(GMP guidelines, §4.18: Before any packaging operation begins, there should be recorded checks that the equipment and work station are clear of previous products, documents or materials not required for the planned packaging operations, and that equipment is clean and suitable for use).
The packaging should be performed in such a way as to limit the risk of possible mix-up between the test and reference product. To this effect:
In the case of liquid formulations the volume packaged should be measured with appropriate precision and accuracy. If a reconstitution of the product is needed the instructions provided with the product should be followed. If a specified volume of fluid is to be used for the reconstitution this volume should be measured with appropriate precision and accuracy.
At least the following elements should be checked in-process by the operator and independently by a second person:
A standard operating procedure (SOP) should describe the packaging operations step by step, including the controls to be performed at each step and the responsibilities of each person involved.
These operations should only be performed by authorised personnel, qualified by training and education.
Access to IMPs should be limited to authorised personnel, both before and after packaging. Storage conditions should conform to the provisions of the protocol (temperature, humidity, protection from light if and as appropriate).
All operations performed, including the controls, should be documented in detail step by step at the time each action is taken. The persons performing each task should be clearly identified (operators and controllers). All precautions taken to avoid mix-ups should be documented in the batch records. Batch records should include at least the following information:
Copies of the labels, showing they have been checked against the randomisation list and approved, should be appended to the batch records.
All controls performed, and the identity of the person(s) performing each control, should be documented with the signature of the individual in charge.
As the test and reference product are to be packaged separately the use of separate batch records per product is strongly encouraged. If IMP are to be packaged/dispensed during separate operations for each trial period, separate batch records should be kept for each period.
Labelling shall be such as to ensure protection of the subject and traceability, to enable identification of the product and trial, and to facilitate proper use of IMP.
Labelling of the containers should conform with the local regulatory requirements. The labelling on each container should comprise the necessary information as required by §26-33 of the GMP Annex 13, for trials conducted under Directive 2001/20/EC, or Annex VI of the Regulation (EU) No 536/2014 (Clinical Trials Regulation [CTR]), for trials conducted under the CTR.
The note for guidance on the investigation of bioavailability and bioequivalence (CPMP/EWP/QWP/1401/98) does not require bioavailability and bioequivalence trials to be conducted blinded.
The use the words "dispensation" or "dispensing" to refer to the provision of a prepared dose of an identified medication to the subject is not recommended in order to avoid possible misunderstandings and confusion. This operation is more properly defined as administration. Administration includes directly introducing the medication into or onto the individual's body.
The process for IMP administration to the subjects should be described in an SOP.
The documentation generated at the time of IMP administration to the subjects should indicate unequivocally the identity of the product administered to each subject, except in the case of a blinded trial. Several possibilities exist to document this administration adequately:
The number of IMP units administered to each subject should be documented at the time of administration.
Compliance with the requirements of the protocol regarding the conditions of administration should be documented: volume of water taken with the IMP, administration in the fed or fasted state, posture etc.
Adherence to the protocol is a fundamental part of the conduct of a clinical study. Any significant change to the protocol should be submitted as an amendment/ modification to the competent regulatory authority and ethics committee. Significant changes to the protocol include any change in inclusion and exclusion criteria, addition or deletion of tests, dosing, duration of treatment etc. (see the definition of a substantial amendment in the 'detailed guidance for the request for of a clinical trial on a medicinal product for human use to the competent authorities, notification of substantial amendments and declaration of the end of the trial' published by the European Commission in chapter I, volume 10 of the rules governing medicinal products in the European Community; and definition of a substantial modification in the Regulation (EU) No 536/2014, Article 2, sub-section 2, point (13)). Deviations from the inclusion/exclusion criteria of the protocol might erode the scientific and ethical value of the protocol and its authorisation and might have an impact on the processes put in place for the care and safety of the study subjects.
Sponsors and investigators should not use systems of prospectively approving protocol deviations, in order to effectively widen the scope of a protocol. Protocol design should be appropriate to the populations required and if the protocol design is defective, the protocol should be amended.GCP does permit deviations from the protocol when necessary to eliminate immediate hazards to the subjects but this should not normally arise in the context of inclusion/exclusion criteria, since the subject is not yet fully included in the trial at that point in the process.
GCP inspectors have observed a number of sponsors implementing systems where the investigator can contact the sponsor, usually the Medical Monitor, and request a prospective approval to deviate from the inclusion and/or exclusion criteria. The use of such systematic waiver systems in clinical trials is not considered to be appropriate and studies using such a system might be regarded as non-compliant with GCP.
Niche subcontractors are used increasingly for carrying out specific tasks of the sponsor, such as monitoring, data management, Interactive voice response systems (IVRS), management of electronic patient diaries or CRFs etc. In addition there are contractors who undertake tasks that are partly or wholly related to the responsibilities of the investigator, even though the contractor may have their main contract with, and be paid by, the sponsor (such tasks may include specialised testing, source data retention (especially in the context of e-CRF or e-patient diary) or patient recruitment or follow-up contacts).
This fragmented distribution of tasks could put additional strain on the maintenance of quality assurance and compliance and obscure the clear responsibility and reporting lines for these tasks.
Great care is therefore needed in ensuring that the distribution of tasks is clearly documented and agreed, that each party has the control and access to data and information that their legal responsibilities require and that the ethics committees and regulatory authorities approving trials have been properly informed of these activities as part of the clinical trial application process.
The legal framework:
The responsibility for the conduct of clinical trials is assigned, by Directive 2001/20/EC1 and Regulation (EU) No 536/20142 (Clinical Trials Regulation [CTR]), and by the note for guidance on GCP (CPMP/ICH/135/953), to two entities – the sponsor and the investigator. The roles of the sponsor, investigator, contract research organisation (CRO) and, monitor, are further defined and described in Directive 2005/28/EC4 and in the glossary and chapters 4 and 5 of the note for guidance on GCP (CPMP/ICH/135/95). The definitions of sponsor and investigator are also provided in Article 2 of the CTR. A number of the tasks involve access to, review, collection and/or analysis of data, much of it personal data, and in specific cases contact with study subjects or potential study subjects. Data protection legislation needs to be followed, in addition to the clinical trial legislation and guidance. Regulation (EU) 2016/6795 sets out requirements for the protection of individuals with regard to the processing of personal data and on the free movement of such data. The specific requirements foreseen by local legislation, setting out the provisions for personal data protection, ethical review and informed consent, should be followed.
Contracts and agreements
All the clinical trial related tasks are ultimately the responsibility of either the sponsor or the investigator. Great care should be taken that the relative distribution of tasks to the different parties is well defined, making clear the ultimate responsibilities in the context of each clinical trial. This should be carefully documented, in the protocol, procedures, contracts or agreements and other documents.
The specifics of each particular clinical trial need to be taken into account when planning the trials, during their conduct and monitoring and by audits or inspections.
This is particularly important where entering into novel arrangements that may arise, for instance in the case of site management organisations (SMOs) or other organisations conducting tasks that relate to the responsibilities of the investigator but where the organisation has its contract and funding with the sponsor. These tasks can often involve contact with the study subjects.
The sponsor/CRO should determine the extent of monitoring of each party, within the context of GCP, under particular circumstances. This should be justifiable, and ensure GCP compliance, in the context of the clinical site organisation and the nature of the product and protocol being studied.
