Tom Haag

The introduction of mobile devices and software as a service (SaaS) into the conduct of clinical trials makes many of us in the clinical quality assurance (CQA) community unsettled. Even today, many CQA professionals, and some regulatory inspectors, do not feel comfortable or confident in the digital data environment having come of age in the world of three-part paper case report forms, hand-written logs, and hand-signed documents. Still, many of us feel our greatest competence lies in our knowledge and interpretation of the established predicate rules, International Conference on Harmonisation (ICH)-good clinical practice (GCP), which we generally view as completely independent of technology.

	Consequently, two phenomena frequently manifest:

		A highly conservative "this is not permitted" reaction toward digital technologies when they are proposed.

		A "refer this to the validation/eCompliance group" reaction to regulatory application in the operational sphere when a computer system is involved, however tangentially.

	While other heavily regulated industries have adopted modern, digital tools, clinical trials often remain technologically challenged because of these attitudes and perceptions.

	Both reactions are unnecessary and result in self-imposed barriers to the successful adoption of key digital technologies in the clinical trial context. Both also indicate a very real need to provide clinical QA professionals with a truly comprehensive and comprehensible framework within which to apply their hard-won predicate rule knowledge and experience. Indeed, applying existing rules and principles to new media should not impede the compliant adoption of new technologies.

	In truth, current electronic records, electronic signatures (ERES) regulation, and the predicate rules themselves need offer no significant barriers to the application of advancing technologies, including such advances as web-based tools and mobile devices, in the collection, processing, interpretation, publication, or archiving of clinical trial data. In fact, ERES regulations are written at such a high level that they can afford us measured choices in how to meet these principles in multiple ways.

	At the heart of both ERES regulation and the predicate rules is this: What both industry and regulators want are data that are complete, correct, and forensically verifiable throughout their lifecycle.

	Part 11 encapsulates this central concern in its definition of the objectives for computerized system validation (21 CFR 11.10 (a)):

		Ensure accuracy, reliability, and consistent intended performance.

		The ability to discern invalid or altered records.

	These are the two central pillars of data integrity. The detailed requirements of the 21 CFR Part 11 elaborate for us the pragmatic yet high level measures required to attain and maintain these two central pillars. Indeed, these, along with the protection of the health, safety, and rights of patients and clinical trial subjects, are also really the central pillars of much of the GCP itself.

	Applying and adhering to these key principles is entirely achievable under the current regulations. Doing so will consistently satisfy regulators, even when one is adopting very new technologies, and will also continue to be simply good business. However, to accomplish this, a new and reimagined framework for applying the regulations is required.

	This reimagined framework, beyond the paper paradigm, is data stewardship.

	As a term, data stewardship is not a radically new concept. Perhaps most relevantly the term was invoked by Karen S. Baker and Lynn Yarmey in their 2009 article, 

Data Stewardship: Environmental Data Curation and a Web-of-Repositories.

 The authors addressed the topic in the context of the need to appropriately safeguard and preserve academic scientific research data gathered in the field and destined to move across multiple forums, technology systems, and potentially a variety of uses from public to private and commercial. Drawing on the concept of “stewardship” in land use and in the work of ecologists, Baker and Yarmey framed data stewardship this way:

Stewardship is a term that involves tending a community element not owned solely by one person.”

	In their framing of data stewardship, the authors note the press of many of the same major technological changes we are experiencing in the clinical research environment:

“The advent of new measurement capabilities (e.g., autonomous vehicles and streaming technology), the increasing recognition of the value of long-term sampling strategies (e.g., time-series measurements and interdisciplinary studies) and the importance of data-sharing initiatives (e.g., master catalogues and interoperability efforts) all create unfamiliar data arrangements requiring identification of, and agreement on, new categories and descriptive standards, as well as expanded dynamic infrastructures for both local and large-scale data endeavors.

Data stewardship provides a conceptual framework for envisioning the flow of data amongst and between arenas. It provides an entrée to the notion of collective practices.” 

	This parallel in experience between the academic field research arena and the clinical research arena should not be surprising and the applicability of data stewardship in our GCP environment where responsibility for data also ranges across a very wide swath of actors, technologies, systems, infrastructures, and even potentially ultimate-end applications.

	Stewardship for clinical trial data is a relevant topic for sponsors, health authorities, technology suppliers, and data management organizations. These stakeholders, along with the clinicians who collect clinical data, are the intended audience for this document. They are Clinical Data Stewards.

