Greg Gogates

The recent evolution within the pharmaceutical industry to the use of technologies associated with clinical trial data collection and storage is quite impressive. Even the risk-averse clinical trial sites are now comfortable departing from recording clinical trial data on pieces of paper to the use of technology-driven data collection solutions. As a result, new requirements must be put in place to ensure data quality and integrity (DQI). At the same time we must avoid adding new complexities to the clinical trial paradigm that attempt to solve problems that do not exist. We suggest referencing an article entitled "When Should the Audit Trail Begin? co-authored by the eClinical Forum, published in 2021, as a particularly good start.

 The article addresses issues such as evaluating software that has the capability to track keystrokes prior to hitting “submit” in an electronic data capture (EDC) system. The authors concluded that if companies or regulators would recommend this as a requirement, it would add additional workflow data for analysis without any proof of value to DQI, or the ability to address any perceived malfeasance. What all this means is that we have be cautious when instituting any new quality associated technology so as not to add requirements/features just because we can. The pharmaceutical industry and regulators must also not use paper-based processes as gold standards as they critically review the root reasons behind any new rules. Any new rules must be clearly documented why they are indeed necessary and how they add to DQI.

The historical record of writing things down started around 3100 BCE when people started to write on clay tablets.

 Around 3000 BCE, the Egyptians begin writing and painting on papyrus, a material prepared from the stem of the water plant Cyperus papyrus. Ordinary leather in the form of parchment began to be used for writing around 2500 BCE. During the second century BCE, a better form of parchment was introduced such that both sides could be written on, but it was not until 400 years later that parchment rivaled papyrus. According to Chinese tradition, paper as we know it today was invented in the year 105 CE by Cai Lun, a eunuch who resided at the imperial court. Fragments of this paper product, made from rags and the fibers of mulberry, laurel and Chinese grass, are currently available in museums. Nevertheless, parchment was the standard writing surface for European scribes up and until the 15th century. Historically, for the Jewish bible, a Torah or biblical scroll could only be written on parchment from the skin of a kosher animal, and the five pages of the U.S. Constitution as well as the Declaration of Independence, the Bill of Rights, and the Articles of Confederation were all written on parchment.

A detailed summary of clinical trials that were conducted between 562 BCE and 1537 was published in 2010.

 It should be noted that during these early times there were no regulators other than kings and curious researchers, and no papyrus or parchment records were being checked by clinical research associates (CRAs). According to the article, the world's first clinical trial is recorded in the Bible’s “Book of Daniel.” This experiment was conducted by King Nebuchadnezzar of Babylon who conquered Jerusalem in 586 BCE and destroyed the Jewish Temple. During his rule, there was a time when all subjects were ordered to eat only meat and drink only wine to keep them in sound physical condition. However, when several of the king’s relatives who preferred to eat vegetables objected, the king allowed them just to eat legumes and drink water for 10 days. When the experiment ended and those eating vegetables appeared better nourished than the “meat-eating controls,” the king graciously permitted the vegetarians to continue on their diet. According to the article, this may have been the first time in the evolution of humans that an open-label clinical trial guided a public health decision.

More recently, the first “controlled” clinical trial was performed by Dr. James Lind (1716-1794), who while working as a ship’s surgeon, was appalled by the high incidence and mortality of scurvy amongst sailors. As a result, he planned and executed a comparative trial of the most promising cures for scurvy. His insightful and vivid description of the trial covers the essential elements of a controlled clinical trial. Dr James Lind's “Treatise on Scurvy” was published in Edinburgh, Scotland in 1753.

Early computers had a type of disk storage composed of a thin and flexible disk using magnetic technology. The original “floppies” stored 384K of data. Later, 720K (double-density) and 1.44MB (high-density) disks were developed. In the mid-80’s, Dr. Fred Wolfe’s rheumatology clinical research unit in Wichita, Kansas had electronic records stored on a computer with backups on floppy disks. Dr. Wolfe had a plan to ship the floppy disks directly to the data management department for processing at the pharmaceutical company where the senior author of this article was running the clinical trial. This could have been the beginning of direct data capture and the elimination of source data verification (SDV). Unfortunately, the idea did not gain acceptance and was abandoned.

