Onboarding for a new biostatistician in our early-phase clinical-pharmacology biometrics group. This page is for you, the person doing the work — it tells you how our team operates, the rules you must follow, what's real today versus proposed, and the order to learn it in. (The decks, business case, and tool comparisons elsewhere are for leadership deciding on the AI program — you don't need them to do the job.)
Read this once before anything else: most of this package is a proposal to bring more programming in‑house with AI — it is pending management approval, not how we produce deliverables today. Today's real production runs through validated tools and our programming team (below). The AI tools here are accelerators, skeletons, and proofs — not validated production systems. Where it matters, each item below is tagged SHIP TODAYPROPOSED or REFERENCE.
The single most important thing to understand on day one — and the thing most easily misread:
Statistical programming is an in-house programming team (not outsourced). Years ago the company relocated programming in-house; it is our team, in‑house, under our processes.
The accountable statisticians own the science, the specs, and the QC, and sign every output. You (NA) own the science, the specs, the QC, and you sign every output. Programming is handled by the in-house team.
Work runs through a ~12‑hour coordination loop. A question asked here in the afternoon is answered the next morning. That handoff is the rhythm of the job (and the friction the AI proposal is trying to reduce).
Blinded vs unblinded roles are real and enforced. Most of the team — including you, by default — works blinded. Unblinded data (treatment assignments, randomization, certain safety/PK) is walled off to specific unblinded roles (an unblinded statistician/pharmacist, the IVRS/randomization system, safety/PV). If you're blinded, you must not seek or handle unblinded data, and you keep it out of any shared tool.
Why this matters for everything else: because programming is in‑house and you are the signer, you are accountable for what ships — which is why the rules below are non‑negotiable, and why AI here only ever drafts behind a human and validated tools.
② Your rules of the road
These are not "what makes the program safe to adopt." They are the rules you personally follow, from day one:
Reported or regulated numbers come ONLY from validated tools — Phoenix WinNonlin (PK/NCA), Pinnacle 21 (CDISC conformance), the EDC/CTMS, the validated SAS/R pipeline. A number is never sourced from an LLM, a Knowledge‑Base note, or a draft. AI may draft words around the numbers; it never produces the numbers.
Operations content only in any AI/shared tool — never PHI, never participant‑level data, never unblinded assignments or randomization, never sponsor‑restricted IP. If you're unsure whether something is operational, treat it as restricted.
Rule
What it means for you
Say "participant," not "subject"
In all prose/deliverables. But keep CDISC variables exactly — USUBJID, SUBJID never change.
Blinding integrity
If you're blinded, don't seek, view, or route unblinded data. Keep it out of the Study KB and any shared/AI tool.
Independent double‑programming
Key derivations/outputs are produced twice, independently, and reconciled — that's how we trust a number, not because one program ran.
A qualified human signs every output
AI and automation draft and check; a named biostatistician reviews, signs, and is accountable. Nothing ships on a tool's say‑so.
Cloud AI needs the compliant path
Consumer "Claude/ChatGPT" plans are not HIPAA‑eligible. The compliant route is the API under a signed BAA — and in practice PHI never goes to the cloud at all.
③ What's real today vs proposed
So you never mistake a polished proposal for current practice:
✓ Real today — usable now, no approval gate
The validated way we work + the no‑AI accelerators
The validated pipeline + tools (Phoenix WinNonlin, Pinnacle 21, EDC) and the programming handoff — this is production.
The deterministic SAS/R monitoring & on‑leave coverage and Smartsheet no‑code automations — no AI, no new approval.
The Study Knowledge Base (no‑GUI, no‑AI file‑mover) — a reference build you can stand up.
◷ Proposed — pending approval, NOT in production
The AI program being pitched to leadership
The hybrid AI stack (cloud Claude + on‑prem local model behind one gateway), the human‑approval queue, the phased pilot — a recommendation, not today's process.
The polished operations wikis (e.g. the 75‑automation hybrid platform, the SLM operating wikis) describe a proposed future state.
The TLF libraries, the interpretation drafter, the simulation sandbox are skeletons / proofs‑of‑capability — accelerators to jump‑start validated builds, not validated systems.
A simple test: if a thing would put a number or a regulated output into the world, it goes through the validated path and a human signer — never an AI tool, no matter how finished the demo looks.
④ Your learning path
Do it in this order. Each step links to the real material.
DAY 1orient
This page — team + rules
Re‑read ① and ② until the rules are reflex. They govern everything you'll touch.
Open the TLF pseudocode libraries — SAS or R (pharmaverse). Follow one guide's "Run it" steps to run a single program against ADaM. These show the derivation/layout logic; they're reference skeletons, not the validated production route.
WEEK 1set it up
Stand up the Study Knowledge Base SHIP TODAY
Follow study_kb_nogui end‑to‑end (it's fully visual, step‑by‑step). It teaches the source‑routing / ops‑only governance reflex hands‑on — and it's real, no‑AI, usable now.
MONTH 1safety reflexes
Monitoring & on‑leave coverage SHIP TODAY
Work through the deterministic SAS/R monitoring + on‑leave coverage playbook, and the study lifecycle monitor. These teach the team's actual safety/operational reflexes (freshness gates, escalation, who decides). Note who acts: these flag and package; the medical monitor / DSMB / unblinded roles decide.
MONTH 1the AI aids
The proposed AI aids — in context PROPOSED
Now that the rules are reflex, see the AI accelerators behind them: the local interpretation drafter (drafts narrative text — never a number) and the synthetic study sandbox. Optionally take the AI Operations course — it introduces the proposed AI tooling (it is not the whole job; this path is).
⑤ Glossary — the acronyms you'll hit
TLF — Tables, Listings & Figures: the statistical outputs of a study.
SDTM / ADaM — CDISC standards: SDTM = collected data; ADaM = analysis‑ready datasets derived from it.
NCA — Non‑Compartmental Analysis: the standard PK parameter derivation (Cmax, AUC, t½…), done in Phoenix WinNonlin.
Phoenix WinNonlin — the validated PK/NCA tool of record.
Pinnacle 21 — the validated CDISC (SDTM/ADaM) conformance checker.
pharmaverse — open R packages for clinical work; admiral (ADaM) + tern/rtables (TLFs).
DB‑lock / DBL — Database Lock: the data is frozen for analysis.