	The term “data stewardship” implies an ethical obligation not necessarily bound or defined by ownership alone. Whoever one judges to be the “owner” of the data collected, clinical data are collected from patients for the ultimate benefit of patients in both safety and efficacy. This is the first principle and foundation of data stewardship. From the first moment of data collection, data stewards share the custody of that data and a profound responsibility for maintaining its integrity. Similar to a familial context, custody is not necessarily the responsibility of a single party. It is often a shared responsibility defined within the construct of legal agreements.

	But shared custody is still real custody, and the shared responsibilities between sponsors, health authorities, and data management organizations have always been there. Out of respect for the owners of the data, this article is intended to clarify the roles, responsibilities and expectations for ethical handling of patient data collected in a clinical trial. It also suggests that a holistic understanding of the generation, management, and review of clinical data is necessary to promote effective data stewardship.

	Data stewardship is a phrase specifically used in this article to guide the responsible parties that handle data during clinical trials. The research and development community consistently encounters new technologies, regulatory guidance, and organizational paradigms that affect the way clinical data is handled. These changes affect the operational models that govern the design, conduct, and reporting for clinical trials, and leave the interpretation and implementation up to the data stewards.

	For these data stewards, each new organizational change, each new internal business process that is re-engineered, each new regulatory opinion that is published, and each new data collection system introduced to market can and does disrupt the status quo. While these disruptive changes can be successful and immediate, they still disrupt the clinical trial landscape.

	Disruption has the potential to affect all data stewards. Any novelty, innovation, or streamlining can be daunting to what has been traditionally (and necessarily) a conservative and herculean endeavor for the research and development community. But if the novelty enhances data integrity by enabling more straightforward implementation of technology, if it makes data entry more intuitive and less burdensome for investigators and patients, or if it increases compliance to protocol and regulations, then the novelty can be considered true innovation to the clinical trial process. The disruption can be considered a positive one.

	Good old-fashioned communication and contracts between the sponsor, the investigator, and the technology providers should provide clarity and establish boundaries for who handles the data along the clinical data chain-of-custody. Strong partnership with well-defined lines of communication is a key driver for successful data stewardship.

	Internal organizational change (for all data stewards) often results in shifts with respect to internal data stewardship roles; so while it is important to establish shared responsibility between organizational entities external to each other, it is equally important to ensure that the chain-of-custody is well understood by each internal party as well.

	For instance, a sponsor’s IT department may provide technology and validation support, but true stewardship is the responsibility of the business process owner. Sponsor quality assurance can only reflect, and not resolve, problems in this area. If the owner cannot answer questions about data integrity, then CQA has a challenge to educate them.

	Sponsor efforts to be leaner, less bureaucratic, and more automated often cause a loss of institutional memory about systems and processes. While there is a chain-of-custody model to be established between sponsor, investigator, and data management (including technology providers), sponsors have unique challenges to maintain a strong sense of internal stewardship between business, QA, and IT. Sponsors who embrace data stewardship internally can expect healthier relationships with their suppliers as well as with health authorities.

	Health authorities are data stewards, as they serve their respective publics and are responsible for public safety. Perhaps this is stating the obvious, but they face unique challenges as well. Health authorities are clearly challenged by the ever-advancing transition from the paper-based clinical trial landscape to the modern technologies that support digital clinical trials. They have to abandon the illusion of stronger custody where paper is the first point of data collection, and accept that well-implemented systems can effectively accelerate and improve the paper process.

	Health authorities are also challenged to modernize their perspective on risk and to better communicate across jurisdictions and with other data stewards. Published guidance from different agencies and locations do not always coincide perfectly on paper; resources are constrained to the point that they cannot be everywhere-at-once, and they need to take care to not be so prescriptive that their guidance becomes a constraint to innovation.

	Technology providers, data management organizations, and contract research organization (CROs) get the fun part of the job, as they are most poised to introduce novelty and innovation to the process landscape, and their business success largely depends upon it. One reason is these suppliers are simply more nimble than sponsors and health authorities. They can rapidly develop systems and are typically not encumbered by 10-year R&D timelines. While they are at the mercy of the sponsor (as much as the sponsor is at the mercy of the health authorities), they have opportunities to innovate by designing compliance into their solutions.

	If the tech providers can introduce compliant, useful tools that enable data management organizations to leverage the clinical data via efficient and clear processes, then they, too, are data stewards inasmuch as a computerized system and its infrastructure are themselves inextricably connected with the completeness and integrity of the data. This is an emerging ethical and contractual reality we believe is inescapable in the digital world, one clearly defined in the privacy realm by HIPAA for SaaS and infrastructure as a service (IaaS) cloud providers.

	Effective data stewardship creates a paradigm where clinical data can be used to deliver safe and effective therapies to patients, evolve the clinical trial model, and satisfy the needs of the public with greater transparency.