Evolution of paper-based data collection in clinical trials

Until the onset of the use of EDC systems in the 1990’s, clinical trial case report forms (CRFs) were composed of three-part NCR (no carbon required) paper with the original copy remaining at the site, and the other copies submitted to the sponsoring pharmaceutical company. The capture of clinical trial data directly onto the paper CRFs was not permitted. Instead, an independent original source record was to be maintained at the clinical research site and the basic function of the CRAs at the “site visit” was to compare the precision and accuracy of the CRF data transcribed from a source record onto a paper CRF, a process defined as source data verification (SDV). In order to complete the data validation process, the paper CRFs were then sent to the pharmaceutical company for data entry into the study database by two separate individuals, a process known as double-key data entry. These data were then compared and any inconsistencies resolved.

Once EDC systems were introduced, paper CRFs were eliminated, and data entry into the study database was shifted to the clinical research sites. This process did not change the SDV workflow as it was still no longer certain that site staff always entered the data accurately into the EDC system. While the data within the databases of the EDC systems could have been used as source data, it was not initially accepted that data entered directly into EDC systems could replace the “source” and “transcribed copy procedures” adopted during the use of paper CRFs.

Figure 1: EDC data workflow when paper source records are used

The transition to direct data capture and eSource technologies

In 2011, a study evaluated the effects of SDV on the mean and standard deviation values of five variables when using an EDC system together with paper-based source records.

 The protocol was for a new treatment in men with lower urinary tract symptoms associated with benign prostatic hyperplasia. Data were collected from 566 subjects who signed informed consent and from 492 of these same subjects who were subsequently randomized. Results showed that post data validation, there were virtually no differences in mean values of the five key variables and a very minor decrease in the standard deviations.

In 2012, in lieu of initially capturing all source data using paper records, a US-based clinical trial evaluating the pharmacokinetics of a topically applied drug product allowed the clinical site to use direct data entry (DDE) into an EDC system at the time of the clinic visit.

 The clinical research team also implemented a risk-based monitoring (RBM) plan which defined the scope of SDV 1) if paper records were used, 2) the frequency and scope of online data review, 3) the role of centralized statistical monitoring (CSM) and 4) the criteria for when to perform in-person monitoring at the clinical research site. As a result of this novel approach to clinical research operations, there were1) no protocol violations as screening errors were identified prior to randomization, 2) minimal transcription errors as very few paper source records were used, and 3) major reductions in onsite monitoring tasks compared to comparable studies that used paper as source records. As needed, EDC edit checks were modified early in the course of the clinical trial, and compliance issues were identified in real time and corrected. From the safety perspective, there was rapid transparency and detection of safety issues. The clinical research site estimated that just in terms of data entry, it was able to save 70 hours of labor by eliminating paper as the original source records. The article concluded that when DDE and RBM are properly implemented, there could be major increases in productivity for both sponsors, clinical sites, and CROs, as well as reduced times to database lock and the statistical analyses.

Figure 2: Direct data entry/eSource workflow

In terms of the impact on query generation, an article published in 2014 reported the results of study that evaluated the use DDE at the time of the patient encounter on the effect of the query effectiveness ratio (QER), defined as the ratio of the number of queries leading to change divided by the total number of queries issued.

 The study looked at 38,207 forms in a phase 2 study for the treatment of migraine. Results showed that of the 1,397 (3.7%) of forms that were queried, only 782 (2.0%) forms required changes to the database. Of these changes, 294 (37.6%) were in the concomitant medication forms and none of the changes had any impact on the study results.

Traditionally, the major roles of the CRAs were to train the clinical sites on the steps needed to execute the clinical trial and then to assess, via SDV, how the clinical sites could accurately transcribe data from paper source records onto paper CRFs. Data management wrote programs to look at logical errors and inconsistencies among and between forms, and communicated these issues directly to the CRAs or via a query directly to the clinical research site. The number of data entry errors was often used as the main metric to see how well a site was executing the study. As a result, this approach focused more on process conformance rather than on protocol compliance. Unfortunately, due to this manual effort, by the time an error was identified by the CRAs or data management, the same error could have been repeated multiple times due to the time between data entry by the site and monitoring by the CRAs.

Currently with the application of DDE in various software solutions including EDC, Electronic Patient Reported Outcomes (ePRO), Electronic Clinical Outcome Assessment (eCOA), Electronic Informed Consent (eICF), Mobile Medical Devices, etc., there is no need to question the data as the system validation efforts at the time of data capture assure the data integrity. Real-time remote monitoring by CRAs and data managers can now focus on 1) protocol compliance, 2) illogical results/outliers, 3) high risk issues related to safety and efficacy endpoints, and 4) evaluation of potential protocol deviations and violations. As a result, DDE logic errors that are systemic and not user specific can be corrected rapidly and communicated to those performing data entry. It is also now possible to evaluate the performance of the CRAs in detecting issues.

