18.3 Compliance in Clinical Trial Informatics

Informatics and Electronic Systems in Clinical Trials

The transition from paper-based data collection to electronic systems has revolutionized clinical research, enabling faster data analysis, real-time monitoring, and global collaboration. However, the use of informatics in clinical trials introduces new compliance challenges. The Clinical Research Coordinator (CRC) must understand the regulatory guardrails that ensure electronic data is as trustworthy and verifiable as traditional paper records.

21 CFR Part 11: Electronic Records and Signatures

In 1997, the FDA issued Title 21 of the Code of Federal Regulations, Part 11 (commonly referred to simply as "Part 11"). This regulation defines the criteria under which the FDA considers electronic records, electronic signatures, and handwritten signatures executed to electronic records to be trustworthy, reliable, and generally equivalent to paper records and handwritten signatures executed on paper.

For an electronic system (like an Electronic Health Record (EHR), Electronic Data Capture (EDC) system, or eRegulatory binder) to be Part 11 compliant, it must feature several technical and procedural controls:

• Validation: The system must be validated to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records.
• Audit Trails: The system must generate a secure, computer-generated, time-stamped audit trail that independently records the date and time of operator entries and actions that create, modify, or delete electronic records. The audit trail must not obscure the original data.
• Access Controls: The system must limit system access to authorized individuals.
• Electronic Signatures: Electronic signatures must be unique to one individual and cannot be reused or reassigned. When an electronic signature is applied, it must clearly indicate the printed name of the signer, the date and time the signature was executed, and the meaning of the signature (e.g., "review," "approval," "responsibility").

Data Integrity and the ALCOA-C Principles

Data integrity refers to the completeness, consistency, and accuracy of data over its entire lifecycle. Regulatory agencies globally rely on the ALCOA-C principles to assess data integrity, whether the data is paper-based or electronic.

Note: Some organizations expand this to ALCOA++, adding principles like Enduring, Available, and Consistent.

Electronic Data Capture (EDC) Systems

The EDC is the primary tool used by CRCs to transmit subject data to the sponsor. When a subject comes in for a visit, the CRC gathers the source documents (lab results, physician notes) and transcribes the required datapoints into the EDC's electronic Case Report Forms (eCRFs).

Ensuring Compliance in the EDC

• Training: CRCs must complete sponsor-provided training on the specific EDC system before they are granted a username and password. This training is documented and filed in the regulatory binder.
• Data Entry Timelines: Sponsors usually require data to be entered into the EDC within a specific timeframe after a study visit (e.g., 3-5 business days). Timely entry ensures contemporaneous data and allows monitors to detect safety signals rapidly.
• Resolving Queries: Clinical Research Associates (CRAs) or Data Managers review the EDC data. If they find discrepancies (e.g., a missing blood pressure reading or a protocol deviation), they issue a "query" within the system. The CRC is responsible for investigating the query, correcting the data if necessary, and providing a rationale in the EDC. This process must be completed promptly to keep the database clean and ready for lock.

E-Source and Direct Data Entry

The industry is moving toward eSource, where clinical data is entered directly into an electronic system (like an electronic tablet given to a patient for a questionnaire) without a prior paper record. When utilizing eSource, the electronic record is the original source. The system used must be fully Part 11 compliant and allow the investigator to retain control of the data, separate from the sponsor, to ensure independent verification.

System Validation Life Cycle

Computerized systems used in clinical trials must undergo rigorous validation to ensure they meet their intended purpose consistently. Validation is not a one-time event; it encompasses the entire life cycle of the software. It begins with defining the User Requirements Specifications (URS)—what exactly the system needs to do. This is followed by building the system and executing extensive testing protocols, including Operational Qualification (OQ) and Performance Qualification (PQ). For the CRC, while the sponsor or vendor typically handles the heavy lifting of validation, the site must maintain documentation proving that the system (especially if it is site-owned, like an institutional EHR) has been validated. If the system undergoes an update or patch, a risk assessment and potential re-validation must occur to ensure the changes did not break existing functionality or compromise Part 11 compliance.