	By recasting the application of ERES regulation and the predicate rules within the framework of data stewardship, it becomes more readily feasible to provide guidance for data stewards by outlining specific responsibilities during key events along the data chain-of-custody. These events start with trial setup and end with database lock.

	Ahead, we discuss the key regulations in more detail to indicate the compatibility and, indeed, clarification and enrichment data stewardship brings to existing regulations and guidance.

	cGCP and ICH both distinguish between the record-keeping responsibilities of the investigator and the sponsor. Broadly speaking, both require the investigator (ICH E6 4.9 /21 CFR 312.62)

 to keep a complete and accurate patient case history and require the sponsor (ICH E6 5.5 /ICH E93.6/21 CFR 312.57) to keep complete, timely, and accurate records directly related to the investigational drug and the conduct of the trial (ICH E9 3.6).

 establishes the sponsor responsibility to ensure investigators will permit "direct access" to source data/documents in order to enable virtual monitoring, audits, and regulatory inspections. It is important to note that in the contemporary digital environment such "direct access" needs to extend well beyond the line-of-sight, scope, and control of investigators through multiple entities, including service and infrastructure providers as well as data sources such as electronic health records.

 looks to render the focus on record-keeping still more specifically by defining the essential trial documents and identifying for each the principal document owner/holder. However, we need to acknowledge that in the digital age, a document, rather than being a discrete physical entity, can actually be one of many potential aggregations of included data that are themselves merely logically assembled, malleable as to association and format, and highly location independent.

	The document is truly a metaphor, a fiction retained mostly for our linguistic convenience, but it is the data content on which we need to focus or the regulation will bring us to ultimately founder on a metaphor rather than adapting to actual reality. Fortunately, the currently proposed Addendum to E6 8.1 uses phrasing that can allow us to more reliably know how to apply the documentation requirements of E6 8.0 in this new digital context, as it opens its focus to more technologically adaptable concepts such as data access and data control. These concepts are, in turn, also relevant and well applicable within the framework of data stewardship.

	As early as the preamble to the original publication of the final rule, FDA has specifically sought to assure industry that 21 CFR Part 11 is meant to enable, not inhibit, the adoption of new technology.

The agency believes that the provisions of the final rule afford firms considerable flexibility while providing a baseline level of confidence that records maintained in accordance with the rule will be of high integrity.

	FDA further went to great lengths to tie 21 CFR Part 11 very explicitly to the predicate rules in their (still in force) 

Guidance for Industry: Part 11 Electronic Records; Electronic Signatures Regulation-Scope and Application

 in which the phrase “predicate rules” is used no less than 34 times in a document of nine pages. At the time this guidance was issued, the agency also stated its belief and apparent intention to revise the Part 11 rule-although the authors believe a close reading shows the agency’s concern was focused on the cGMP application of the rule. In all the subsequent years; however, it is clear the agency and industry have found themselves quite capable of applying the existing rule adequately in the GCP-ICH environment.

	Interestingly, in 2014, Yashashri Shetty and Aafreen A. Saiyed published 

Analysis of warning letters issued by the US Food and Drug Administration to clinical investigators, institutional review boards and sponsors: a retrospective study

, an analysis of warning letter issued to investigators and institutional review boards (IRBs) during 2011 and 2012 and to sponsors during the period from January 2005 to December 2012.

	While their analysis showed that 40% of warning letters issued to investigators and 30% of those issued to sponsors were attributed to failures in recordkeeping-clearly a Part 11 implicated area-they also noted that investigator performance in the maintenance of case histories and the retention and production of records actually appeared to improve when they compared the results of their study to those of previous published analyses. It is precisely the predicate rules pertaining to recordkeeping (case histories, study data, and drug shipment records) where one would expect the preponderance of citations related to Part 11 to be present, yet it was in this area that, at least for investigators, Shetty and Saiyed found evidence of improved performance. It is hard to read this as evidence of problems applying or understanding the electronic records regulation via the predicate rules.

	Of necessity, the GCP regulations have generally left open a significant margin for interpretation by the regulators and industry. Over time, that margin does become somewhat narrowed by practice, as industry defines detailed processes and deliverables that establish lower level regulatory expectations. An example of this would be the document sets and associated practices and processes that now comprise the regulatory expectations associated with the broad regulatory requirement for computerized system validation. Similarly, it is very reasonable to shift the wider GCP/ICH paradigm for existing practice from a document-based framework to a true and genuinely comprehensive data stewardship framework that acknowledges and embraces the chain of custody concept.