Contact with patients
Where direct contact with study subjects or their carers/guardians is involved, the privacy and confidentiality of those involved and of any information maintained or collected needs to be respected in compliance with the GCP and clinical trial requirements and with the personal data protection legislation. Such contacts need to be considered in advance by the ethics committees concerned and be given a positive opinion, either as part of the study specific opinion from the ethics committee or a more general opinion in the context of subject screening procedures, which are not study specific.
Personal details such as identity or contact information should not be communicated outside of the parties who have received the ethics committee approval and should not be used or communicated for purposes other than those agreed by the ethics committee and consented to by the study subjects, and where applicable, their carers or others who may be contacted and whose details might be retained.
1Directive 2001/20/EC of the European Parliament and of the Council of 4 April 2001 on the approximation of the laws, regulations and administrative provisions of the Member States relating to the implementation of good clinical practice in the conduct of clinical trials on medicinal products for human use (Official Journal L 121, 1/5/2001 p. 0034 - 0044).
2Regulation (EU) No 536/2014 of the European Parliament and of the Council of 16 April 2014 on clinical trials on medicinal products for human use, and repealing Directive 2001/20/EC
3ICH guideline for good clinical practice E6(R2) - Step 5 - Revision 2
4Commission Directive 2005/28/EC of 8 April 2005 laying down principles and detailed guidelines for good clinical practice as regards investigational medicinal products for human use, as well as the requirements for authorisation of the manufacturing or importation of such products (Official Journal L 91, 9/4/2005 p. 13 - 19).
5Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
Introduction
Source data is defined in International Conference on Harmonisation of Technical Requirements for Registration of Pharmaceuticals for Human Use (ICH) GCP (1.51) as all information in original records and certified copies of original records of clinical findings, observations, or other activities in a clinical trial necessary for the reconstruction and evaluation of the trial. Source data should be accurate, legible, contemporaneous, original, attributable, complete and consistent.
Source data is documented in source documents which may be both electronic and on paper. The following list gives examples of source documents where source data may be located:
Purpose of identifying source data location
Verification of source data is a considerable part of the work of monitors, auditors and inspectors.
During GCP inspections, it is frequently seen that data are recorded in multiple locations at a site.
It is therefore essential to the possibility of reconstructing the clinical trial that it is clear, where the original record is documented. The identification list of where source data is documented is primarily intended as a tool for monitors, auditors and inspectors in their work of verifying that the trial is performed in keeping with the ICH GCP guidelines, current legislation and guidelines as well as the trial protocol.
Requirements for source data
According to ICH GCP (6.4.9) and to the Regulation (EU) No 536/2014 (Clinical Trials Regulation [CTR]), Annex I, section D, point 17 (r), the protocol should identify any data to be recorded directly into the CRFs that are considered to be source data.
According to the reflection paper on expectations for electronic source data and data transcribed to electronic data collection tools in clinical trials, a detailed diagram and description of the transmission of electronic data should be provided in the protocol. The source data and their respective capture methods should be clearly defined prior to subject recruitment (i.e. in the protocol or in a trial specific source data agreement). The sponsor should describe which data will be transferred, the origin and destination of the data, the parties with access to the transferred data, the timing of the transfer and any actions that may be triggered by real-time review of those data.
The list of source data must be sufficiently detailed
In order to facilitate location of data, the list of source data should be sufficiently detailed. It is often not enough to write 'medical record', as the medical record is often a collective name covering different document types and locations. This may make it necessary to write: 'patient record – dispensing and administration chart', 'medical record – continuation', 'medical record – nurses notes', etc.
It is frequently seen during GCP inspections that the CRF is designed to only include an overall statement regarding a subject's eligibility in the trial. The text in the CRF could for instance say: 'Did the subject satisfy all study entry criteria?'. The statement is typically intended to be answered with 'yes' or 'no'.
The expectation of the GCP Inspectors' Working Group is that adherence to all individual inclusion and exclusion criteria are documented in the source data. Adherence to the criteria of the protocol can originate from different sources like blood samples, physical examination, medical history, information from the subject etc. When designing the protocol and the related CRF, the sponsor should carefully consider where each source data originate from, with reference to a specific visit. This is important since some data originate from screening visits, others from the randomisation visit and some data could be historical.
It should be agreed with the investigator of a site how adherence to the individual criteria is documented.
It is the expectation that a qualified physician who is an investigator or a sub-investigator for the trial has assessed each individual eligibility criteria and has taken the final decision to include the subject in the trial (ICH GCP 4.3.1). This decision should be documented prior to the subject receiving the first dose of the IMP.
GCP inspections have revealed a substantial amount of cases where the overall eligibility statement in the CRF confirms subject eligibility but where source data shows that the subject did not fulfil all eligibility criteria. In addition, it has often not been documented that an investigator/sub-investigator has reviewed all criteria prior to inclusion. It therefore seems that a system with an overall statement in the CRF regarding a subject's eligibility in itself does not ensure the safety of the subjects, the quality of the data and sponsor oversight.
In addition, see related Q&A regarding how and where source data should be defined.
Response:
The requirement for investigators to keep a copy of the CRF has been in existence for 20 years. (See for example ICH GCP 8.3.14). It is the expectation of the EU GCP IWG that the copy held by the investigator is a contemporaneous and independent copy of the CRF, i.e. that it is not held or has been held by the sponsor. This requirement is valid irrespective of the media used; however, the introduction of electronic CRFs in clinical trials presents an additional challenge in achieving this requirement - especially if data are being submitted directly via a web based application. This issue has been identified by EU GCP inspectors and discussed in the reflection paper EMA/INS/GCP/454280/2010 (see section 6.2 Specific Requirements Topic 3: control).
Recent inspections have revealed a need to clarify this point.
Requirement 10 of the above reflection paper states the following: "The sponsor should not have exclusive control of a source document. (Requirement 10, ICH GCP 8.3.13)"
The 12 requirements in the reflection paper originate from the CDISC standard and are therefore quoted directly in the reflection paper. However, although the CDISC requirements specifically relate to source data, the requirements is considered by the EU inspectors to be also applicable to transcribed data - as stated in the reflection paper section 6.2. Therefore, the requirement of a contemporaneous and independent copy of the CRF is valid irrespective of whether the CRF contains source data or only transcribed data. The EU GCP inspectors do not consider the requirement above to be met if data are captured in an electronic system and the data are stored on a central server under the sole control of the sponsor. This is because the investigator does not hold a contemporaneous and independent copy of the data.
The EU GCP inspectors do not have a preference for any specific solution e.g. a third party vendor, printed data prior to transferring to the database or saving a contemporaneous copy at the investigator's local computer hard drive; the essential point is that choosing an electronic solution should not jeopardise the credibility of data and should not result in lower quality as compared to a paper CRF. It is the responsibility of the sponsor and the investigator to institute a process by which a contemporaneous and independent copy of the CRF is available at the investigator site.
Can the sponsor require that the investigator contacts sponsor staff before unblinding?
According to international guidelines, the treating physician (investigator) is responsible for the medical care of the individual trial subject (Declaration of Helsinki 3§ and ICH GCP 4.3). The coding system in blinded trials should include a mechanism that permits rapid unblinding (ICH GCP 5.13.4). If the blinding is prematurely broken, it is the responsibility of the investigator to promptly document and explain any unblinding to the sponsor (ICH GCP 4.7).
