NET operation, the ACR CRI delivers quality patient registry data and patient care through clinical research. ACR CRI legal staff also plays a key role by evaluating regulatory and policy issues and negotiating proper agreements with the research sites.
1These protections are 45 Code of Federal Regulations Part 46 (the “Common Rule”) and the HIPAA Privacy Rule (codified in 45 Code of Federal Regulations Parts 160 and 164).
2This includes both the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations set forth in 45 CFR §§ 160 and 164 as amended.
Looking into CCTA and Revenue Code Selection
The chair of the Commission of Economics discusses cardiac computed tomography angiography revenue code, with Juan Carlos Batlle, MD, MBA, FACR, FSCCT.
Read more
JACR Special Issue Shines a Light on Lung Cancer Screening
Ashley E. Prosper, MD, discusses how radiologists are positioned to make sure the benefits of lung cancer screening are realized broadly and with dignity.
Read more
You Belong Here: ACR Members Have a Partner for the Long Haul
The College’s staff and volunteers make membership invaluable through community-building, tireless advocacy and resources to advance your career.
Read more