FDA Guidance for Industry: Electronic Source Data in Clinical Investigations (2013)

 also displays the agency’s increased awareness of the complexities and nuances that can develop in the interactions among systems and users as “data sources” and “data originators” are carefully defined and delineated entirely contextually. This focus on context and the recognition that a user’s role can shift across multiple systems is an important development. It means the agency is looking to a more fundamental level, always underlying the mere technology strata to enforce the regulated person’s responsibilities. This most recent guidance appears to renew and reinforce the agency’s commitment to Part 11 referenced nine times throughout the new guidance and to technology-agnostic reliance on the predicate rules, a stance that might allow the agency to remain more nimble in the face of the still rapidly evolving electronic records environment.

	As detailed earlier, we can see that the regulations (and FDA guidance) already acknowledge some degree of shared responsibility for data integrity, although only the investigator and the sponsor share the responsibility articulated. In the digital world of contemporary clinical data collection, monitoring, interpretation and archiving a much larger set of actors is usually involved. This includes eClinical vendors, Internet service providers (ISPs), document management systems/providers, and other infrastructure service providers.

	This leads us to a critical question: just who is a data steward?  Some, especially at the infrastructure level, are arguably very far removed from the clinical trial data itself. The answer, we believe, is that even those concerned solely and entirely with infrastructure, are still data stewards within their domain. The reality is that these data never cease being regulated clinical data, and the networks and other virtual infrastructure that comprise the conduits and switches for these data are also integral to their sustained integrity and are 

 links in their chain of custody. Everyone responsible for the environment inhabited by the data as well as operations on or affecting those data are data stewards who must have unambiguous responsibility for the impacts of their actions on the integrity of the data.

	Focusing on data stewardship accomplishes the genuine ends the regulations are intended to achieve, but does so by acknowledging the digital reality, the complex web work within which data are actually collected, maintained, managed, transmitted, shared, and protected in the current electronic environment. In the digital environment, multiple entities have both shared and unique responsibilities for the protection of the data from its production through to its final archival preservation and, ultimately, its destruction. This approach supports attributable, legible, contemporaneous, original, and accurate (ALCOA) principles. Data integrity responsibility can be shared transparently through the entire complex data chain of custody; a "chain" which is far more persistent, a molecular chain of sorts, than it is sequential in the contemporary digital environment.

	Just as computerized system validation has adopted a full life-cycle approach, so, too, must the regulations, as they utilize the comprehensive concept of data stewardship. Data stewards vary somewhat, but largely they are:

		Software developers, including trial-specific application developers

	While the regulation will always place the ultimate responsibility for data integrity with the trial sponsors and principal investigators, it will, likewise, always need to be applied across the highly interconnected entities upon which every sponsor and investigator must rely (to at least some extent) in the digital world. The interpretation of regulation will need to adjust from the old location-dependent paradigm of physical "original" documents to implementation in a world in which the data exist as "original" simultaneously across multiple networks, including often-independent domains (think "Cloud" storage here, as one very significant example).

	When the “original” is a virtual entity, the concept of a “copy” is often problematic. As noted earlier, the newly proposed Addendum to E6 8.1 is a clear shift in this direction, a shift more aligned with the FDA’s 2013 Guidance on eSource.

	As the FDA’s own eSource guidance reflects, the same data can be and often are appropriately represented on multiple systems in novel ways appropriate to a specific stage in the data acquisition, data entry, data management, and data analysis life cycle. These copies are both that-copies, and are still "original" data in a given system. This is a world quite different from that in which multiple entities might receive physical copies of a single multipart form.

	Data stewardship is an approach that can translate the obligations, responsibilities, and intention of the regulation into this more-subtle and complex environment. The paper metaphor regulators have traditionally applied to their interpretations ignores the reality of the technology and hampers the successful assurance of quality and integrity the regulation is meant to ensure.

	This article is a call to action to rethink the entire data "chain" as a full and persistent data life cycle. It endeavors to define data stewardship as a platform. It should inform and encourage data stewards to rethink their mission according to a more modern reality, where adherence to GCP is not only attainable, but also potentially more effective in the digitized world.

Tom Haag is Data Integrity Process Expert, eClinical Quality Assurance, Novartis

 Pharmaceuticals Corporation; Tom Koch is President, Lead Consultant,

Acknowledgements: Grant Simmons, Novartis Pharmaceuticals Corporation; Monica Cahilly, Green Mountain Quality Assurance, LLC; Phil Coran, Medidata Corporation

	1. Baker, Karen S., and Yarmey, Lynn. Data Stewardship: Environmental Data Curation and a Web-of-Repositories

The International Journal of Data Curation

US Code of Federal Regulations Title 21 Part 312

 ICH E8 General Considerations for Clinical Trials

US Code of Federal Regulations Title 21 Part 11

FDA Guidance for Industry: Part 11 Electronic Records; Electronic Signatures Regulation-Scope and Application (2003)

	7. Shetty, Yashashri C., and Saiyed, Aafreen A. Analysis of warning letters issued by the US Food and Drug Administration to clinical investigators, institutional review boards and sponsors: a retrospective study. 

