Electronic Records and Signatures

Electronic records and signatures are widely used in clinical research to create, capture, review, approve, maintain and retain clinical trial information. When electronic systems are used for regulated clinical trial activities, appropriate controls should ensure that records remain reliable, secure, traceable and available throughout their required lifecycle.

Electronic records and electronic signatures should be managed in accordance with applicable regulatory requirements, Good Clinical Practice (GCP) and appropriate procedures for the systems and records involved.

Electronic Records in Clinical Research

Electronic records may include many types of clinical trial information, such as:

• Electronic case report forms (eCRFs)
• Electronic informed consent records
• Clinical trial protocols and amendments
• Investigator and site documentation
• Safety information
• Monitoring and audit documentation
• Electronic patient-reported outcome data
• Laboratory and other externally generated data
• Trial Master File records
• Training and approval records

The regulatory significance of an electronic record depends on its purpose, how it is used and the applicable requirements governing that record.

Electronic Signatures

Electronic signatures may be used to document activities such as review, approval, verification, authorship or responsibility.

An electronic signature intended to serve as the equivalent of a handwritten signature should be attributable to the individual who executed it and appropriately linked to the corresponding electronic record.

Controls should prevent the inappropriate use, transfer or reassignment of an individual’s electronic-signature credentials.

21 CFR Part 11

In the United States, 21 CFR Part 11 establishes criteria under which FDA considers certain electronic records and electronic signatures to be trustworthy, reliable and generally equivalent to paper records and handwritten signatures.

Part 11 should be considered together with the applicable underlying regulatory requirements governing the records, sometimes referred to as predicate rules.

Whether Part 11 applies depends on the nature of the electronic record, its regulatory purpose and how the organisation relies upon it.

FDA provides additional current guidance on the use of electronic systems, electronic records and electronic signatures in clinical investigations.

Computerized Systems

Computerized systems used in clinical trials should be appropriate for their intended purpose and support reliable trial conduct and data.

System controls should be proportionate to the importance of the system and the risks associated with its use.

Relevant considerations may include system functionality, validation, user management, security, data integrity, change control, backup and recovery, business continuity and record retention.

Validation and Fitness for Purpose

Electronic systems used for important clinical trial activities should be appropriately validated or otherwise demonstrated to be fit for their intended purpose.

The extent of validation and control should consider the intended use of the system and the potential risks to participant protection and the reliability of trial results.

Changes to computerized systems should be appropriately evaluated, tested and documented according to their significance and associated risks.

Access Controls and User Management

Access to electronic systems should be limited to appropriately authorised individuals.

User accounts should be attributable to individual users, and roles and permissions should reflect assigned responsibilities.

Processes should address account creation, modification and removal, including timely removal or adjustment of access when responsibilities change.

Shared credentials should be avoided where they would compromise attribution or accountability.

Audit Trails and Metadata

Computerized systems should maintain appropriate audit trails and other relevant metadata that allow important activities and changes to be reconstructed.

Audit trails may document the initial entry of data, subsequent changes or deletions, the individual or system responsible for an action, the date and time of the action and, where appropriate, the reason for a change.

Audit trails and relevant logs should be protected from inappropriate alteration or disabling.

The extent and nature of audit-trail and metadata review should be planned and proportionate to the risks and importance of the data and processes involved.

Data Corrections

Corrections to electronic trial data should be traceable.

The original information should not be inappropriately obscured, and changes should be attributable to the individual or computerized system making the correction.

Where appropriate, the reason for the change should also be documented.

Processes should support timely correction of errors that could affect participant safety or the reliability of trial results.

Electronic Data Transfer and Migration

Electronic clinical trial data may be transferred between systems or migrated when systems are changed.

Appropriate processes should help ensure that data and relevant metadata maintain their integrity and confidentiality during transfer, exchange or migration.

Transfer and migration activities should be documented to provide traceability, and reconciliation or other appropriate controls should be used when necessary to identify data loss or unintended modification.

Security and Confidentiality

Electronic systems should include appropriate safeguards to protect clinical trial information from unauthorised access, alteration, disclosure or loss.

Security measures should be proportionate to the sensitivity and importance of the information being managed.

Participant confidentiality should be protected throughout data collection, processing, transfer, storage and retention.

Record Retention and Retrieval

Electronic records should remain accessible and retrievable for the period required by applicable regulatory requirements.

Records should be protected against inappropriate alteration, deterioration or loss throughout the retention period.

Systems and procedures should also support the production of records in an appropriate form for authorised monitoring, audit or regulatory inspection.

Electronic Informed Consent

Electronic systems may be used to support the informed consent process where permitted by applicable requirements.

Electronic informed consent should continue to meet the ethical and regulatory requirements applicable to informed consent, including appropriate presentation of information, participant understanding, voluntary agreement and documentation of consent.

The use of electronic technology does not reduce the responsibility to protect participants’ rights and welfare.

Importance of Electronic Records and Signatures

Electronic records and signatures can improve accessibility, efficiency, collaboration and traceability in clinical research.

Their value, however, depends on the reliability of the systems and processes used to create and maintain them.

Appropriate validation, access controls, audit trails, security, data-integrity measures and record-retention processes help ensure that electronic clinical trial information remains trustworthy and suitable for its intended regulatory and scientific purposes.

These controls form part of the broader quality framework described in the Principles of Good Clinical Practice.

You may be interested in the programs below: