Plan: Blinding and Unblinding Plan

This is a ready-to-use Blinding and Unblinding Plan, the controlling document an inspector checks everything else against: who is blinded to what, how the blind is held operationally, how it is broken in an emergency, how an accidental break is handled, how it is broken deliberately at the end of the trial, and how pharmacovigilance gets what it needs without leaking to the conduct team. Replace every <<FILL: ...>> placeholder, set your document numbers and dates, and route it through your normal review and approval before the first subject is randomized. A filled specimen follows. This is general guidance to adapt and verify, not legal or regulatory advice.

Document control header

1. Purpose and scope

This plan defines how the blind is designed, held, and controlled for protocol <<FILL>>, from first randomization through database lock and final unblinding. It applies to all sites, all roles named in section 2, and the systems listed in section 3. It does not replace the separate <<FILL: SOP-ID for emergency unblinding procedure>>, which this plan references for the operational steps of an emergency break, or the <<FILL: SOP-ID / procedure for supply-side code-break control>> governing the manufacturing and packaging side of blinding.

2. Blinding design and role matrix

Blinding design: <<FILL: e.g. double-blind, double-dummy against an active comparator and matching placebo>>. State precisely who is blinded, to what, and how; do not rely on the label “double-blind” alone.

3. Operational maintenance of the blind

3.1 Randomization and IRT / RTSM

• Randomization list generated by <<FILL: statistician / vendor>> with a documented, reproducible seed, validated, and access-restricted.
• IRT/RTSM holds the list and the kit-to-treatment map internally and exposes only role-appropriate information; validation must demonstrate blinded roles cannot derive the assignment.
• Access to the IRT is provisioned by role, reviewed at <<FILL: cadence>>, and deprovisioned promptly when a role changes.

3.2 Clinical supply and labeling

• Product is indistinguishable across arms in appearance, weight, smell, taste, and packaging; <<FILL: over-encapsulation / double-dummy / matched placebo, as applicable>>.
• A documented blinded assessment, including a weight check where relevant, confirms indistinguishability before use.
• Kit or pack labels show only kit number, expiry, storage conditions, and required regulatory text.

3.3 Data and reporting outputs

• Patient profiles, listings, data reviews, and TLFs shared with blinded staff suppress treatment, including indirect tells such as drug-level columns or a kit lot that maps to an arm.
• A validated step confirms blinded outputs are actually blinded before each blinded data review.
• Unblinded outputs (DMC reports, the firewalled statistician’s work, broken-case safety files) are stored in an area the conduct team cannot reach.

4. Emergency unblinding

Emergency unblinding is available around the clock for the safety of an individual subject, decided by the treating investigator when knowledge of the assignment is necessary for clinical management. Sponsor sign-off is never a precondition for an emergency break. The full trigger, authorization, primary (IRT) and backup (manual) channel, documentation, and notification requirements are defined in <<FILL: SOP-ID for the Emergency Unblinding Procedure>>; every break is recorded on the Unblinding Event Log.

5. Accidental and unintended unblinding

Treat every accidental or unintended unblinding as a quality event: document what happened, assess the impact (subjects, roles, and whether endpoints or decisions could be biased), contain it, correct the source, and raise a CAPA. Use the Accidental Unblinding Impact Assessment and CAPA for the assessment and corrective action record, and report a materially significant break to <<FILL: role>> for a disclosure decision, including whether it must be reflected in the clinical study report.

6. Planned unblinding for analysis: the firewall and database lock sequence

• The firewall is held by the unblinded (independent) statistician and unblinded programmers, who sit outside the conduct organization, do not attend blinded team meetings, and store unblinded outputs separately.
• The database lock and unblinding sequence, in order: (1) clean data and resolve queries while blinded, (2) blinded data review meeting to classify deviations and fix analysis populations, (3) database lock, (4) statistical analysis plan finalized and approved, (5) controlled, logged release of the randomization key, (6) analysis and reporting.
• No decision that depends on judgment, an analysis population, a deviation classification, the SAP itself, is made or finalized after the blind is broken.
• Master-key release is logged: who released it, who received it, when, and how it was applied.

7. Pharmacovigilance unblinding pathway

For a suspected unexpected serious adverse reaction, pharmacovigilance obtains the assignment for that specific case through a contained route, uses it to assess causality and prepare the expedited report within the applicable clock, and stores the unblinded case information apart from the blinded study data. The conduct team, including the medical monitor, learns only that a break occurred, not the treatment. See pharmacovigilance and safety data integrity for the wider safety-reporting picture.

8. Decentralized, pragmatic, and RWD-incorporating elements

Where this trial includes decentralized elements, pragmatic elements, or real-world data (RWD) per ICH E6(R3) Annex 2, this section states how the blind is protected outside the traditional site setting.

