Greg Gogates

When audit trails are used in any business process, whether it be in pharmaceutical clinical research, stock market trading or banking, it creates a step-by-step record by which data can be traced to its source. An audit trail is most often utilized when the accuracy of a data element needs to be verified or when a record of changes made to original, or source data is required. Not all data have the same level of criticality. For example, in a clinical trial, the significance of tracking data changes may depend on the nature of critical variables such as those affecting randomization, as well as compliance with inclusion and exclusion criteria. For example, it would be unacceptable for a data field to be changed in order to make an ineligible subject eligible without full visibility and documentation to allow assessment by those monitoring the study.

This article addresses and discusses the regulatory history behind audit trails and its interpretation as it relates to clinical research data originating or residing in EDC or eCOA systems.

, the FDA published the Final Rule on Electronic Records; Electronic Signatures as related to 21 CFR Part 11. As part of the discussion, it was stated in comment 72 on page 13446 that: “§11.10(e) would require the use of time-stamped audit trails to document record changes, all write-to file operations, and to independently record the date and time of operator entries and actions.”

It was also stated that: “…record changes must not obscure previously recorded information and such audit trail documentation must be retained for a period at least as long as required for the subject electronic documents and must be available for agency review and copying.” “As many comments objected to the proposed requirement that all write-to file operations be documented in the audit trail…”, FDA noted that it is the “…agency’s intent that the audit trail provide a record of essentially who did what, wrote what, and when.”

Although FDA acknowledged that “…not every operator ‘action’, such as switching among screen displays, need be covered by audit trails, the agency was concerned that revising the rule to cover only ‘critical’ operations would result in excluding much information and actions that are necessary to document events thoroughly.” “The agency intended that the audit trail capture operator actions and operator information at the time the information is saved to the recording media (such as disk or tape), in much the same manner as such actions and information are memorialized on paper.” FDA noted that the “…audit trail need not capture every keystroke and mistake that is held in a temporary buffer before those commitments. For example, where an operator records the lot number of an ingredient by typing the lot number, followed by the ‘return key’ (where pressing the return key would cause the information to be saved to a disk file), 

the audit trail need not record every ‘backspace delete’ key the operator may have previously pressed to correct a typing error

” FDA added, that “…subsequent ‘saved’ corrections made after such a commitment, must be part of the audit trail.” Accordingly, the FDA revised proposed § 11.10(e) “…by removing reference to all write-to-file operations and clarifying that the audit trail is to cover operator entries and actions that create, modify, or delete electronic records.”

, the EMA published a Reflection paper on expectations for electronic source data and data transcribed to electronic data collection tools in clinical trials and stated that: “The audit trail starts with the initial entry of the data.”

, the FDA Guidance for Industry, entitled: “Electronic Source Data in Clinical Investigations” defined an audit trail as: “A process that captures details such as additions, deletions, or alterations of information in an electronic record without obscuring the original record. An audit trail facilitates the reconstruction of the course of such details relating to the electronic record.” "§III.A.2.e. Transmission of Data From Patient-Reported Outcome (PRO) Instruments to the eCRF. When a PRO instrument is used by a subject to transmit data elements directly to the eCRF, the subject is the data originator and the eCRF is the source. If a process is used by which the subject uses the instrument to transmit data to a technology service provider database, the 

, the Medicines & Healthcare Products Regulatory Agency (MHRA) ‘GXP’ Data Integrity Guidance and Definitions stated that: “The audit trail is a form of metadata containing information associated with actions that relate to the creation, modification or deletion of GXP records. An audit trail provides for secure recording of life-cycle details such as creation, additions, deletions, or alterations of information in a record, either paper or electronic, without obscuring or overwriting the original record. An audit trail facilitates the reconstruction of the history of such events relating to the record regardless of its medium, including the ‘who, what, when and why’ of the action. Where computerized systems are used to capture, process, report, store or archive raw data electronically, system design should always provide for the retention of audit trails to show all changes to, or deletion of data while retaining previous and original data. It should be possible to associate all data and changes to data with the persons making those changes, and changes should be dated, and time stamped (time and time zone where applicable). The reason for any change, should also be recorded. The items included in the audit trail should be those of relevance to permit reconstruction of the process or activity. The relevance of data retained in audit trails should be considered by the organization to permit robust data review/verification.” 

“It is not necessary for audit trail review to include every system activity (e.g., user log on/off, keystrokes etc.).”

We believe, that unless there is a clear need to collect keystroke data, any data collected prior to clicking on the SUBMIT/SAVE keys serves no purpose. Analysis of these data also would be complex and adds no value to the study, the study record, or the audit trail. 