However, if debunking “accuracy” is no longer highly critical in the data validation process as one usually assumes, then what is? The recently published ICH E8(R1) emphases the need for “completeness (lack of missing information)” and “consistency (uniformity of ascertainment over time).”

 Thus, it is reasonable to expect that narrow-focused / accuracy-specific edit checks will play a lesser role over time, while at the same time, the part of aggregate (“across subject”) and complex statistical checks will expand. Data management and clinical operations professionals should not only be ready for this paradigm shift, but lead the transition. This advancement will demand a shift in perception and processes and equally importantly, the development of new skills. Let us now recognize that “Data Science” is no longer exclusively the domain of statisticians, but is now associated with all clinical research operations dealing with data collection, validation, and monitoring.

It is now time to follow the new definition of Data Quality documented by the Clinical Trials Transformation Initiative (CTTI), and redesign the data validation processes from eliminating all errors to the elimination of errors that matter to decision making. It is also time to focus on potential errors which have a meaningful impact on the safety of trial participants, the credibility of the results and the potential impact on the future care of patients.

Technology is providing major contributions to the execution of clinical trials and has assisted in the improvement of DQI. However, there are still major challenges ahead to increase efficiencies, avoid redundancies, and ensure compliance with all aspects associated with data capture, data transfer and final reporting. The creation of lean documented processes and procedures will enable technology and human interactions to expedite clinical development, while at the same time protect the data and the basic principles that govern quality as documented in existing regulations.

With the implementation of DDE, RBM and technology solutions, we can now early in a clinical trial identify potential risks to the patients and to the study itself. Real time risk mitigation strategies must address those risks that are most critical for the evaluation of the safety and efficacy profile of the drug or device under study. Regulators can now shift their focus from how well a data point is transcribed from one medium to another, to issues that could put patients/study participants at risk and compromise the clinical trial outcome, such as lack of protocol compliance, incompetent or unscrupulous investigators and biased sponsors. It is now time to also avoid the profound effects on patients and sponsoring companies where studies fail due to lack of quality rather than lack of efficacy.

., is the President and CEO of THI Pharma Services Inc.

, BS, is the President and CEO of Fasor Technical Services, Inc.

, BE, is the Regulatory Affairs Manager for Videoc Technologies.

, MS., is the Faculty / Program Coordinator / Senior Lecturer, MS in Regulatory Science & Food Safety Regulation Programs, at Johns Hopkins University.

Sr. Director, Data Quality Science and Programming, at BioMarin Pharmaceuticals, Inc.

Mitchel, J., Sugiura, Y., Arnera, V. et al. 

When Should the Audit Trail Begin? Applied Clinical Trials

Papyrus: A Brief History – Dartmouth Ancient Books Lab

Evolution of Clinical Research: A History Before and Beyond James Lind. Perspectives in Clinical Research

Evaluation of Data Entry Errors and Data Changes to an Electronic Data Capture Clinical Trial Database

. Drug Information Journal, Vol. 45, pp. 421–430, 2011.

Mitchel, J., Schloss Markowitz, JM, Hua (Helen) Yin, et

. Lessons Learned from a Direct Data Entry Phase 2 Clinical Trial Under a US Investigational New Drug Application

. Drug Information Journal 46(4) 464-471 2012.

. Query Effectiveness in Light of Risk-based Monitoring (RBM). Data Basics Winter

Time to Change the Clinical Trial Monitoring Paradigm. Applied Clinical Trials

ICH E8 (R1) GENERAL CONSIDERATIONS FOR CLINICAL STUDIES 

https://database.ich.org/sites/default/files/E8-R1_Guideline_Step4_2021_1006.pdf

CTTI’s QbD Project. Recommendations available at: 

https://tracs.unc.edu/docs/regulatory/CTTI_Recommendations-Quality_by_Design.pdf

Articles

New requirements must be put in place to ensure data quality and integrity.

The Transformation of Clinical Trials from Writing on Papyrus to the World of Technology

When audit trails are used in any business process, whether it be in pharmaceutical clinical research, stock market trading or banking, it creates a step-by-step record by which data can be traced to its source. An audit trail is most often utilized when the accuracy of a data element needs to be verified or when a record of changes made to original, or source data is required. Not all data have the same level of criticality. For example, in a clinical trial, the significance of tracking data changes may depend on the nature of critical variables such as those affecting randomization, as well as compliance with inclusion and exclusion criteria. For example, it would be unacceptable for a data field to be changed in order to make an ineligible subject eligible without full visibility and documentation to allow assessment by those monitoring the study.