Articles

Amid the push for clinical trials to adopt more modern digital data technologies, the job of assuring adherence to key data quality and integrity principles is achievable under current regulations governing electronic record-keeping. Doing so, however, will require a new and reinvented framework: data stewardship.

Clinical Trial Data Stewardship

There has been a recent thrust within the pharmaceutical industry to promote the transformation of the clinical trial process. In 2008, the Clinical Trial Transformational Initiative (CTTI), a public-private partnership with the FDA, and Duke University, was established to identify practices that, through broad adoption, will increase the quality and efficiency of clinical trials. A major publication by CTTI of monitoring practices has helped to transform the monitoring of clinical trials.

	According to the Food and Drug Administration (FDA) eSource Guidance of 2013: “Electronic source data are data initially recorded in electronic format. They can include information in original records and certified copies of original records of clinical findings, observations, or other activities captured prior to or during a clinical investigation used for reconstructing and evaluating the investigation.”

 Saying it differently, eSource data are original subject data that are collected digitally without having to record the data on a piece of paper first, and then transcribe it to an electronic data capture (EDC) system.

	It has been shown by many that changes made to the study database as a result of source document verification (SDV) affect neither study results nor the interpretation of those results.

 Therefore, despite the support of regulators, including the FDA

, it is difficult to explain 1) why many of those managing clinical research operations they still respond to a perceived risk, instead of adopting systematic and scientifically substantiated approaches for data management and cleaning, and 2) why there has been tepid adoption of eSource solutions coupled with “intelligent” monitoring of clinical trials. Perhaps failure to appreciate the wisdom contained in the quotes below explains why those doing clinical research spend a lot of their time on non-productive activities.

“Life is really simple, but we insist on making it complicated”

“Simplicity is the ultimate sophistication”

“The art of being wise is the art of knowing what to overlook”

	There is broad agreement across the pharmaceutical industry that it no longer makes sense to collect clinical trial data by writing results and observations first on a piece of paper, then to transcribe those data into an EDC system, and then to save that paper so that a clinical research associate (CRA) can check how precisely a person transcribed information from a piece of paper into the EDC system. Sadly, we continue to see residual, frequent emphasis on checking these transcription activities when electronic systems can easily eliminate this highly inefficient process. Doing the math, moving to electronic systems can provide a dramatic return on investment by 1) reducing labor costs at the clinical research sites and sponsoring companies, 2) reducing travel costs, and 3) providing improvements in data quality.

	In 2006, the Electronic Source Data Interchange (eSDI) Group within CDISC issued a paper entitled “Leveraging the CDISC Standards to Facilitate the use of Electronic Source Data within Clinical Trials.”

 The eSDI document was the product of the CDISC eSDI Initiative, the purpose 

of which was “to investigate the use of electronic technology in the context of existing regulations for the collection of eSource data (including that from eDiaries, EHR, EDC) in clinical trials for regulatory submission by leveraging the power of the CDISC standards, in particular the Operational Data Model (ODM)." The overall goal of the initiative was to make it easier to collect data once in an industry standard format.

	Eight years later, on Jan. 29, 2014, FDA addressed these issues in a webinar reviewing the final guidance for industry titled “Electronic Source Data in Clinical Investigations."

Leonard V. Sacks, associate director, Office of Medical Policy (CDER), Ron Fitzmartin, Office of Strategic Programs (CBER), and Jonathan S. Helfgott, associate director for risk science (acting), Office of Scientific Investigations (CDER).  Clearly, FDA is supporting efforts by industry to adopt eSource solutions.

	Even earlier, however, in 2010, the EMA GCP Inspectors Working Group eSource subteam released the “EMA Reflection Paper On Expectations for Electronic Source Data and Data Transcribed to Electronic Data Collection Tools in Clinical Trials.”