While the definition of an audit trail is very clear, there appears to be some confusion about the definition of an original or source record in the digital world. We believe the data entered 

 clicking on SUBMIT or SAVE are the source, except for a very few cases: 1) where there are other original records such as data originally collected as a paper record, or 2) where the ability to type accurately (or speak clearly) is a variable to be measured according to the study protocol, or the natural characteristics of end point data. Conversely, we do not see value for clinical research, in assessing data quality in data that includes erroneous keystrokes as source, such as data that would be collected before the user has corrected unintentional errors and before the user clicks SUBMIT or SAVE. 

Edit checks can also affect audit trail retention. Edit checks on end user devices should only catch obvious user errors. These are flagged and the user has the opportunity to correct “immediately” before going forward, and no audit trail is necessary as this is simply automated mistake correction. 

However, there are situations where an immediate edit check should not be used, and instead edit checks that fire after the data have been submitted can be used to alert site staff of anomalies that should be investigated. 

All changes made after the data have been submitted must be captured in the audit trail.

While we do not recommend saving pre-submit keystroke data, we do recommend that the source of the data that is transmitted to the clinical research database is properly attributed. The audit trail functionality of the eCOA devices (mobile phones, tablets, Internet of Medical Things (IoMT), and web browsers) used in clinical trials should be aligned with the regulatory agency’s descriptions noted above, as well as industry standard practices. 

We recommend that at the time of data entry into an electronic system that supports a clinical trial such as EDC and/or eCOA, two additional metadata should be collected: the data source and the data originator. Examples of a data source are direct data capture, paper record, EHR etc. Examples of data originators are the clinician who did the physical exam or the study coordinator who did the interview. A data originator for an eCOA questionnaire, whether using a dedicated device or a website, is the person logging in with his/her username and password, as it is assumed that data entry will be performed by that person (regardless of if this is the study subject or authorized designee/caregiver, such as a parent in a study of pediatric patients).

For eCOA users, the data source or data originator is usually very clear in the system and in the audit trail. There is also no need for source data verification (SDV) against the eCOA device, as there is only one copy. The devices essentially acquire data from study subjects in real time, temporarily store the data within the application, and then eventually pass the data to the centralized database as a completed task. Changes made to entries prior to submitting the record being created by the data originator, can be considered draft data, held in temporary storage until that point in time when the user acknowledges their entry is complete, and then consciously saves the record and submits it for transmission. This is analogous to completing a draft paper form prior to signing the record. 

Thus, the audit trail for eCOA devices used in clinical trials begins at the time data is committed to permanent storage in the main eCOA database, similar to authenticating a paper form at the time of signing.

It is important that each company is clear on when the audit trail begins for their EDC and eCOA systems. We recommend that they perform a risk assessment regarding the value of saving keystroke data prior to a save/transmit transaction. The protocol or other document (such as the Data Management Plan) should include this information.

All of us can hit wrong keys when entering data using a keyboard/touchscreen or when we observe voice transcription errors. Unless there is a clear need to collect keystroke data, any data collected prior to clicking on the SUBMIT/SAVE keys serves no purpose. Analysis of these data also would be complex and adds no value to the study, the study record, or the audit trail. 

To properly attribute source data, two additional metadata need to be collected at the time of data entry: the data source and the data originator.

Finally, to be clear as to when the audit trail begins, it is recommended that each company perform a risk assessment regarding the audit trail value of keystroke data and data entered prior to a save/transmit transaction. It is also recommended to put this information into the protocol or other document such as the Data Management Plan (DMP). And finally, when in doubt, share the plan with regulators and obtain their agreement.

Members of the eClinical Forum Regulatory Advisory Group: 

 is the Co-Founder of Target Health, US. 

 is the Associate Director of Global Data Management & Centralized Monitoring for Bristol Myers Squibb, Japan. 

, MD, is a Scientific Advisor for ERT, Switzerland. 

 is the Vice President of Quality/Regulatory for Fasor, US. 

 is a Quality Manager for Viedoc Technologies, Sweden. 

 is a Senior Director, Data Integrity Quality Assurance for Astellas Pharma Global Development, US. 

 is the Americas Administrator for eClinical Forum.

21 CFR Electronic Records; Electronic Signatures – Final Rule

Reflection Paper On Expectations For Electronic Source Data and Data Transcribed to Electronic Data Collection Tools in Clinical Trials

Electronic Source Data in Clinical Investigations

GXP’ Data Integrity Guidance and Definitions

Articles

A discussion of the regulatory history behind audit trails and its interpretation as it relates to clinical research data originating or residing in EDC or eCOA systems.