This article addresses and discusses the regulatory history behind audit trails and its interpretation as it relates to clinical research data originating or residing in EDC or eCOA systems.

, the FDA published the Final Rule on Electronic Records; Electronic Signatures as related to 21 CFR Part 11. As part of the discussion, it was stated in comment 72 on page 13446 that: “§11.10(e) would require the use of time-stamped audit trails to document record changes, all write-to file operations, and to independently record the date and time of operator entries and actions.”

It was also stated that: “…record changes must not obscure previously recorded information and such audit trail documentation must be retained for a period at least as long as required for the subject electronic documents and must be available for agency review and copying.” “As many comments objected to the proposed requirement that all write-to file operations be documented in the audit trail…”, FDA noted that it is the “…agency’s intent that the audit trail provide a record of essentially who did what, wrote what, and when.”

Although FDA acknowledged that “…not every operator ‘action’, such as switching among screen displays, need be covered by audit trails, the agency was concerned that revising the rule to cover only ‘critical’ operations would result in excluding much information and actions that are necessary to document events thoroughly.” “The agency intended that the audit trail capture operator actions and operator information at the time the information is saved to the recording media (such as disk or tape), in much the same manner as such actions and information are memorialized on paper.” FDA noted that the “…audit trail need not capture every keystroke and mistake that is held in a temporary buffer before those commitments. For example, where an operator records the lot number of an ingredient by typing the lot number, followed by the ‘return key’ (where pressing the return key would cause the information to be saved to a disk file), 

the audit trail need not record every ‘backspace delete’ key the operator may have previously pressed to correct a typing error

” FDA added, that “…subsequent ‘saved’ corrections made after such a commitment, must be part of the audit trail.” Accordingly, the FDA revised proposed § 11.10(e) “…by removing reference to all write-to-file operations and clarifying that the audit trail is to cover operator entries and actions that create, modify, or delete electronic records.”

, the EMA published a Reflection paper on expectations for electronic source data and data transcribed to electronic data collection tools in clinical trials and stated that: “The audit trail starts with the initial entry of the data.”

, the FDA Guidance for Industry, entitled: “Electronic Source Data in Clinical Investigations” defined an audit trail as: “A process that captures details such as additions, deletions, or alterations of information in an electronic record without obscuring the original record. An audit trail facilitates the reconstruction of the course of such details relating to the electronic record.” "§III.A.2.e. Transmission of Data From Patient-Reported Outcome (PRO) Instruments to the eCRF. When a PRO instrument is used by a subject to transmit data elements directly to the eCRF, the subject is the data originator and the eCRF is the source. If a process is used by which the subject uses the instrument to transmit data to a technology service provider database, the 

, the Medicines & Healthcare Products Regulatory Agency (MHRA) ‘GXP’ Data Integrity Guidance and Definitions stated that: “The audit trail is a form of metadata containing information associated with actions that relate to the creation, modification or deletion of GXP records. An audit trail provides for secure recording of life-cycle details such as creation, additions, deletions, or alterations of information in a record, either paper or electronic, without obscuring or overwriting the original record. An audit trail facilitates the reconstruction of the history of such events relating to the record regardless of its medium, including the ‘who, what, when and why’ of the action. Where computerized systems are used to capture, process, report, store or archive raw data electronically, system design should always provide for the retention of audit trails to show all changes to, or deletion of data while retaining previous and original data. It should be possible to associate all data and changes to data with the persons making those changes, and changes should be dated, and time stamped (time and time zone where applicable). The reason for any change, should also be recorded. The items included in the audit trail should be those of relevance to permit reconstruction of the process or activity. The relevance of data retained in audit trails should be considered by the organization to permit robust data review/verification.” 

“It is not necessary for audit trail review to include every system activity (e.g., user log on/off, keystrokes etc.).”

We believe, that unless there is a clear need to collect keystroke data, any data collected prior to clicking on the SUBMIT/SAVE keys serves no purpose. Analysis of these data also would be complex and adds no value to the study, the study record, or the audit trail. 

While the definition of an audit trail is very clear, there appears to be some confusion about the definition of an original or source record in the digital world. We believe the data entered 

 clicking on SUBMIT or SAVE are the source, except for a very few cases: 1) where there are other original records such as data originally collected as a paper record, or 2) where the ability to type accurately (or speak clearly) is a variable to be measured according to the study protocol, or the natural characteristics of end point data. Conversely, we do not see value for clinical research, in assessing data quality in data that includes erroneous keystrokes as source, such as data that would be collected before the user has corrected unintentional errors and before the user clicks SUBMIT or SAVE. 