The medical care of the trial subjects includes medical decisions such as whether to start or stop treatment or institute alternative treatment if required. In emergency situations the treating physician, often an investigator, may need to break the treatment code immediately, or as quickly as possible if he/she finds it is in the best interest of the trial subject. Consequently, in order to do so, the investigator must have unrestricted and immediate access to break the treatment code.
Some sponsors have recently introduced a code breaking system that requires the investigator to contact a sponsor representative and only after discussion with the representative, the investigator receives information that unblinds the treatment. Some sponsors have even added a requirement that the investigator submits a written form after the phone call before receiving the information that unblinds the treatment.
It is the opinion of the EMA GCP Inspectors Working Group (GCP IWG) and the Clinical Trial Facilitation Group (CTFG) that the responsibility to break the treatment code in emergency situations resides solely with the investigator. Consequently the sponsor can't require or insist on being involved in the decision to unblind, stall or delay in any way the unblinding of trial subject treatment in emergency situations. The groups also strongly recommend that any sponsor who has introduced or is applying such a system should immediately revise it in order to be compliant with international guidelines.
Breaking the treatment code is usually conducted via code envelopes or electronic systems such as telephone or web based systems such as IVRS and IWRS. When using these kinds of systems the investigator must have direct access in order to break the blind without the interference of the sponsor in any way. In support of electronic systems, a backup system enabling unblinding of treatment must be provided. The CTFG and the GCP IWG acknowledge that such backup systems are operated by the sponsor in a manual way and that the investigator or other treating physician can contact the sponsor staff to unblind the treatment. Still, the sponsor is not entitled to stall or reject unblinding.
Code breaking instructions should be specified clearly in the clinical trial protocol.
In connection with centralised applications, the Committee for Medicinal Products for Human Use (CHMP) often requests a good clinical practice (GCP) inspection of one or more sites to be performed. Prior to such GCP inspections, the European Medicines Agency (EMA) sends an announcement letter to the applicant in which – among others – a list of documents to be provided to the inspection team is presented. The data are used by inspectors for review in order to select patients and data to inspect. Among the requested documents are the individual patient data listings for the patients recruited at the sites to be inspected. Based on past experience, this request for data listings poses a significant number of problems and subsequently costs a lot of time for companies and inspectors, quite often resulting in listings of suboptimal quality.
The aim of this Q&A is to standardise and clarify the format of the data listings to be provided.
It is important to emphasise that the following guidance is the expected standard for most inspections; however, for some trials different, specific requests may be warranted. Consequently, no data should be provided until contact has been established with the reporting inspector and the requirements for data listings have been discussed.
In general, the following is expected:
Specification of formats and names:
Report format of the patient data listings
Unless otherwise agreed with the inspection team, the data should be collected in the groups defined below – each to be presented in a different Excel spreadsheet. The columns ”study site ID”, ”subject ID” and ”treatment group” and where applicable “visit ID” and/or ”visit Date” should be in all spreadsheets. Some data listings may – depending on the trial - belong to different groups, for instance ”vital signs/physical exam” usually belongs in the safety data group; however, in a hypertension trial it is likely to be an efficacy parameter. If in doubt, please ask the lead inspector:
Sponsors contract out an increasing number of tasks in clinical trials. According to Art 7(1) of Directive 2005/28/EC and Art 71 of the Clinical Trials Regulation (EU 536/2014), any sponsor may delegate any of his trial-related tasks/functions to an individual, company, institution or organization. Nevertheless, where tasks/functions are delegated to third-party, the sponsor remains ultimately responsible for ensuring that the conduct of the trials and the final data generated by those trials comply with the requirements of Regulation (EU) 536/2014 as well as with those of Directive 2001/83/EC in the case of a marketing authorization application. This applies in particular to the safety of the subjects and the reliability and robustness of the data generated in the clinical trial.
Any trial-related tasks/functions that are delegated to a third party should be specified in a written contract and made clear between the sponsor, third party and when relevant, with the investigator (e.g. responsibilities regarding safety reporting, see Q&A 5.4 in Q&A for Clinical Trials regulation).
Sponsors typically lack sufficient internal knowledge or resources to develop and/or manage the electronic systems used in clinical trials, such as systems used for randomisation and investigational medicinal product (IMP) distribution management/accountability (Interactive Response Technology (IRT)) and/or clinical trial data capture (eCRF and ePRO systems). Therefore, very often, sponsors delegate related tasks to third parties. In these cases, sponsors remain responsible to conduct the trial in compliance with the protocol and with principles of good clinical practice (Clinical Trials Regulation Art 47, ICH E6(R2) section 5.2.1).
During good clinical practice (GCP) inspections of commercial as well as academic trials, an increasing amount of deviations from GCP standards have been identified by the inspectors in view of sub-standard contractual arrangements and related procedures. The aim of this Q&A therefore is to highlight aspects with increased frequency of deviations during GCP inspections, which therefore should be prevented by improved contracts between sponsor and vendors of IT systems.
Special consideration should be given on relevant training and quality systems. Experience suggests that vendors accepting tasks regarding electronic systems are frequently knowledgeable about IT systems and sometimes data protection legislation, but not necessarily on ICH E6(R2) requirements, quality systems, etc. This Q&A should be read together with Q&A #2, which contains more general considerations on how contracting should be addressed, and with the Notice to sponsors regarding computerised systems, published on the EMA website in the GCP Q&As section. The examples of deviations are described as bullet points under the following headings: status of contracts, distribution of delegated tasks, standards to be followed, audits and inspections, serious breaches, compliance with the protocol, output and exemptions.
Status of contracts
The following contract-related issues have been identified by GCP inspectors in the context of clinical trial inspections:
Missing contracts or only draft contracts in place.
Distribution of tasks
Due diligence should be exercised from the sponsor to ensure that the distribution of tasks is clearly documented and agreed by the vendor, and that each party has the control and access to the data and information that their legal responsibilities require.
GCP inspectors have observed a lack of clarity with regards to:
Standards to be followed
The following issues have been observed by GCP inspectors regarding certain standards to be adhered to by the vendor.
When the vendor fails to formally agree to comply with the applicable national and EU legislation related to the conduct of clinical trials, as well as with ICH E6(R2) requirements, the sponsor should consider whether the use of the vendor is appropriate for the clinical trial.
Audits and inspections
It is sometimes not stated that the sponsor should have access to conduct audits at the vendor site and that the vendor site could be subject to inspections (by national and international authorities) and shall accept these. In addition, it needs to be specified that vendors shall provide necessary documentation (e.g. qualification documentation prepared by the vendor in relation to the system) when requested during a GCP audit/inspection process.
Serious breaches
Reporting of “serious breaches” of GCP/Trial Protocol is a legal requirement in certain Member States for clinical trials conducted under Directive 2001/20/EC, and is a legal requirement in all Member States for clinical trials conducted under the Regulation (EU) No 536/2014 (Clinical Trials Regulation [CTR]) as provided for by Article 52 of the CTR. The EU portal (Clinical Trials Information System [CTIS]) has been set up to handle the notification of serious breaches in accordance with the CTR.
It is frequently not specified in the contract that the vendor should report potential serious breaches to the sponsor (for assessment and onward reporting) and reporting timescales for such reports are missing.
