Source Records, CRFs and What Source Means

Part of Clinical Research Coordinator (CRC) Training: Source Documentation and Data.

About 6 minutes. Free, in your language, no account needed.

Why this matters

An inspector cannot watch your clinic. They can only read what you wrote. If the record is missing, unreadable, or written a week later, the assessment cannot be trusted.

The rule sites are judged by is blunt: if it is not in the source, it did not happen.

What a source record is

ICH E6(R3) uses the term source records. It defines them as original documents or data, including relevant metadata, or certified copies of them, whatever the medium.

At a site, source records include:

• The participant's medical record, clinic notes and charts.
• Study-specific worksheets, where the protocol allows the site to record directly onto them.
• Laboratory reports, imaging reports and printouts from devices such as an electrocardiogram machine.
• Data entered by the participant themselves, such as an electronic diary or a paper questionnaire.
• Pharmacy dispensing records.
• Data from automated instruments, wearables and sensors.

A certified copy is a copy that has been verified — by a dated signature, or by generation through a validated process — to hold the same information as the original, including relevant metadata where applicable. A scan nobody has verified is not a certified copy.

Define your source before you start

This is the requirement most sites miss. E6(R3) section 2.12.2 requires the investigator to define what is considered a source record, the methods of data capture and their location, before the trial starts, and to update that definition when needed.

In practice this is a written source data location list. For each data point the protocol requires, it states where the source lives and how it is captured. Blood pressure: the printed strip from the monitor, attached to the visit worksheet. Concomitant medications: the clinic's medication list in the electronic record. Symptom diary: the participant's paper diary, collected at the visit.

The same section adds that unnecessary transcription steps between the source record and the data acquisition tool should be avoided. Every extra copy is another chance to introduce an error.

Source and case report form are not the same thing

The case report form, or CRF, is the sponsor's structured collection of the data the study needs. Today it is usually electronic, and the system is called electronic data capture, or EDC.

Source comes first. The CRF is completed from it. Two consequences:

• Do not invent data in the CRF that does not exist in source. Every value in the CRF must be traceable back to a record.
• Where the CRF itself is the first place a datum is recorded, that field is the source and must be identified as such in your source data location list. This happens legitimately, for example with some questionnaires entered directly.

The attributes E6(R3) requires

E6(R3) section 2.12.2 states the requirement in words:

"Source records should be attributable, legible, contemporaneous, original, accurate and complete. Changes to source records should be traceable, should not obscure the original entry and should be explained if necessary (via an audit trail)."

The guideline's glossary definition of data integrity lists eight attributes:

• Attributable — it is clear who recorded the entry.
• Legible — another person can read and understand it.
• Contemporaneous — it was recorded at the time of the activity.
• Original — it is the first record, or a certified copy of it.
• Accurate — it reflects what actually happened.
• Complete — nothing required is missing.
• Secure — it is protected from unauthorized access and alteration.
• Reliable — it can be depended on for decisions.

ICH E6(R3) never uses the acronym ALCOA, ALCOA+ or ALCOA++. The acronym is a widely used industry memory aid, and the industry applies the plus signs inconsistently. Use it to remember the list if you find it helpful. Never write "as required by ICH E6(R3)" next to it. The eight attributes above are the requirement.

Corrections

A correction must never hide what was written first.

On paper:

• Draw a single line through the incorrect entry, so the original stays readable.
• Write the correct value beside it.
• Add your initials and the date.
• Add a short reason where the reason is not obvious.
• Never erase, never use correction fluid, never write over the top.

In an electronic system, the audit trail enforces the same rule. E6(R3) defines an audit trail as metadata showing activities, the initial entry and changes to data fields, by whom, when and where applicable why. Use the system's correction function. Never work around it.

Late entries

Contemporaneous means at the time, or as soon as possible afterwards. When a late entry is unavoidable:

• Date it the day you are actually writing it.
• State clearly that it is a late entry, and the date the event occurred.
• Explain briefly why it is late.

Never date a note to the day of the event when you wrote it later. That is back-dating, and it is treated as falsification.

Protecting the record

• Report data to the sponsor under an unambiguous participant code that only the site can trace back to the person. E6(R3) section 2.12.8 requires this.
• Keep the participant identification list at the site, under access control.
• Protect the systems the site runs itself from unauthorized access, alteration and accidental loss, as section 2.12.9 requires.
• Use individual logins. A shared account destroys attribution.

In practice

Northside Clinic measures blood pressure with an automated monitor that prints a strip. Nadia's source data location list says the strip is the source, that it is attached to the visit worksheet, and that the value is then entered into the electronic system.

At visit 3 the machine prints 148/92. Nadia writes 184/92 on the worksheet by mistake, and notices at the end of the day. She draws one line through 184, writes 148 beside it, initials, dates, and adds "transcription error, see attached printout". The strip is still attached. Nothing is hidden.

A nearby site works differently. Readings are written on scrap paper during the clinic and copied into the notes the following week. There is no printout and no source data location list. When the monitor asks what the source is for blood pressure, nobody can answer.

Illegible records can be treated as if the data do not exist. So can undefined ones.

Key takeaways

• ICH E6(R3) uses the term "source records", meaning original documents or data including relevant metadata, or certified copies of them, in any medium.
• Section 2.12.2 requires the investigator to define the source records, capture methods and their location before the trial starts, which in practice is a written source data location list.
• The E6(R3) glossary definition of data integrity lists eight attributes: attributable, legible, contemporaneous, original, accurate, complete, secure and reliable.
• E6(R3) never uses the acronym ALCOA, so the acronym may be used as a memory aid but must never be attributed to the guideline.
• Corrections use a single line-through with initials, date and reason, late entries are dated the day they are written and marked as late, and back-dating is treated as falsification.