Edit checks can also affect audit trail retention. Edit checks on end user devices should only catch obvious user errors. These are flagged and the user has the opportunity to correct “immediately” before going forward, and no audit trail is necessary as this is simply automated mistake correction. 

However, there are situations where an immediate edit check should not be used, and instead edit checks that fire after the data have been submitted can be used to alert site staff of anomalies that should be investigated. 

All changes made after the data have been submitted must be captured in the audit trail.

While we do not recommend saving pre-submit keystroke data, we do recommend that the source of the data that is transmitted to the clinical research database is properly attributed. The audit trail functionality of the eCOA devices (mobile phones, tablets, Internet of Medical Things (IoMT), and web browsers) used in clinical trials should be aligned with the regulatory agency’s descriptions noted above, as well as industry standard practices. 

We recommend that at the time of data entry into an electronic system that supports a clinical trial such as EDC and/or eCOA, two additional metadata should be collected: the data source and the data originator. Examples of a data source are direct data capture, paper record, EHR etc. Examples of data originators are the clinician who did the physical exam or the study coordinator who did the interview. A data originator for an eCOA questionnaire, whether using a dedicated device or a website, is the person logging in with his/her username and password, as it is assumed that data entry will be performed by that person (regardless of if this is the study subject or authorized designee/caregiver, such as a parent in a study of pediatric patients).

For eCOA users, the data source or data originator is usually very clear in the system and in the audit trail. There is also no need for source data verification (SDV) against the eCOA device, as there is only one copy. The devices essentially acquire data from study subjects in real time, temporarily store the data within the application, and then eventually pass the data to the centralized database as a completed task. Changes made to entries prior to submitting the record being created by the data originator, can be considered draft data, held in temporary storage until that point in time when the user acknowledges their entry is complete, and then consciously saves the record and submits it for transmission. This is analogous to completing a draft paper form prior to signing the record. 

Thus, the audit trail for eCOA devices used in clinical trials begins at the time data is committed to permanent storage in the main eCOA database, similar to authenticating a paper form at the time of signing.

It is important that each company is clear on when the audit trail begins for their EDC and eCOA systems. We recommend that they perform a risk assessment regarding the value of saving keystroke data prior to a save/transmit transaction. The protocol or other document (such as the Data Management Plan) should include this information.

All of us can hit wrong keys when entering data using a keyboard/touchscreen or when we observe voice transcription errors. Unless there is a clear need to collect keystroke data, any data collected prior to clicking on the SUBMIT/SAVE keys serves no purpose. Analysis of these data also would be complex and adds no value to the study, the study record, or the audit trail. 

To properly attribute source data, two additional metadata need to be collected at the time of data entry: the data source and the data originator.

Finally, to be clear as to when the audit trail begins, it is recommended that each company perform a risk assessment regarding the audit trail value of keystroke data and data entered prior to a save/transmit transaction. It is also recommended to put this information into the protocol or other document such as the Data Management Plan (DMP). And finally, when in doubt, share the plan with regulators and obtain their agreement.

Members of the eClinical Forum Regulatory Advisory Group: 

 is the Co-Founder of Target Health, US. 

 is the Associate Director of Global Data Management & Centralized Monitoring for Bristol Myers Squibb, Japan. 

, MD, is a Scientific Advisor for ERT, Switzerland. 

 is the Vice President of Quality/Regulatory for Fasor, US. 

 is a Quality Manager for Viedoc Technologies, Sweden. 

 is a Senior Director, Data Integrity Quality Assurance for Astellas Pharma Global Development, US. 

 is the Americas Administrator for eClinical Forum.

21 CFR Electronic Records; Electronic Signatures – Final Rule

Reflection Paper On Expectations For Electronic Source Data and Data Transcribed to Electronic Data Collection Tools in Clinical Trials

Electronic Source Data in Clinical Investigations

GXP’ Data Integrity Guidance and Definitions

A discussion of the regulatory history behind audit trails and its interpretation as it relates to clinical research data originating or residing in EDC or eCOA systems.

When Should the Audit Trail Begin?

