10.2 Record Retention Regulations (FDA vs. ICH GCP)

Record Retention Regulations (FDA vs. ICH GCP)

The Importance of Record Archiving

Record retention is a cornerstone of regulatory compliance in clinical research. The documents generated during a clinical trial, collectively known as essential documents (as defined in ICH GCP E6 Section 8), provide the audit trail necessary to reconstruct the trial and evaluate the quality of the data and the integrity of the trial's conduct. These documents include the protocol, consent forms, IRB approvals, case report forms (CRFs), source documents, drug accountability records, and monitor logs. Archiving these files ensures that regulatory authorities, sponsors, and auditors can verify that the rights, safety, and well-being of human subjects were protected, and that the study data is reliable. However, determining how long to keep these records requires navigating differing regulations from the FDA, international guidelines, state laws, and institutional policies.

FDA Regulations for Record Retention

The U.S. Food and Drug Administration (FDA) specifies record retention timelines based on the type of product under investigation (drugs/biologics versus medical devices). These regulations are legally binding for trials conducted under an Investigational New Drug (IND) application or an Investigational Device Exemption (IDE).

• Investigational Drugs and Biologics (21 CFR 312.62(c)): The FDA requires clinical investigators to retain records and reports for a period of 2 years following the date on which a marketing application (New Drug Application [NDA] or Biologics License Application [BLA]) is approved for the drug for the indication for which it is being investigated. If no marketing application is to be filed, or if the application is not approved for the investigated indication, the investigator must retain the records for 2 years after the investigation is formally discontinued and the FDA is notified of the discontinuation.
• Investigational Devices (21 CFR 812.140(d)): Under IDE regulations, both investigators and sponsors must maintain records for a period of 2 years after the date on which the investigation is terminated or completed, or the date that the records are no longer required for purposes of supporting a premarket approval application (PMA) or a notice of completion of a product development protocol (PDP), whichever is later.

These FDA regulations represent the minimum federal requirements. In practice, clinical trials are rarely closed out and destroyed after just two years because other rules and agreements supercede these limits.

ICH GCP E6 Standards for Record Retention

The International Council for Harmonisation (ICH) GCP guidelines provide a global standard that is typically more conservative and requires longer retention periods than FDA regulations.

• ICH GCP E6 (R2/R3) Section 4.9.5: Essential documents must be retained for at least 2 years after the last approval of a marketing application in an ICH region and until there are no pending or contemplated marketing applications in an ICH region, or at least 2 years have elapsed since the formal discontinuation of clinical development of the investigational product.
• The "Last Approval" Distinction: The critical difference between FDA and ICH guidelines lies in the geographical scope. While the FDA timeline is tied to the approval of the marketing application in the United States, the ICH guideline is tied to the last approval in any ICH region (including the European Union, Japan, Canada, Switzerland, and others). Because international drug approvals can span a decade or more, the ICH GCP timeline almost always extends far beyond the FDA’s US-specific 2-year timeline.
• Sponsor Communication: ICH GCP states that the sponsor is responsible for notifying the investigator and institution in writing when the study records are no longer needed. Investigators are prohibited from destroying any study-related files without prior written agreement and authorization from the sponsor.

International and European Union Standards

For multi-center global clinical trials, sponsors frequently insert clauses in the clinical trial agreement (CTA) requiring the site to retain records for 15 years or longer.

• The 15-Year Standard: Historically, many international clinical trials adopted a 15-year archiving standard to align with European and Japanese regulatory expectations.
• European Union Clinical Trials Regulation (Regulation (EU) No 536/2014): Under the current EU regulation, the clinical trial master file and associated source documents must be archived for at least 25 years after the end of the clinical trial. This strict requirement has led many global sponsors to standardise their contracts worldwide to a 25-year retention period, regardless of whether the site is located in Europe or the United States.

Institutional, State, and Pediatric Requirements

Investigators and clinical research coordinators must also consider local factors that may mandate longer retention:

1. State Statutes of Limitations: Medical malpractice and personal injury laws vary by state. Many state laws require medical records (which serve as study source documents) to be maintained for 7 to 10 years after the last patient contact.
2. Pediatric Studies (Minor Subjects): When a clinical trial enrolls pediatric subjects, record retention requirements are significantly extended. Records must typically be maintained until the subject reaches the age of majority (usually 18 or 21) plus the state’s statute of limitations for personal injury claims. For example, if a trial enrolls a 2-year-old child, the site may be required to retain the records for 18 to 21 years (until the child reaches adulthood) plus an additional 2 to 7 years, resulting in a total retention period of up to 28 years.
3. HIPAA Authorization Records: Under the Health Insurance Portability and Accountability Act (HIPAA) Security Rule (45 CFR 164.316(b)), signed authorizations and documentation of compliance policies must be retained for at least 6 years from the date of their creation or the date when they were last in effect.

Compliance and Secure Destruction

To remain compliant, sites must implement a robust archiving procedure:

• Storage Conditions: Archived files must be stored in a secure, fireproof, and climate-controlled environment with restricted access to prevent damage or unauthorized disclosure of protected health information (PHI).
• Media Migration: If records are migrated to electronic media (e.g., scanning paper source documents), the site must use validated systems under 21 CFR Part 11 to ensure the copies are certified, legible, and complete.
• Secure Destruction: When the retention period has elapsed and the sponsor has provided written clearance, records must be destroyed securely (e.g., through certified shredding or incineration) to maintain subject confidentiality. The site must retain a Certificate of Destruction to document the final disposition of the records.