 The reflection paper-which is very similar in nature to an FDA guidance-was followed up by direct exchanges with industry representatives (the Society for Clinical Data Management and the eClinical Forum, among others). Those discussions are captured in a series of questions and answers that are frequently updated on the EMA website.

 of an independent contemporaneous investigator copy (ICIC) of the case report form (CRF) has led to numerous and passionate debates among the professional and industry associations. The basic concept of the ICIC is still far from being consistently understood and implemented in the different geographies; regardless, ICIC has had a considerable impact and has brought about an extension of the concept of ALCOA, that source data should not only be

attributable; legible; contemporaneous; original; and accurate, but also complete; consistent; enduring and available, when needed

As a result of this lack of consensus of the regulatory understanding of how to optimally generate and review electronic source records, apprehension and uncertainty among solutions vendors, contract research operatives, and pharmaceutical company sponsor remains.

 Good Clinical practice states that “The sponsor should ensure that it is specified in the protocol or other written agreement that the investigator(s)/institution(s) will permit trial-related monitoring, audits, IRB/IEC review, and regulatory inspection(s) by providing direct access to source data/documents.” There are no statements that paper records must be kept, just that there needs to be direct access to source data/documents.

	The FDA, in September 2013, issued a final “Guidance for Industry: Electronic Source Data in Clinical Investigations.”

 This guidance is consistent with the EMA “Reflection Paper on Expectations for Electronic Source Data and Data Transcribed to Electronic Data Collection Tools in Clinical Trials.”

	Regulators seem ahead of the game in supporting the transformation of how the pharmaceutical industry manages the performance of clinical trials. The following summarizes aspects of the perspectives of FDA and EMA.

	According to the FDA Guidance, source data include all findings, observations, or other activities in original and certified copies of original records, which are used by regulators to reconstruct and evaluate a clinical trial. All interested parties need to review source data and ensure adequate protection of human clinical trial subjects and the quality and integrity of the clinical data. Source data should be ALCOA and must meet the regulatory requirements for recordkeeping. FDA has proposed that electronically capturing and transmitting source data to the eCRF should:

		Encourage entering source data during a subject’s visit, where appropriate

		Eliminate unnecessary duplication of data entry and transcription errors

		Facilitate remote monitoring of data and promote real-time access for data review

		Facilitate the collection of accurate and complete data

	According to the FDA, data can be entered into the eCRF either manually or electronically using “direct entry of data into the eCRF.”  For example, there are many data elements in a clinical investigation, such as blood pressure, that can be entered directly into the eCRF at the time of the office visit. FDA also indicated that “data elements originating in an electronic medical record (EMR) can be automatically transmitted directly into the eCRF.  Unlike a direct transmission to an eCRF from instruments or medical devices, EMRs can use intervening processes (e.g., algorithms for the selection of the appropriate data elements).” In cases where the EMR serves as the source, the pertinent data for the subjects in the clinical study should be made available for review during regulatory inspections and monitoring visits.

	And although many may know this, the FDA added that the eCRF should be capable of recording metadata (e.g., data about the data identifying who entered or generated the data and when the data were entered or generated).  Also, changes to the data must not obscure the original entry, and must record who made the change, when, and why. Data element identifiers should be attached to each data element as it is entered or transmitted by the originator into the eCRF. Data element identifiers for each subject should identify the:

		Originators of the data element (including those entered manually (e.g., by the clinical investigator(s)) or automatically by devices

		Date and time that the data element was entered into the eCRF

	These data element identifiers allow sponsors, FDA, and other authorized parties to examine the audit trail of the eCRF data and to provide information that will allow FDA to reconstruct and evaluate the clinical investigation.

	The following are from the EMA Reflection Paper

In order to meet the requirements of maintenance of an independent contemporaneous copy of source records, a certified copy of the data should be created before the transfer to the sponsor and retained at the investigator site. The method of transfer should be validated. 

The recording of a clinical observation is made at the same time as when the observation occurred. If this is not possible the chronology of events should be recorded. An acceptable amount of delay should be defined and justified prior to trial recruitment.

The source data and their respective capture methods should be clearly defined prior to trial recruitment (i.e., in the protocol or study-specific source data agreement). The sponsor should describe which data will be transferred, the origin and destination of the data, the parties with access to the transferred data, the timing of the transfer, and any actions that may be triggered by real-time review of those data. There should only be one source defined at any time for any data element.

	According to the EMA, the source data and their respective capture methods should be clearly defined prior to trial recruitment (i.e. in the protocol or study specific source data agreement). The sponsor should describe which data will be transferred, the origin and destination of the data, the parties with access to the transferred data, the timing of the transfer, and any actions that may be triggered by real-time review of those data. There should only be one source defined at any time for any data element. The EMA has focused on the issue of source data control and specifically stated that “the investigator should maintain the original source document or a certified copy (Requirement 5, ICH GCP 2.11, 5.15.1); that source data should only be modified with the knowledge or approval of the investigator (Requirement 6, ICH GCP 4.9.3, 4.9.4 and chapter 8); and the sponsor should not have exclusive control of a source document. (Requirement 10, ICH GCP 8.3.13).”