• Direct-to-patient shipment / home administration: <<FILL: describe kit chain-of-custody, who receives and administers product outside the site, and how indistinguishability and kit numbering are confirmed on arrival>>.
• Non-site healthcare professionals (home nurse, caregiver, local pharmacist): <<FILL: name each role, its blind status, its training scope, and whether it is ring-fenced as unblinded-by-necessity>>.
• Remote / video assessment and digital rating tools: <<FILL: describe rater qualification and blinding for remote assessments, and the validation evidence that the eCOA/DHT build behaves identically regardless of arm>>.
• RWD used as endpoint data or an external comparator: <<FILL: describe how outcome ascertainment is kept comparable between the trial arm and the RWD source, and how the adjudication charter, if used, applies one case definition regardless of data source>>.
• Adaptive elements (if applicable): <<FILL: describe any response-adaptive randomization or unblinded sample-size re-estimation, who calculates it, and what is allowed to cross the firewall>>.

9. Data integrity controls

• Unique accounts, role-based access, no shared logins, periodic access review, prompt deprovisioning.
• Audit trail of every unblinding action (emergency, accidental logging, key release), reviewed periodically, not just collected.
• IRT/RTSM validation specifically tests that blinded roles cannot derive the assignment and that unblinding functions are restricted and logged.
• Master-key version control and a documented, logged chain-of-custody procedure for release.
• End-of-study reconciliation of every unblinding event: IRT log, manual envelopes or scratch-off panels, safety breaks, and final key release should all agree.

10. Roles and responsibilities

11. Training and confidentiality

Every unblinded or firewalled role signs a confidentiality and unblinding agreement before receiving access and is trained on what may and may not be communicated to blinded staff. Non-site healthcare professionals named in section 8 receive scoped training limited to their task, not the full protocol, unless their role requires it.

12. Review and revision

This plan is reviewed at <<FILL: defined points, e.g. protocol amendment, DMC charter change, addition of a decentralized element>> and updated under version control, with the reason for each revision recorded. It is finalized before first randomization.

13. Acceptance criteria for this plan

• Every role in the trial, including non-site roles, has a documented blind status.
• The emergency unblinding pathway, the accidental-unblinding pathway, and the planned-unblinding sequence are each fully described or cross-referenced to a controlling procedure.
• The firewall around the unblinded statistician is named explicitly, with segregated storage.
• Decentralized, pragmatic, or RWD elements, where present, are addressed by name, not silently assumed to work like a site-based design.
• The plan is approved before first randomization and re-reviewed at defined trigger points.

14. References

ICH E6(R2) Good Clinical Practice and ICH E6(R3) Principles and Annex 1, integrity of randomization and blinding. ICH E6(R3) Annex 2, additional considerations for decentralized elements, pragmatic designs, and real-world data (Step 4, 3 June 2026). ICH E9, Statistical Principles for Clinical Trials. ICH E2A and regional implementations, expedited safety reporting and the unblinding of individual serious cases. 21 CFR 314.126, adequate and well-controlled studies, blinding as a bias-minimizing design feature.

Confirm the current version and clause numbers of each reference, and the in-force status for every region the study touches, before you rely on it.

15. Approvals

Filled specimen (excerpt)

The following shows the role matrix and decentralized-elements section completed for an example Phase 3 double-blind trial that includes home infusion for a subset of subjects. Illustrative only.

Decentralized elements, excerpt: “Home infusion nurses are engaged through a home-nursing service provider under a documented arrangement (Annex 2, investigator oversight of healthcare professionals). Each nurse completes task-scoped training on infusion administration and confidentiality, without access to the protocol or investigator’s brochure. Because the active-arm infusion requires a filter set the placebo does not, the nurse role is classified unblinded-by-necessity and excluded from any outcome-assessment activity. Kits are shipped cold-chain with identical outer packaging and kit numbering; the nurse confirms kit number against the IRT-issued dispensing instruction before administration and logs the confirmation.”

Common inspection findings this plan prevents

• A blinding plan that does not name every role’s blind status, especially non-site roles added after the protocol was written.
• Decentralized or home-administration elements added to the trial with no update to the blinding plan.
• No cross-reference from this plan to the emergency unblinding procedure or the accidental-unblinding form, leaving each to be reconstructed ad hoc during an inspection.
• A firewall described in general terms with no named roles or segregated storage.

How to adapt this plan

1. Populate section 2’s role matrix from your actual protocol and organization chart, including every non-site role.
2. Point sections 4, 5, and 7 at your actual controlling SOP and form numbers rather than leaving them as narrative alone.
3. Complete section 8 in full if the trial has any decentralized, pragmatic, or RWD element; delete the sub-bullets that do not apply and state that they do not apply, rather than leaving them blank.
4. Confirm every regulation and date in section 14 against the current published version before issue.