Compliance with the protocol
The protocol is part of specification for IRT/eCRF builds and therefore should be consistent with the protocol approved by the regulatory authority and given a favourable opinion by the independent ethics committee. Some contracts reviewed had inconsistencies between the protocol and the wording of the contract. Examples have also been seen where contracts referred to the version of the protocol applicable when the contract was signed, however there was no contractual requirement to cover the vendor obtaining any subsequent changes. There is a risk that the vendor could implement changes to the electronic system based on protocol amendments sent by the sponsor that have not been approved by the CA and REC. The contract or the vendor procedures should address how this would be prevented.
Output
In terms of output generated from the clinical trial, the following observations have been made by GCP inspectors:
Exemptions
It is important to be aware of any exemptions in the contract regarding specific functionalities of the data collection system.
For example, contracts stating, that a data collection system cannot be used in the handling of e.g. serious adverse events, although the same system was actually used for exactly that purpose (i.e. automatically generating emails to safety departments, etc.) have also been noted by the GCP inspectors.
Qualification and validation particulars
On the basis of recent GCP inspection findings, inspectors would like to reiterate that sponsors should contractually ensure:
Reference document
This Q&A should be read in conjunction with the 'Reflection paper on expectations for electronic source data and data transcribed to electronic data collection tools in clinical trials (superseded)' - EMA/INS/GCP/454280/2010 and any further updates of this guidance. The Q&A aims to address the situation in which a sponsor is using a system (as intended) from a vendor, including the built-in possibilities for configuration. Further useful guidance can be found also in the notice to sponsors regarding computerised systems, published on the EMA website in the GCP Q&As section.
The system in question may be a system validated by the supplier, but installed at the sponsor, or a system provided as software-as-a-service (SaaS or cloud solution).
Different requirements will apply in cases when the sponsor is changing/adding functionalities to the system.
Today, in clinical trial settings, the use of electronic systems, e.g. for data collection, data management, safety data collection and evaluation, treatment allocation and trial management has proved to be more the standard than the exception. A considerable number of electronic Case Report Forms and applications for e.g. collecting Patient Related Outcomes or Clinical Outcome Assessments are provided by, or purchased from, vendors and are customized to varying degrees. GCP inspectors receive an increasing amount of questions from sponsors and deviations are given during GCP inspections regarding the level of validation/qualification needed to be performed by a sponsor when using a system that has already been (or is supposed to have been) validated by the supplier.
According to ICH E6(R2), sections 5.2.1 and 5.5.3.a, respectively, “the ultimate responsibility for the quality and integrity of the trial data always resides with the sponsor” and “the sponsor should ensure and document that the electronic data processing system(s) conforms to the sponsors established requirements for completeness, accuracy, reliability, and consistent intended performance (i.e. validation).”
According to ICH E6(R2), section 1.65., validation of computerised systems is “a process of establishing and documenting that the specified requirements of a computerised system can be consistently fulfilled from design until decommissioning of the system or transition to a new system.”
Furthermore, it is specified that the approach to validation should be based on a risk assessment that takes into consideration the intended use of the system and the potential of the system to affect human subject protection and reliability of trial results. This risk-based approach should be informed by the following guidance given. The risk assessment should be justified by the sponsor and documented.
The sponsor is ultimately responsible for the validation of the clinical trial processes, which is supported by electronic systems and for providing sufficiently documented evidence to GCP inspectors on the validation process and the qualification of the electronic systems. The sponsor may rely on qualification documentation provided by the vendor if the qualification activities performed by the vendor have been assessed as adequate. However, the sponsor may also have to perform additional qualification/validation activities based on a documented risk assessment.
The conditions for a sponsor to use the vendor’s qualification documentation include, but are not limited to, the following:
Sponsors and vendors should be aware that if the electronic systems are used for generating/handling relevant clinical trial data or to maintain control and oversight of clinical trial processes, documentation regarding the qualification process and any other relevant documentation on the electronic system maintained at the sponsor level, as well as on the vendor level, and it is the sponsor’s responsibility to ensure that these documents are available for inspections by Member States GCP inspectors.
Documentation regarding the validation of processes and qualification of systems is considered essential by GCP inspectors and it is likely to be requested during inspections. This is irrespective of whether the sponsor has contracted out activities related to electronic systems and whether the sponsor choses to consider as an audit the above-mentioned assessment of vendor systems/processes/documentation. GCP inspectors do not consider the documentation/report of these activities as an audit report that falls under ICH E6(R2), section 5.19.3d.
What should a sponsor do if the sponsor intends to submit an MAA without being able to provide documentation of qualification activities for clinical trial computerised data collection tools/software and access for inspectors is not ensured contractually?
In case a sponsor has relied fully or partly on vendor qualification efforts and documentation for any system function, the sponsor should make sure that such documentation is readily available for inspection if requested. Failure to provide access to the documentation is likely to result in critical findings that will impact the acceptability of the clinical trial data.
A sponsor should amend any contract with vendors to ensure availability of qualification documentation. If a vendor is not willing to amend the contract, the sponsor is responsible to demonstrate that the system concerned is in a validated and qualified state. In case a sponsor cannot rely on a vendor to provide documentation, the sponsor has to requalify the system on the basis of their own and of the vendor’s system requirement specifications. In case the trial is ongoing, this should be done without delay; if the trial is completed, this should be undertaken prior to the submission of the MAA. A documented risk assessment is required to assess integrity risks to data captured and held by a computer system that was not in a confirmed qualified/validated state following the retrospective qualification/validation activity. Depending on the outcome of the requalification, the sponsor may need to change to a new vendor/system. The required migration of previously captured clinical trial data should be validated. Findings that are the responsibility of the sponsor are still likely to be issued for the lack of documentation and inadequate vendor assessment prior to trial initiation.
Rererence document
The question is often raised on whether it is acceptable to carry out some clinical trial procedures, for example, to dispense and/or administer the IMP (e.g. i.v. infusions) or perform blood samplings to the subjects, at their home reducing the burden of travelling to the clinical trial site.
The GCP-IWG is of the opinion that the ICH-GCP guideline and applicable EU laws do not prohibit such practice, but it should be clear who has the responsibility for all aspects of subject protection and data reliability and robustness and the procedures in place should ensure that the rights, safety, dignity and well-being of subjects are being protected and the data generated are credible and accurate. In addition, national legislation regulations (see also below) should be taken into account for aspect such as dispensing and/or administering of IMP or blood sampling. For example, the direct shipment of IMPs to the patient’s home is not allowed by national legislation in some of the EU Member States and where it is allowed, still considerations should be made in relation to the patient confidentiality and the process followed should be checked against national requirements before any shipments are made.
The GCP-IWG considers that performing any practice at the subjects’ facilities and not at the clinical trial site should be avoided as much as possible and applied only if in compliance with national legislation and when duly justified. Hence, the GCP-IWG agreed on the following points:
Based on the trial design and setting, the sponsor may support the investigator by identifying or contracting service providers or personnel to be involved directly in the conduct of the clinical trial (e.g. providing additional resources to the clinical trial site or qualified personnel).
In the opinion of the GCP IWG it is possible to follow such an approach, provided it is compliant with the applicable EU laws and with the requirements of the ICH E6 guideline. Nevertheless, there are aspects that need to be carefully considered to ensure that the division of roles of the responsible parties is maintained. In this regard the Recommendation paper on Decentralized Elements in Clinical Trials is to be taken into consideration.