	The EMA also requires that “all data generated in a clinical trial relevant to patient care must be made available to the investigator at all times during and after the trial, and all data held by the sponsor that has been generated in a clinical trial should be verifiable to a copy not held by the sponsor.”  The EMA also stated that “the requirements above are not met if data are captured in an electronic system and the data are stored on a central server under the sole control of the sponsor.” The EMA requires that a “contemporaneous certified copy of the data should be retained at the investigator site in addition to the record maintained on a central server.”

	In addition, the business requirement of any electronic system can be summarized to include:

		To be a separate legal entity from the sponsor and from the investigator, with a detailed contract defining duties and responsibilities of each party

		An assured mechanism for investigators to be informed about and/or approves of modifications to the data should be clearly established, and this control by the investigator should be demonstrable 

		Any changes to the data should be captured by the audit trail

	The variations in regulatory understanding have confounded many stakeholders. In order to find a practical way forward, industry and professional associations should concentrate efforts on identifying and addressing concerns around clinical data quality. Specific provisions associated with quality assurance and the transparency of data flow should be present in the protocol, protocol-associated plans, and any contractual agreements with the vendors and study sites. Failure to create, implement, and document such risk mitigation associated with source data would be a major shortcoming, as it could:

		Hinder the scientific interpretability of the data-and renders any clinical decision support impossible

	Not surprising, the EMA has directly warned sponsors and contract research organizations (CROs) that documentation, procedural, and systemic shortcomings will compromise (or even block) application package submission to the Committee for Medicinal Products for Human Use (CHMP). Similar reactions in presence of blatant lack of compliance are to be expected in the case of NDAs (CDER), BLAs (CBER) and PMAs (CDRH).

Source records during development process

	Despite the philosophical and historical differences explained earlier, it is possible to implement a clinical data acquisition environment that meets all recognized regulatory expectations. Source records, for example, can be maintained in many formats, including but not limited to paper records (e.g., data files, XML files, and PDF files). Regardless of the medium or the format, compliant maintenance of source records:

		Assures the ability of independent auditors to confirm the accuracy of data presented to regulatory agencies by pharmaceutical and device companies

		Allows for the reconstruction of study data in the event of catastrophic loss of data by the sponsor

	Source data should not be the same “version” of the data that the sponsor (or CRO) “controls.” Confirmation of the accuracy of the data submitted to regulatory agencies can be accomplished by review of the validation of electronic systems used as original data sources, manually reviewing paper records and comparing results submitted by sponsoring companies and/or performing “data compare” of electronic source records to data stored in locked databases. Ideally, evaluating extracts of, or entire datasets against CRF data elements could provide corroborating evidence, and ultimately a measure of confidence, as to the accuracy of reported assessments and endpoints. This, however, would require access to the electronic source data from EMRs, machines used in the clinical trial process (e.g., raw MRI records) and EDC databases prior to transfer to the sponsor of the clinical trial. While all of these tasks can be used to assure precise data (i.e., data elements agree between databases), these processes do not holistically address data accuracy. Sensitivity analyses done on real clinical trial datasets have repeatedly shown that database changes, as a result of SDV and SDR, have little or no impact on final means and standard deviations (SD).

	Therefore, key areas of focus during monitoring, audits or inspections are the following:

		Were the clinical site personnel qualified, as documented by education and experience, to perform the activities for which they were responsible?

		Were the clinical site personnel properly trained on the protocol and the electronic systems used for the trial (e.g., EDC, eSource storage, etc.)?

		Did the clinical site understand and follow the protocol?

		Were there any differences in outcomes between sites, suggesting lack of understanding of the protocol or possible fraud?

		Were basic regulations followed that assure patient safety (e.g., proper informed consent and safety monitoring)?

	The above is certainly not exhaustive-but it is an example of the strict minimums that assure quality.

	Sites may maintain source records in many formats, including electronic data stored by an independent third party prior to the source data arriving at the EDC database. 

	Source records could come from direct data entry at the time of the study visit, from the EMR, from patient reported outcomes (PROs), and from output from machines. The sponsor should have no more access to electronic source records than if given access to a site’s paper source records. One advantage of the source record existing as a PDF file in the cloud, with read-only system privileges, is that it is impossible for registered users to manipulate the file. It is the same as viewing a document on the FDA or EMA website, where one can view but cannot modify the file. PDF files can also be uploaded into most EMR systems and searched if saved as “readable” files. Generating electronic source as .XML can further enhance the ability to search.

