But the Instrument Doesn’t Let Us….

…use access controls…implement audit trails…

During a clinical lab audit, you come across an instrument that doesn’t have access controls or an audit trail. You raise the problem as a finding during the audit, and the auditee objects:

“Where is THAT written?”
“It’s an approved device.” (Or “It has a CE mark.”)
“Our raw data are paper.”

Here are

Counters to these 3 objections
A resource on data integrity from the MHRA

Objection 1: “Where is THAT written?”

Truth? It’s not spelled out in any regulation. You must understand the records and associated predicate rules, apply logic, and step into the digital age. 21 CFR Part 312.62 requires investigators to

Prepare and maintain adequate and accurate case histories that record all observations and other data pertinent to the investigation on each individual administered the investigational drug or employed as a control in the investigation. Case histories include the case report forms and supporting data including, for example, signed and dated consent forms and medical records including, for example, progress notes of the physician, the individual’s hospital chart(s), and the nurses’ notes.

In addition, FDA reminds us in the Guidance for Industry Electronic Source Data in Clinical Investigations: “Source data should be attributable, legible, contemporaneous, original, and accurate (ALCOA) and must meet the regulatory requirements for record keeping.”

But we’re a clinical lab, not an investigator!

Also true. What else is certainly true? That chemistry analyzer that’s missing audit trails is creating, maintaining, and transmitting source data for clinical trial subjects. Without an audit trail, you cannot demonstrate the source are adequate and accurate. The investigator’s only visibility into those data is the lab report the central lab emails or faxes to them.

The investigator is completely reliant on the central lab to maintain data integrity.

That FDA guidance is about putting data in eCRFs. We don’t do that!

Then where are the data stored? As Excel spreadsheets, CSV files, and SAS data sets on file shares at the lab and the sponsor. That presents additional data integrity issues. (More on that in a later blog post….)

We’re a clinical lab, not a CRO!

Again, a true statement. A bit legalistic, but true. Read “When is a CRO not a CRO?” ….and remember this:

Counter

Source data in a clinical trial should have the ALCOA attributes. Period.

Need a refresher? Read How Do I Apply ALCOA to Electronic Records?
And check out FDA’s current thinking on shared logins in the GMP environment . (See Question 5.)

You don’t even need 21 CFR Part 11! Make the discussion about the records and the need for data integrity. And if your contract with the clinical lab does not require them to create, modify, maintain, archive, retrieve, and transmit records with the ALCOA attributes, then work with your legal and contracting teams to improve your contracts.

Objection 2: “It’s an approved device!”

Well, let’s hope so! The question is, “Approved for what?” And the answer is nearly always that it’s approved for use in clinical practice. But:

Clinical Practice ≠ Clinical Research

Clinical research is subject to higher data integrity requirements than clinical practice. Remember – the clinical trial subjects, whether we call them participants, subjects, patients, or volunteers, are experimental units in a scientific experiment. We must do them the honor of making sure their contributions to the experiment have integrity.

Counter

Work with the lab to identify the source of the problem. Did the lab simply neglect to configure the instrument properly or is it a manufacturer’s design problem? The solution may be simpler than you think. And the good news? Device and instrument manufacturers are listening! It’s becoming increasingly common to see newer devices and instruments with far better controls. Look for this as you qualify your clinical labs.

Objection 3: “Our raw data are paper.”

This is the result of misunderstanding an old guidance document about 21 CFR Part 11. For paper records to be equivalent to paper printouts, the paper printouts must be equivalent in content and meaning to the electronic records. Can your auditee demonstrate this is the case? Can you demonstrate that it’s not? In some cases, demonstrating the negative is pretty easy. (Remember: duplicates are only duplicates if they’re the same. See Finding B.3.c in this Warning Letter.)

Want to learn more? Check out Why Isn’t Paper the Same as Electronic?

Even more important, what do people rely on to perform regulated activities? It’s almost certainly the electronic records, not the paper. When was the last time the lab’s Data Management department used paper records to prepare your file for transfer? When was the last time your Data Management department received paper printouts from a central lab and double data entered the results in a clinical database? Nope. We all rely on the electronic records. Here’s FDA’s current thinking on paper records in the GMP environment. (See Question 3.)

Counter

Compare paper record to electronic records to demonstrate why they are not equivalent to electronic records. Discuss the fact that neither central lab personnel downstream from the instrument in the lab, the sponsor, nor the investigator rely on those instrument printouts to perform their regulated activities.

MHRA Steps Up With Data Integrity Guidance

In 2015, the MHRA published a very helpful guidance on data integrity in the GMP environment. The latest revision discusses how to deal with computer systems that do not currently support adequate audit trails or logical security controls, any of which could be applied to a clinical lab.

Keep in mind: Regulators will certainly continue to take action when they see evidence of data integrity problems that are institutionalized, endorsed by management, or the result of collusion or fraud.

What do you think?

My turn to ask you questions! Enter a comment below or use the “Contact Us” button at the top of the page.

How does CLIA help/not help a clinical lab with ALCOA requirements for source data in a clinical trial?
On 23 Dec 2015, FDA issued a Warning Letter to a manufacturing facility, citing “because eight different analysts share a single username and password, you were unable to demonstrate who performed each operation on this instrument system.” How would you handle this situation in a clinical lab?

I look forward to hearing from you!