The investigator should retain the final decision on whether the service provider, intended to support the investigator, is appropriate. The investigator also retains the ultimate responsibility for any tasks involving trial-related medical decisions (e.g. participant eligibility and enrolment, protocol specified medical procedures, assessment of efficacy/safety, evaluation of test results, decision to dispense or make changes to the trial medication) and, the appropriate supervision of the persons or parties undertaking the activities delegated.
Any trial related procedure that is delegated to a service provider should be specified in a written agreement. Where the agreement is between the sponsor and the service provider and involves tasks under investigator responsibility, it should be clear in the agreement between the sponsor and the service provider as well as in the agreement between the sponsor and the investigator that the investigator maintains adequate control and oversight over the contracted tasks.
When contracting or delegating tasks to a service provider, a delineation should be maintained between tasks that are mutually exclusive or that lead to potential conflicts of interest (e.g. by delegating the quality control function to the same person who is performing the task in question or by having the same vendor performing tasks for both the investigator and the sponsor in cases where independence in the tasks are required).
Reference:
Sponsors and investigators/institutions should keep the TMF up to date and ensure that it is complete at the end of the trial. The TMF should be readily available and directly accessible, upon request, to the competent authorities of the Member States.
Prior to the inspection, the inspector will usually discuss with the sponsor and investigator/ institution the logistics of making the TMF available to the inspectors. A paper TMF (or eTMF stored on media archived elsewhere) or certified copies thereof (paper or electronic) created for and relevant to the inspection should be available for the inspection upon reasonable notice. Access to existing eTMFs (live and archived on servers) would be expected by inspectors to be given promptly (minimal / limited time only required to set up inspector access to the trials requested by the inspectors for the duration of the inspection procedure). The overall TMF index should be provided (in print-out) to inspectors to assist them in locating documents in the TMF.
Direct access to the TMF is required. In case of eTMFs, the inspectors should have read-only access to all documents in the eTMF, without any restriction. The inspectors should have access to the entire TMF, which means to the same TMF as used by the staff conducting the trial and be able to see all documents that are in the TMF. Direct access includes all the systems that comprise the TMF as defined by the sponsor; however, the nature of some of these systems, for example those containing data rather than documents and systems that contain centrally held documents (such as SOPs, training records and computer software validation), may require the direct access to be assisted by a representative of the sponsor familiar with the system. The inspectors may decide to request documentation (e.g. reprints, (electronic) copies, screenshots or photos) from the system. Organisations should be aware that GCP inspectors may have the right based on national regulations to seize original trial documentation (e.g. where there is a suspected criminal offence). GCP inspectors can always request copies or print outs and can retain some or all of these. The GCP inspectors’ expectation is that an eTMF system should at least adequately replicate the functionalities of a paper-based TMF system and provide for suitable document identification, search, prompt retrieval and marking for future reference/copying. The eTMF should enable review in an efficient manner and should not take longer to be undertaken than for a paper-based TMF and should enable straightforward navigation and opening of documents permitting searching and browsing (analogous to leafing through a paper-based file). Particular attention should be paid to the following aspects:
Any training required by the inspectors in order to use of the system, should be available, if the inspectors request training, and should be brief (taking no more than an hour).
The eTMF will need the use of suitable equipment, to be provided by the organisation, for the inspector to access/view the documents.
The investigators are responsible for data entered into eCRFs and other data collection tools under their supervision (electronic records). Those data should be reviewed and signed-off.
The signature of the PI or authorised member of the investigator’s staff is considered as the documented confirmation that the data entered in the eCRF and submitted to the sponsor are attributable, legible, original, accurate, and complete and contemporaneous (ICH-GCP 4.9.1). Any member of the staff authorised for sign-off (as per ICH GCP 8.3.14) should be qualified to do so in order to fulfil the purpose of the review as described below.
The acceptable timing and frequency for the sign-off needs to be defined and justified for each trial by the sponsor and should be determined by the sponsor on a risk-based manner. The sponsor should consider trial-specific risks and provide a rational for the risk-based approach. Points of consideration are types of data entered, non-routine data, importance of data, data for analysis, length of the trial and the decision made by the sponsor based on the entered data, including the timing of such decisions.
It is essential that data are confirmed prior to interim analysis and the final analysis and that important data related to e.g. reporting of SAEs, adjudication of important events and endpoint data, DSMB review, are signed off in a timely manner. In addition, a timely review and sign-off of data that are entered directly into the CRF as source is particularly important.
Therefore, it will rarely be sufficient to just implement one signature immediately prior to database lock. Signing of batches of workbooks is also not suited to ensure high data quality and undermines the purpose of timely and thorough data review.
For planned interim analysis, e.g. when filing a marketing authorisation application, all submitted data (e.g. eCRF pages) need to be signed off by the investigator or her/his designated and qualified representative before extracting data for analysis. The systems should be designed to support this functionality.
To facilitate timely data review and signing by the PI or her/his designated representative, the design of the EDC system should be laid out to support the signing of the data at the defined timepoints.
Furthermore, it is important that the PI reviews the data on an ongoing basis in order to detect shortcomings and deficiencies in the trial conduct at an early stage, which is the precondition to undertake appropriate corrective and preventive actions.
Appropriate PI oversight is required to ensure that incorrect data is being corrected in a timely manner and to implement necessary corrective and preventive actions at the investigator site.
Adequate oversight by the PI is a general requirement to ensure clinical trial participant safety and data quality and integrity. Oversight can be demonstrated via various means, one of them being review of reported data.
This question touches the scope of Good Clinical Practice (GCP) as well as the scope of Good Manufacturing Practice (GMP). The main aspects of the above question are, whether sponsor oversight, as defined in ICH GCP E6 (R2) also extends to the manufacturing area, i.e. a GMP area and whether the contract between the CRO and subcontractors should include (or implicitly permit) that a sponsor audit is possible not only at the CRO, but also at the subcontractor.
For clinical trials, sponsor oversight is required according to ICH GCP (R2), section 5.2.1:
(‘A sponsor may transfer any or all of the sponsor's trial-related duties and functions to a CRO, but the ultimate responsibility for the quality and integrity of the trial data always resides with the sponsor’). This oversight applies not only to duties and functions executed by sponsor staff, but also to duties and functions, which have been transferred to a CRO, or which were even further subcontracted by the CRO to another party; also see section 5.2.2 (addendum) (‘The sponsor should ensure oversight of any trial-related duties and functions carried out on its behalf, including trial-related duties and functions that are subcontracted to another party by the sponsor’s contracted CRO(s)’).
Furthermore, ICH GCP (R2) 5.13.1 and 2.12 stipulate that the sponsor ensures that the IMP is manufactured according to GMP and local regulations. The sponsor can only meet this requirement if he has the possibility to perform an audit at the manufacturing site.
Approaching this question from a GMP perspective, one comes to the same conclusion. According to Annex 13, the sponsor is responsible for the quality of the IMP and for implementation of an effective Quality Management System:
(‘Co-operation is required with trial sponsors who undertake the ultimate responsibility for all aspects of the clinical trial including the quality of investigational medicinal products. The increased complexity in manufacturing operations requires a highly effective quality system.’)
Similar requirements are outlined in the Detailed Commission guideline of 8 December 2017 on the good manufacturing practice for investigational medicinal products pursuant to the second paragraph of the Article 63(1) of Regulation (EU) No 536/2014 for trials conducted under the CTR:
(‘For manufacturers to be able to apply and comply with good manufacturing practice for investigational medicinal products, co-operation between manufacturers and sponsors of clinical trials is required. This co-operation should be described in a technical agreement between the sponsor and manufacturer, as referred to in recital 4 of Delegated Regulation (EU) No 2017/1569.’)
