Electronic Data Capture and Digital Systems

Part of Good Clinical Practice (GCP) — ICH E6(R3): Data Collection, Source Documentation and CRFs.

About 8 minutes. Free, in your language, no account needed.

Why this matters

Almost every trial now runs on computerized systems. If a login is shared, nobody can prove who entered a value. If an audit trail is switched off, a change cannot be explained. If a blind-breaking report reaches the wrong person, the trial result can be questioned.

Data governance is a new section in E6(R3)

Section 4 of Annex 1 is called Data Governance – Investigator and Sponsor. It did not exist in the previous revision, E6(R2), which scattered computerized system expectations through the sponsor and investigator sections. R3 gathers them into one shared section.

Section 4 covers "management of data integrity, traceability and security". It names four key processes for the full data life cycle: protecting the confidentiality of participants' data; managing computerized systems so they are fit for purpose; safeguarding essential elements such as randomization, dose adjustments and blinding; and supporting key decisions such as data finalization before analysis, unblinding, allocation to analysis data sets and the work of an independent data monitoring committee (IDMC).

Principle 9.3 sets the tone. Computerized systems "should be fit for purpose (e.g., through risk-based validation, if appropriate)".

4.1 Safeguarding blinding

Blinding is protected through system design, not only through procedure. E6(R3) §4.1.1 lists where blinding is at risk: system design, user account management, delegation of data handling, data access at sites, data transfers, and database review before planned unblinding and analysis.

Section 4.1.2 requires roles, responsibilities and procedures for access to unblinded information to be defined and documented, according to the protocol. Sponsor staff and service providers who interact with site staff should not have access to unblinding information unless the trial design justifies it. Section 4.1.3 then requires mitigation to reduce the risk of inadvertently unblinding site staff.

Section 4.1.4 is the one to memorize:

"The potential for unblinding should be part of the risk assessment of a blinded trial. Any planned or unplanned unblinding, including inadvertent or emergency unblinding, should be documented. Any unplanned unblinding should be assessed for its impact on the trial results."

Note the two obligations. Everything is documented, planned or not. Anything unplanned is also assessed for impact. This connects to §2.11, where the investigator must be able to unblind without undue delay in an emergency, and must promptly document and explain any premature unblinding.

4.2 The data life cycle

Metadata and audit trails (§4.2.2). Systems must log user account creation, changes to roles and permissions, and user access. They must document the initial entry and any later change or deletion, with the reason where appropriate, and must record workflow actions as well as direct data entry. Date and time must be unambiguous, for example coordinated universal time (UTC).

The strongest sentence is §4.2.2(b):

"Ensuring that audit trails, reports and logs are not disabled. Audit trails should not be modified except in rare circumstances (e.g., when a participant's personal information is inadvertently included in the data) and only if a log of such action and justification is maintained."

Review of data and metadata (§4.2.3). Reviewing data, audit trails and other metadata must be a planned, risk-based activity, adjusted based on experience during the trial. Audit trail review is not something you do only after a problem appears.

Data corrections (§4.2.4). Corrections are attributed, justified, supported by source records from around the time of original entry, and made in a timely manner.

Transfer, exchange and migration (§4.2.5). Validated processes, or other appropriate processes such as reconciliation, must preserve integrity and confidentiality when data move between systems. The transfer or migration is documented for traceability, and reconciliation avoids data loss.

Finalization of data sets before analysis (§4.2.6). The data quality needed for interim and final analysis is defined in advance, and finalization activities are documented against pre-specified procedures. They may include database reconciliation, error correction, medical coding, and addressing the impact of protocol deviations.

Retention, access and destruction (§4.2.7 and §4.2.8). Data and relevant metadata are archived so they can be retrieved and read, and are protected from unauthorized access and alteration throughout the retention period. They may be permanently destroyed when no longer required under applicable regulatory requirements. E6(R3) states no number of years.

4.3 Computerized systems — the eight sub-headings

Section 4.3 requires each party's responsibilities for each system to be clear and documented. It also recommends involving representatives of the intended participant population in system design.