When Should the Audit Trail Begin?

	The European Union (EU) General Data Protection Regulation (GDPR) is the most important change in data privacy regulation in 20 years. The regulations can be enforced from May 25, 2018, at which time any organization which does not comply may face heavy fines. The GDPR (

) replaces the Data Protection Directive 95/46/EC, designed to harmonize data privacy laws across Europe, to protect and empower all EU citizens data privacy, and to reshape the way organizations across the region approach data privacy.

	Certain key changes fall under different categories (see The GDPR key changes 

	· Increased Territorial Scope (extra-territorial applicability)

	The aim of the GDPR is to standardize and strengthen the protection of personal data across the EU and for other country’s data being “processed” within the EU. As such, this is an issue for all to take note, not just those based in Europe. Under the new regulations, all company processing of the personal data of subjects residing in the Union must comply, regardless of the company’s other global locations.

How will it impact the clinical trials industry?

	The increasing use of the internet, electronic records, and the advancement of clinical trial technologies enabling the collection and use of data, has no doubt played a part in the need for new regulations. Big data is becoming increasingly important in clinical research, which also poses new challenges for data security and privacy.

	Clinical trial data is considered a “special” data category whereby processing is necessary for scientific or research purposes. The data subject gives their explicit consent for the collection of these categories of data.

 When a volunteer, patient, or subject signs the informed consent it will clearly state what data is being collected and why. This special data category negates the subject’s right to erasure, or portability which makes sense as clinical data cannot be removed from the dataset without an audit trail as well as that changing the statistical trial outcome.  Subjects can only leave a trial to prevent additional data collection.

	The GDPR aims to strengthen the rights of individuals to be better informed about how their data is to be used and sets out clearer responsibilities and obligations on healthcare professionals and companies using such data. Transparency, security, and the accountability of Data Controllers is paramount. Clinical trial providers must identify the data that is being processed, where it is transferred to, who processes the data, what it used for, any risks and processes, and ensure all employees are trained.

	Many of the responsibilities and obligations defined by GDPR are not new for companies in the Clinical Research sector, including that of consent. Within GDPR, the conditions for consent have been strengthened-most notable is that any request for consent must be given in a clear, intelligible, and easily accessible form, with the purpose for data processing attached to that consent. Consent must be distinguishable from other matters and use plain language. It must be as easy to withdraw consent as it is to give it. The clinical trial world already lives and breathes by informed consent. Going forward, however, clinical trial organizations must ensure that any informed consent document clearly states the intended logistics of any data collected.

	For clinical trial providers, the new regulations not only cover those participating in clinical trials, but also employees, customers, and subcontractors. A clinical trial provider is a processer from a customer perspective but also a controller of data in terms of personnel, sales, and sub-contractors. As a consequence, clinical trial companies have obligations to make sure that rules are in place and followed.

	For clinical trial operators, data impact assessments will be crucial, for both electronic and hard copy data. Comparable to risk assessments for a data stream, it should cover what the data is used for, how it is managed, and what action is needed. There is also a defined role within the GDPR called the Data Protection Officer-a named person within the organization, registered with the data protection authorities in specific territories. This individual acts as the interface between organizations and the company and would be involved if there are any data breaches.

	Another crucial part of the GDPR for clinical trials is the concept of pseudonymization and anonymization. The GDPR defines pseudonymization as “the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information.” Therefore, any pseudonymized data that could still be attributed to a trial participant using other information will be considered personal data. The terms should be distinguished in trial protocols, as only the anonymization of data will ensure that the data is no longer considered to be personal data.

	There will be no transitional period--now is the time for pharmaceutical companies and CROs to ensure that future clinical trials are compliant and avoid any requirement to make retrospective amendments to consent forms and other clinical trial documentation. Companies need to ensure that their internal policies are aligned with the regulations defined in GDPR and have a plan ready. Only a small percentage of companies are ready for GDPR and with significant penalties for non-compliance, let alone the cost and impact on trial progress, it is essential to identify trusted partners to ensure clinical trials are executed to the latest regulatory standards and the highest quality.

https://www.viedoc.com/site/assets/files/1323/preparing_for_the_eu_gdpr_in_clinical_and_biomedical_research.pdf

http://www.elexica.com/en/legal-topics/life-sciences-regulatory/150617-planning-ahead-the-impact-of-the-gdpr-on-clinical-trials-in-the-eu

 is the VP of Quality and Regulatory at CRF Health 

The EU General Data Protection Regulation is the most important change in data privacy regulation in 20 years.

Greg Gogates

Articles

When Should the Audit Trail Begin?

How Does GDPR Affect Clinical Trials?