Moreover, GMP Volume 4, Chapter 7, section 7.17 explicitly states that audits at contractors and subcontractors should be made possible:
(‘The contract should permit the contract giver to audit outsourced activities performed by the contract acceptor or his mutually agreed subcontractors’).
In particular ‘For cause’ audits by the sponsor in relation to a complaint or a quality defect (e.g. quality, packaging, labelling, etc.) can be of great importance, if patient safety or well-being could be affected or even endangered by the issue/defect. Regarding the contracts, no matter which contractual constellation is planned or exists (contract: sponsor – CRO; CRO – subcontractor; sponsor – subcontractor), it is concluded from a GCP- and GMP- perspective that the contracts between the involved parties should permit that the sponsor of the clinical trial audits both, the CRO(s) and the subcontractor(s) (ICH GCP (R2), 5.2.1 and 5.2.2 Addendum and GMP Vol 4, Chapter 7).
15. Do GCP inspectors from regulatory authorities of an EU/EEA Member State have the authority to inspect trial participants’ medical records and other data, even if there is no statement in the ICF establishing that trial participants consent to the review of their medical records and other personal data by EU inspectors?
Scope and purpose
The scope of the question above addresses only GCP inspections requested by the CHMP.
The purpose of this document is to state the importance of sponsors to include an explicit passage in their informed consent form (ICF) regarding the authorisation for EU inspectors to direct access and review of trial participants’ medical records (including applicable electronic systems) and other personal data in EU/EEA and non-EU/EEA countries.
Background
A clinical trial as a scientific undertaking requires careful record-keeping to ensure that data are collected and reported in an ethical, accurate and complete manner. In addition, regulations and guidelines have established processes including investigator review, sponsor monitoring and auditing and regulatory inspection, in order to check and control the accuracy and completeness of the data.
According to the combined reading of sections 5.1.2 and 1.21 of ICH-GCP, the sponsor is responsible, to secure agreement from all involved parties to ensure that regulatory authorities have direct access to all trial related sites, source data/documents, and reports for the purpose of inspection. In order to secure the above-mentioned agreement, the sponsor should take into account ethical considerations and all applicable laws and regulations, including data protection legislation.
The dossier supporting a marketing authorisation application (MAA) submitted to the Agency should be inspection ready and therefore direct access should be ensured to source data/documents (including medical records) for the purpose of inspection by Union regulatory authorities.
Case a): inspection by EU inspectors of clinical trials conducted within the EU/EEA
For clinical trials conducted within the EU/EEA, EU inspectors have the authority to review trial participants’ medical records and other personal data, even if there is no statement in the ICF allowing access to these records and data.
The lawfulness of the processing of personal data, and in particular health data, by EU inspectors in the course of an inspection mandated by EMA and carried out within the EU/EEA is based on the fact that it is necessary for the performance of a task carried out in the public interest mandated by Union law, in particular, in the area of public health to ensure high standards of quality and safety of medicinal products. Therefore, the lawfulness of such data review is not dependent on the content of the ICFs. However, from an ethical point of view it is good practice to inform the patients that EU inspectors may access their medical records (ICH GCP § 4.8.10.n).
Case b): inspection by EU inspectors of clinical trials conducted outside the EU/EEA
Explicit consent should be obtained from the trial participants or their legal representative in the ICF to access their medical records and other personal data by inspectors/experts from regulatory authorities of an EU/EEA Member State.
The possibility that inspectors from EU/EEA authorities will have direct access to the participants’ medical records and other personal data should be clear to the trial participants. If a more general wording is used, such as "regulatory authorities from foreign countries", it is the responsibility of the sponsor to ensure before the trial is initiated, and confirm with the principal investigators, that such wording would not prevent EU/EEA inspectors from having direct access to the medical records and other personal data of the trial participants, based on the applicable local legislation and policy on data protection and access to medical records. The opinion of the relevant Independent Ethics Committee (IEC) or Institutional Review Board (IRB) might be sought in case of doubt with regard to the wording. If compliance with the above is not fulfilled, the dossier supporting the MAA, is considered to not be inspection ready as the trial participants’ medical records and other personal data concerned cannot be inspected.
Given the above, from an ethical point of view, explicit (written) consent should be obtained, pre-inspection, before the data would be accessed and reviewed by EU inspectors.
Data that cannot be inspected, cannot be confirmed nor can the integrity and the quality of the reported data be assessed. Compliance with GCP is in principle prerequisite for data to be used for the assessment for a marketing authorisation application. As a result, the data of the affected sites might not be considered in the assessment of the medicinal product concerned, which could have serious consequences for a marketing authorisation application.
References
Is monitoring a requirement for all clinical trials?
Monitoring is an ICH-GCP requirement for all clinical trials and should be conducted under the responsibility of the sponsor (ICH-GCP §5.18). Monitors should be appointed by the sponsor and their qualification and training should be documented (ICH-GCP §5.18.2).
The sponsor is expected to determine the extent and nature of monitoring in order to guarantee GCP compliance, based on a risk assessment taking into account the study population and study design.
Monitoring reports should be reviewed by the sponsor’s designated representative and adequate corrective/preventive actions should be implemented (ICH-GCP §5.18.6) for deficiencies or deviations. Monitoring is considered to be the main tool for the sponsor’s oversight of the trial.
For bioequivalence clinical trials, monitoring is required for the clinical part of the trial. The bioanalytical part is not subject to monitoring but to appropriate quality control as required by ICH-GCP §5.1.3.
Could audits substitute monitoring?
No, audits conducted by the sponsor according to ICH-GCP §5.19 cannot be considered monitoring. As stated in ICH-GCP “a sponsor’s audit (…) is independent of and separate from routine monitoring or quality control functions” (ICH-GCP §5.19.1).
Could the quality assurance/quality control activities of the contracted clinical site (BE CRO Facility) substitute monitoring?
Quality assurance/quality controls activities that are part of the quality system of the clinical site (BE CRO facility) cannot be considered monitoring. As explained above, monitors should be appointed by the sponsor and the activity should be performed by the sponsor or appropriately delegated. If monitoring is contracted to the same BE CRO that is conducting the clinical trial, it should be ensured that the personnel appointed for monitoring is not involved in the conduct of the same clinical trial.
How should monitoring be described in the study documents?
The monitoring activities carried out by or on behalf of the sponsor should be described in the Clinical Study Protocol (ICH-GCP §6.11) and in the Clinical Study Report (ICH E3 §9.6) and this should cover the extent and nature of monitoring based on a risk assessment as referred to above.
Should a monitoring plan be developed?
A monitoring plan should be developed according to ICH-GCP (R2) §5.18.7.
How will monitoring conduct be evaluated during the assessment of a MAA?
Information on the monitoring activities, as indicated in the Clinical Study Report, will be evaluated during the assessment of a MAA, and additional documents may be requested from the Applicant where necessary.
This Q&A focuses on how sponsor oversight of such activities can be demonstrated and should be considered in combination with Q&As B.2, B.8 and B.111, which contain general considerations on how contracting should be addressed. Furthermore, the reader is referred to the Guideline on the content, management and archiving of the clinical trial master file (paper and/or electronic) 2 and, upon publication, the Guideline on computerised systems and electronic data in clinical trials.