	One way to create an ICIC of the site’s submitted study data is to adopt a data flow such as that depicted in Figure 1. In this model, at the time of the

 subject visit, rather than create a paper record of a study-related observation-if they have the means-the site staff can enter the information directly into a properly configured EDC system. As depicted in the figure, the system then takes a snapshot of the entered information (e.g., pdf, xml), transmits the snapshot to a repository controlled by the site (step 3), receives acknowledgment that the data were received without error (step 4), and then transmits the data to the EDC database (step 5). This approach is consistent with regulatory concerns in that sites at all times maintain control over original data. This process also reduces the site’s work burden by eliminating maintenance of paper copies and subsequent transcription to EDC systems, and provides sponsors with real-time data with which to make timely decisions. In today’s world of cloud-based computing, there is a growing recognition of the benefits of capturing source records using databases and web applications, vs. local data storage devices.

	There is no legislation or regulatory guidance that prohibits the investigator from delegating the hosting and maintenance of the site’s ICIC of original date via contractual agreement to an outside vendor or CRO. This applies even if the system is set up and financed by the

 sponsor. At the same time, it is the responsibility of the sponsor to have control of the study database and the data management process. This task is often delegated to a CRO, via a written agreement. These two tasks can very well be delegated to two independent CROs. However, when the same CRO takes on both tasks in the same study, independent systems must be in place to control access by employees of the CRO to the data management and eSource software products. If the appropriate controls of systems are not in place, this could indicate a conflict of interest where the independence of the CRO may be questioned.

	A key question is whether it is reasonable for the EMA, FDA, and other regulatory bodies to view independent CROs performing EDC and concurrent data management services as independent of sponsors. Clearly, no one other than the clinical site should enter or modify data and all transactions must be subject to an audit trail. So the fact that a CRO is performing data management should not disqualify it from hosting eSource data as long as:

How to satisfy regulatory concerns about EDC data integrity and site controls over its source records.

eSource Records in Clinical Research: Keeping it Simple

	There has been a recent thrust within the pharmaceutical industry to promote the transformation of the clinical trial process. In 2008, the Clinical Trial Transformational Initiative (CTTI), a public-private partnership with the FDA, and Duke University, was established to identify practices that, through broad adoption, will increase the quality and efficiency of clinical trials. A major publication by CTTI of monitoring practices has helped to transform the monitoring of clinical trials.

 The eSDI document was the product of the CDISC eSDI Initiative, the purpose of which was “to investigate the use of electronic technology in the context of existing regulations for the collection of eSource data (including that from eDiaries, EHR, EDC) in clinical trials for regulatory submission by leveraging the power of the CDISC standards, in particular the Operational Data Model (ODM)." The overall goal of the initiative was to make it easier to collect data once in an industry standard format.

 The reflection paper-which is very similar in nature to an FDA guidance-was followed up by direct exchanges with industry representatives (the Society for Clinical Data Management and the eClinical Forum, among others). Those discussions are captured in a series of questions & answers that are frequently updated on the EMA website.  

The following are from the EMA Reflection Paper

		Violate fundamental patient rights
		 

	One way to create an ICIC of the site’s submitted study data is to adopt a data flow such as that depicted in Figure 2. In this model, at the time of the subject visit, rather than create a paper record of a study-related observation-if they have the means-the site staff can enter the information directly into a properly configured EDC system. As depicted in the figure, the system then takes a snapshot of the entered information (e.g., pdf, xml), transmits the snapshot to a repository controlled by the site (step 3), receives acknowledgment that the data were received without error (step 4), and then transmits the data to the EDC database (step 5). This approach is consistent with regulatory concerns in that sites at all times maintain control over original data. This process also reduces the site’s work burden by eliminating maintenance of paper copies and subsequent transcription to EDC systems, and provides sponsors with real-time data with which to make timely decisions. In today’s world of cloud-based computing, there is a growing recognition of the benefits of capturing source records using databases and web applications, vs. local data storage devices.

	There is no legislation or regulatory guidance that prohibits the investigator from delegating the hosting and maintenance of the site’s ICIC of original date via contractual agreement to an outside vendor or CRO. This applies even if the system is set up and financed by the sponsor. At the same time, it is the responsibility of the sponsor to have control of the study database and the data management process. This task is often delegated to a CRO, via a written agreement. These two tasks can very well be delegated to two independent CROs. However, when the same CRO takes on both tasks in the same study, independent systems must be in place to control access by employees of the CRO to the data management and eSource software products. If the appropriate controls of systems are not in place, this could indicate a conflict of interest where the independence of the CRO may be questioned.