• 4.3.1 Procedures — documented procedures must cover the appropriate use of computerized systems for essential data collection, handling and management activities.
• 4.3.2 Training — the responsible party must ensure that users are appropriately trained.
• 4.3.3 Security — security is managed across the whole data life cycle. The guideline names authentication and password management, firewalls, antivirus software, security patching, system monitoring and penetration testing. Backup and disaster recovery must be tested periodically.
• 4.3.4 Validation — the approach is risk-based, considering the system's intended use, the importance of its data, and the potential effect on participants and on result reliability. Systems are validated before use, and changes under change control. Protocol-specific configuration and interfaces must be validated too, not only standard functionality.
• 4.3.5 System release — trial-specific systems, including updates from protocol amendments, may only be released to a site after all necessary approvals for that site are received.
• 4.3.6 System failure — contingency procedures must prevent loss of, or loss of access to, data essential to participant safety, trial decisions or trial outcomes.
• 4.3.7 Technical support — mechanisms such as a help desk document, evaluate and manage system issues, with periodic review to find systemic problems. Defects are resolved by criticality.
• 4.3.8 User management — access controls limit access to authorized users and ensure attributability to an individual. Permissions follow the user's duties, blinding arrangements and organization, are revoked when no longer needed, and are reviewed periodically.

What §2.12.10 asks of the site

Section 4.3 is addressed to whoever is responsible for the system, which is often the sponsor. §2.12.10 is addressed to you. It lists five duties for the investigator or institution wherever a computerized system is used in a trial:

• (a) For systems the site deploys, ensure that appropriate individuals have secure and attributable access.
• (b) For systems the sponsor deploys, notify the sponsor when an individual's access permissions need to be changed or revoked.
• (c) For systems the site deploys specifically for clinical trial purposes, ensure the section 4 requirements are addressed, proportionate to the risks to participants and to the importance of the data.
• (d) Where the site gives data-acquisition equipment to participants, maintain traceability and provide the participants with appropriate training.
• (e) Report incidents in the use and operation of computerized systems to the sponsor, and where applicable to the IRB/IEC, where in the investigator's judgment they may have a significant or persistent impact on the trial data or on system security.

Point (c) is the one sites underestimate. A tablet the site bought to collect questionnaires is a trial system, and section 4 applies to it in proportion to what rides on its data.

In practice

Dr. Sarah is the investigator at a blinded site. A coordinator leaves on a Friday. Nobody tells the sponsor, and the account stays active for six weeks.

Two problems follow. The leaver's login is used by a colleague to enter two visits, so those entries are attributed to the wrong person. An unblinded pharmacy report is opened under that account. The periodic user access review required by §4.3.8 would have caught both.

Under §2.12.10(b) the investigator notifies the sponsor whenever access permissions need to be changed or revoked, so the site adds departure notification to its offboarding checklist. The unblinding is documented and assessed under §4.1.4.

A system is only as controlled as its list of users.

Key takeaways

• Data Governance – Investigator and Sponsor is section 4 of E6(R3) Annex 1, is new in R3, and is shared between the investigator and the sponsor.
• E6(R3) §4.1.4 requires all unblinding to be documented, whether planned, inadvertent or emergency, and requires unplanned unblinding to be assessed for its impact on trial results.
• E6(R3) §4.2.2(b) requires that audit trails, reports and logs are not disabled, and are not modified except in rare justified circumstances with a log of the action.
• Review of data, audit trails and metadata must be a planned, risk-based activity under §4.2.3.
• Validation of computerized systems is risk-based and must cover protocol-specific configuration and interfaces, not only standard functionality, per §4.3.4 and Principle 9.3.
• Trial-specific systems may only be released to a site after that site has all necessary approvals (§4.3.5), and user access must be individually attributable and revoked when no longer needed (§4.3.8).
• §2.12.10 sets five site-side duties for computerized systems: secure attributable access, telling the sponsor when permissions change, applying section 4 proportionately to systems the site deploys, traceability and training for participant-held equipment, and reporting significant system incidents to the sponsor and, where applicable, the IRB/IEC.