The current EU legislation and guidelines state the following on sponsor oversight of trial activities delegated by written contract:
The following points are a non-exhaustive list of measures to consider:
The sponsor should be able to demonstrate oversight through adequate documentation, including:
The sponsor should implement processes to continuously assess and manage the quality of the clinical trial. The quality management process to be put in place for the relevant issues identified should include:
The sponsor should ensure that contractual arrangements do not interfere with the sponsor's ability to perform quality management.
With good documentation and adequate processes, the sponsor should be capable to demonstrate their ability to identify signals of quality deviations/issues e.g.: missing data, high error rates in data entry, deviant processes, faulty or incomplete computerised systems, deviant employee behaviour, and deliberate deception such as fraud. In case of deviations from defined quality/ compliance levels or deliberate deception are detected, the sponsor should have adequate escalation processes in place to communicate the issues internally and follow up and solve the deviation/issue according to established procedures. For deviations or events of regulatory interest (e.g. serious breach, urgent safety measure), a timely notification is required, either in CTIS or according to national requirements.
The service provider may not perform all duties and functions (tasks) delegated in a written contract by the sponsor. The service provider may choose to further delegate duties and functions (tasks) to a different service provider (sub-contracting). This should not impact the level of oversight by the sponsor.
In order to still be able to demonstrate oversight as outlined earlier, the following should be considered in addition:
Regardless of delegation of duties and functions (tasks), the complete trial conduct should remain traceable and verifiable. Therefore, the sponsor should ensure that (direct) access to all trial relevant documents can be provided.
References:
Productivity applications are software used for producing information (e.g. documents, presentations, worksheets, databases, charts). Usually they are operated locally and allow the processing of texts and tables, the extraction and combination of information from different sources and the graphical presentation of results. The most widespread applications are universal solutions, not adapted to the specific requirements of clinical trials. Generally, suppliers of these universal solutions are not considered service providers in the context of a clinical trial.
Clinical trials have specific requirements for collecting, recording, sorting, storing, adapting, modifying, reading, using, sharing, comparing, linking, analysing, and deleting or destroying data and essential documents. Whether productivity applications are suitable for use in clinical trials depends on the use case.
Productivity applications are known to be used to support operational processes and to record, track and evaluate events from the clinical trial. The results of the applications can be essential documents with corresponding archiving obligations.
Commonly used applications for this are spreadsheet programs for oversight or tracking of relevant trial-related decisions (e.g. deviation management, data monitoring committee notes). Such use requires robust documentation and ongoing storage processes, e.g. storing of new versions of the spreadsheet after each decision process in a TMF fulfilling data integrity requirements.
A common shortcoming in productivity applications is the lack of an audit-trail or similar feature that ensures traceability and attributability of entries and changes. The use of productivity applications in areas where data integrity principles (such as the ALCOA++ principles) apply therefore requires a risk evaluation and, where applicable, effective mitigation measures. If such an application is used, a justification is required and measures should be taken to ensure attributability and traceability, and to make non-traceable changes more difficult or prevent them.
For instance, the specific measures could include:
Whenever non-traceable changes are or can be made to data and documents that impact data integrity and credibility, or the safety, well-being, rights, and dignity of trial participants, the risk-benefit balance of the clinical trial may be affected.
When pre-qualifying sites, the sponsor should assess the sites’ use of productivity applications. The assessment should consider their importance for the credibility and integrity of the data and safety, well-being, rights and dignity of the trial participants.
Facilities whose computerised systems do not meet the sponsor's requirements and the requirements of a clinical trial should only be selected, if justified and the risk of the deficiency is mitigated.
Some productivity applications allow the user to configure and to customise the functionality of the software itself. This includes the possibility to combine certain commands, create automatic scripts or add new functions. Configurations and customisations should be validated before use. The thoroughness of the validation depends on the use case and the risk for the corresponding process.
A common use is the calculation of derived values using spreadsheet applications. Depending on the risk of the derived value (e.g. dose calculation), an appropriate level of validation is required. In addition to the validation of the formulas used for calculation, the formulas should be protected against unwarranted modification.
Further modification of productivity applications usually requires expertise in the relevant programming languages and should only be performed by qualified and trained personnel. The qualification and training is a risk factor, which should be taken into account before the corresponding modification is considered or carried out.
Configurations and customisations should be considered in the archiving strategy, especially if essential decisions or events in the clinical trial cannot be reconstructed otherwise. Archiving the application file or the template of the application file as a dynamic file is recommended.
In order for the authorities to be able to assess whether the measures taken are appropriate, the use of productivity applications requiring specific measures and the measures taken, if any, are expected to be detailed and justified in the clinical study report (section on quality assurance).
Reference:
An IB including substantial changes should be distributed to clinical sites/ investigators as soon as it has been approved by the competent authority and has received a favourable opinion from the ethics committee(s), where applicable, in the country where these sites are located and for the trial in which the investigators participate. It is not acceptable to wait until the updated IB has been approved in all EU Member States or worldwide, or approved for all clinical trials concerned, before distributing it to the clinical sites/ investigators already covered by an approval/favourable opinion.
With regard to the start of the use of the new Reference Safety Information (RSI), sponsors should refer to separate guidance published and applicable to the legal framework under which their trial is approved:
However, this would not justify delaying the distribution of the IB to clinical sites/ investigators, as they are not involved in the determination of the expectedness of suspected serious adverse reactions. Please also note that it is strongly recommended in other guidance to submit a substantial amendment application that includes an updated RSI to all Member States concerned at the same time. It is not acceptable to unnecessarily prolong time to submission and thereby distribution to investigators of important safety information.
Similarly, a revised ICF should be distributed to clinical sites/ investigators as soon as it has received a favourable opinion from the ethics committee(s) and is approved by the competent authority, where applicable. An unjustified substantial delay, which affects patients’ rights, between the favourable opinion/ approval and the distribution (e.g. several weeks) is considered unacceptable. Cases where an outdated ICF missing important new information was signed by participant at enrollment, or a delay to obtain re-consent to participate in a trial on a new ICF, are considered GCP non-compliance, i.e. the trial participant was not (adequately) informed.
References
e-TMFs can be acceptable to regulatory authorities if they meet the requirements for TMFs that are described in Directive 2005/28/EC and the related guidance in volume 10 of the rules governing medicinal products in the European Union. For the purposes of GCP inspection (and audit), the following attributes apply:
Additional considerations
Documents on e-TMF should remain complete and legible in all aspects giving information about the way the document was prepared. This holds especially for contracts and forms completed by hand. Transfer to e-TMF should not (be used to) conceal any physical change to the document such as physical cut & paste to remove or add items, use of correction fluid etc.
It is helpful if the e-TMF has:
Future considerations
For the future, it would help if e-TMFs were available through secure internet links. This would help to avoid some unnecessary travel when accessing the TMF. This approach has advantages over supplying e-TMFs by e-mail, DVD etc., in that only one version of the e-TMF needs to exist, which can be continually updated for ongoing trials.
Advantages
Background
A variety of records is generated and maintained relating to the healthcare of clinical trial subjects (whether study subjects or healthy subjects). Some of these are general and relate to the general healthcare of the study subject before, during and after the trial. Others are specific to the trial. A clinical trial as a scientific undertaking requires careful record-keeping to ensure that data are collected and reported in an accurate and complete manner. In addition regulations and guidelines have established processes including investigator review, monitoring, auditing and inspection, in order to check and control the accuracy and completeness of the data. GCP, ethical requirements and medical standards require that each study subject is cared for and this duty to the individual is put above the more general scientific needs.