	The European Union (EU) General Data Protection Regulation (GDPR) is the most important change in data privacy regulation in 20 years. The regulations can be enforced from May 25, 2018, at which time any organization which does not comply may face heavy fines. The GDPR (

) replaces the Data Protection Directive 95/46/EC, designed to harmonize data privacy laws across Europe, to protect and empower all EU citizens data privacy, and to reshape the way organizations across the region approach data privacy.

	Certain key changes fall under different categories (see The GDPR key changes 

	· Increased Territorial Scope (extra-territorial applicability)

	The aim of the GDPR is to standardize and strengthen the protection of personal data across the EU and for other country’s data being “processed” within the EU. As such, this is an issue for all to take note, not just those based in Europe. Under the new regulations, all company processing of the personal data of subjects residing in the Union must comply, regardless of the company’s other global locations.

How will it impact the clinical trials industry?

	The increasing use of the internet, electronic records, and the advancement of clinical trial technologies enabling the collection and use of data, has no doubt played a part in the need for new regulations. Big data is becoming increasingly important in clinical research, which also poses new challenges for data security and privacy.

	Clinical trial data is considered a “special” data category whereby processing is necessary for scientific or research purposes. The data subject gives their explicit consent for the collection of these categories of data.

 When a volunteer, patient, or subject signs the informed consent it will clearly state what data is being collected and why. This special data category negates the subject’s right to erasure, or portability which makes sense as clinical data cannot be removed from the dataset without an audit trail as well as that changing the statistical trial outcome.  Subjects can only leave a trial to prevent additional data collection.

	The GDPR aims to strengthen the rights of individuals to be better informed about how their data is to be used and sets out clearer responsibilities and obligations on healthcare professionals and companies using such data. Transparency, security, and the accountability of Data Controllers is paramount. Clinical trial providers must identify the data that is being processed, where it is transferred to, who processes the data, what it used for, any risks and processes, and ensure all employees are trained.

	Many of the responsibilities and obligations defined by GDPR are not new for companies in the Clinical Research sector, including that of consent. Within GDPR, the conditions for consent have been strengthened-most notable is that any request for consent must be given in a clear, intelligible, and easily accessible form, with the purpose for data processing attached to that consent. Consent must be distinguishable from other matters and use plain language. It must be as easy to withdraw consent as it is to give it. The clinical trial world already lives and breathes by informed consent. Going forward, however, clinical trial organizations must ensure that any informed consent document clearly states the intended logistics of any data collected.

	For clinical trial providers, the new regulations not only cover those participating in clinical trials, but also employees, customers, and subcontractors. A clinical trial provider is a processer from a customer perspective but also a controller of data in terms of personnel, sales, and sub-contractors. As a consequence, clinical trial companies have obligations to make sure that rules are in place and followed.

	For clinical trial operators, data impact assessments will be crucial, for both electronic and hard copy data. Comparable to risk assessments for a data stream, it should cover what the data is used for, how it is managed, and what action is needed. There is also a defined role within the GDPR called the Data Protection Officer-a named person within the organization, registered with the data protection authorities in specific territories. This individual acts as the interface between organizations and the company and would be involved if there are any data breaches.

	Another crucial part of the GDPR for clinical trials is the concept of pseudonymization and anonymization. The GDPR defines pseudonymization as “the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information.” Therefore, any pseudonymized data that could still be attributed to a trial participant using other information will be considered personal data. The terms should be distinguished in trial protocols, as only the anonymization of data will ensure that the data is no longer considered to be personal data.

	There will be no transitional period--now is the time for pharmaceutical companies and CROs to ensure that future clinical trials are compliant and avoid any requirement to make retrospective amendments to consent forms and other clinical trial documentation. Companies need to ensure that their internal policies are aligned with the regulations defined in GDPR and have a plan ready. Only a small percentage of companies are ready for GDPR and with significant penalties for non-compliance, let alone the cost and impact on trial progress, it is essential to identify trusted partners to ensure clinical trials are executed to the latest regulatory standards and the highest quality.

https://www.viedoc.com/site/assets/files/1323/preparing_for_the_eu_gdpr_in_clinical_and_biomedical_research.pdf

http://www.elexica.com/en/legal-topics/life-sciences-regulatory/150617-planning-ahead-the-impact-of-the-gdpr-on-clinical-trials-in-the-eu

 is the VP of Quality and Regulatory at CRF Health 

The EU General Data Protection Regulation is the most important change in data privacy regulation in 20 years.

Greg Gogates

Articles

The Transformation of Clinical Trials from Writing on Papyrus to the World of Technology

When Should the Audit Trail Begin?

How Does GDPR Affect Clinical Trials?