There are national, professional, local, or institutional requirements either in law, various forms of guidance, rules, or established practice which define many requirements for the maintenance of records in the course of normal study subject care. Any requirements that may arise as a consequence of the conduct of clinical trials can only be an addition and not a substitute for these, since the conduct of a clinical trial should never diminish the standard of care.
Many of those involved in clinical research ask questions about what should be documented, when, where, by whom and for what reason.
The purpose of this document is to set out some of the main elements of this study subject record-keeping in the clinical trial context, in order to assist those involved in clinical research to understand why such records are kept and looked for, and in order to help in planning record-keeping in specific contexts.
Taking into account the various issues outlined it is very unlikely that a CRF would ever suffice as the complete and only record of a study subject relevant to their participation in a clinical trial.
Reference documents: ICH guideline for good clinical practice E6(R2) - Step 5 - Revision 2
Specific references
| Study subject care | - CPMP/ICH-GCP 2.3, 2.7, 4.3 |
| Source Data /documents | - CPMP/ICH-GCP 1.51, 1.52, 5.15, 8 |
| Original Medical Record | - CPMP/ICH-GCP 1.43 |
| Case Report Form | - CPMP/ICH-GCP 1.11, 6.4.9, 4.9, 8 |
Issues
What should appear in the original medical record?
What purposes does the medical record serve in the context of the clinical study?
What purpose do source documents serve?
What characteristics should source data documents have?
Source documents should be:
- Accurate
- Legible
- Contemporaneous
- Original
- Attributable
- Enduring
- Available and accessible
Background
An increased trend of clinical trial sponsors routinely requesting copies of medical records from investigator sites has been noted during GCP inspections. There may be different reasons for this, such as endpoint committee evaluation, safety committee evaluation or even remote monitoring of e.g. eligibility criteria. The medical records could be hospital notes, scans, laboratory reports etc.
There are many aspects to take into consideration when clinical trials documents containing sensitive data of patients are sent to a sponsor, or a third party working on behalf of the sponsor, and failures have been noted during inspections.
Some examples are:
Without prejudice to the possible violation of the rules concerning the processing of personal data, it should be considered that failure to implement adequate technical and organizational measures for the protection of data could result in undermining the dignity of clinical trial subjects. It is therefore important to remind investigators and sponsors of their obligations concerning the protection of personal data in connection with the activities of clinical trials.
Legal framework
"The rights, safety and well-being of the trial subjects are the most important considerations and should prevail over interests of science and society", as stated in ICH GCP article 2.3. The guideline further states in article 2.11 that "The confidentiality of records that could identify subjects should be protected, respecting the privacy and confidentiality rules in accordance with applicable regulatory requirement(s)."
The WMA Declaration of Helsinki (64th WMA General Assembly, Fortaleza, Brazil, October 2013) is also very clear on this subject in article 24: "Every precaution must be taken to protect the privacy of research subjects and the confidentiality of their personal information."
There are also provisions in the EU data protection legislation that need to be adhered to when performing clinical trials. The Regulation (EU) 2016/679 (the General Data Protection Regulation - GDPR) represents the reference text, at European level, on the protection of personal data. It became applicable on 25 May 2018 and sets up a regulatory framework which seeks to strike a balance between a high level of protection for the privacy of individuals and the free movement of personal data within the European Union (EU) while increasing consistency in the application of data protection rules in the EU.
To protect the privacy of research subjects, data collected in clinical trials and reported to sponsors should always be pseudonymised (coded, as referred in ICH E6 (R2) point 1.58).
In this context "coding", is the process of assigning to a name or other direct identifier a unique code. The process of assigning a subject identification code meets the definition of pseudonymisation described in Article 4(5) of the GDPR: "Article 4(5) GDPR - pseudonymisation' means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person."
Recital 26 of the GDPR also clarifies that the personal data which have undergone pseudonymisation are information on an identifiable natural person and as such, they are considered personal data and hence fall under the scope of the GDPR as opposed to anonymous information, as described in the same recital: "Namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable" which falls outside the scope of the GDPR."
Thus, as long as there is a link between the subject identification code and the subjects' identity at the clinic level, such data should be regarded as "pseudonymised" and thus should be handled as personal data.
Considerations
The legal status of clinical trial subject data as personal data, whether coded or not, needs to be taken into account by investigators and sponsors, or a third party working on behalf of the sponsor, at all times and in particular when the data are transferred to other parties. This refers to e.g. CRF data as well as redacted copies of medical records. Below are some important factors to take into consideration:
In addition they may also refer to the extent and under which circumstances records can be provided to sponsors, or third parties working on their behalf, outside the clinical environment. These national regulations need to be followed by the clinics when sharing medical records with a sponsor, or a third party working on behalf of the sponsor, within the scope of clinical trials.
Overall, it is expected that during and after the conduct of clinical trials patients' integrity, involving handling of personal data, is respected, and that regulations governing both clinical trials and data protection are fulfilled.
For the purposes of this Q&A, direct remote access is any access from an access point (location and/or hardware) that is not under the control and supervision of the investigator/institution. Direct remote access involves additional data processing(1).
National provisions on direct remote access by authorised personnel of the trial sponsor (i.e. monitor or auditor) to identifiable personal and health data may differ between Member States and should be considered.
For the trial participants to give informed consent to participate in a clinical trial, they should be fully informed about all aspects of the trial that may influence their decision to participate. This also applies to direct remote access to confidential health records. Therefore, it should be explained in the informed consent documentation that in addition to the trial team (healthcare personnel) certain authorised personnel of the trial sponsor, (i.e. monitor, auditor) as well as regulatory authorities (i.e. inspector) may require direct remote access to their confidential health documents.
Any information addressed to the trial participants should be concise, easily accessible and easy to understand. Clear and plain language and, additionally where appropriate, visualisation should be used.
The participants' consent to participate in the clinical trial does not relieve the investigator or the sponsor of their responsibility to ensure compliance with the legal provisions on data protection.
The level of detail of information required when identifiable personal health data is accessed remotely may be determined by national regulations, if any.
Remote access to confidential health documents should be considered together with the requirements of Regulation (EU) No. 536/2014, Annex 1 on the content of the protocol, in particular on what the protocol shall contain at least:
Similar considerations are required for clinical trials under Directive 2001/20/EC.
A data protection impact assessment is strongly recommended, prior to remotely accessing confidential health documents, in particular to identify and mitigate risks associated with remote access.
The sponsor should consult with their data protection officer (DPO) and with the Institution/investigator and, if applicable, their DPO, to establish whether (direct) remote access is feasible and manageable. The sponsor and the institution/investigator should confirm their agreement in writing.
Due to the design of different systems, a distinction is made in the following between direct remote access to and remote viewing of records. Remote viewing means providing access by other means, such as sharing a screen or filming a document in real time.
The following aspects (not an exhaustive list) should be taken into account when accessing or viewing health documents remotely.
At the place, where access is granted, it should be ensured that
During transmission the following should be ensured:
At the place where the access is made, it should be ensured that
(1) Processing covers a wide range of manual or automatic operations on data. It includes the collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of data.