Research Documentation: What to Write, What to Save, How to Store It

Tracy Rightmer, J.D.

Compliance Manager

December 16, 2008

Objectives

Discuss essential elements of a data and document management plan

Present strategies for efficient management of research related documentation

Highlight effective tools for use in managing study files

Discuss some common audit findings Describe measures for ensuring subject

confidentiality and data storage

International Conference on Harmonization

The International Conference on Harmonization of Technical Requirements for Registration of Pharmaceuticals for Human Use (ICH) is a unique project that brings together the regulatory authorities of Europe, Japan and the United States and experts from the pharmaceutical industry in the three regions to discuss scientific and technical aspects of product registration

ICH

The purpose is to make recommendations on ways to achieve greater harmonization in the interpretation and application of technical guidelines and requirements for product registration in order to reduce or obviate the need to duplicate the testing carried out during the research and development of new medicines

E6:Good Clinical PracticeConsolidated Guidance

An international ethical and scientific quality standard for the design, conduct, performance, monitoring, auditing, recording, analyses, and reporting of clinical trials

GCP

Compliance with this standard provides public assurances that the rights, safety and well-being of trial subjects are protected, consistent with the Declaration of Helsinki, and that the clinical trial data are credible

Provide a unified standard to facilitate internal acceptance of clinical data by the regulatory authorities in these jurisdictions

GCP 2.10

All clinical trial information should be recorded, handled, and stored in a way that allows its accurate reporting, interpretation, and verification

Documentation is Essential

“If it isn’t documented, it didn’t happen” Viewed as a bother, but invaluable if a

problem arises No one method is mandatory (no one-

size-fits-all solution) But there are certain essential

elements

Range of Complexity

Simple anonymous survey or use of de-identified existing samples

Versus

Multi-site coordination of a double-blinded drug study with 12 visits over two years

Jargon

“Regulatory Binder” “Case Report Forms” “Source Documentation” (original

documents, data and records, such as hospital records, lab reports, subjects’ diaries, pharmacy records, etc.)

Jargon

Memo To File or Note to File An amendment is an amendment (Study personnel added via

amendment)

Approaches to research documentation

Chronological

By topic/section

Some combination of the two

Maintain copies of all final documents

History or ‘bread-crumb trail’ or ‘show your work’

Word-processing functions such as ‘track changes’

Header/footer use for version/dates Version Control: only one version is

‘active’ at a point in time Future electronic submission will

necessitate strict electronic version control

Important sections of a regulatory binder

Protocol (including all amendments and all versions)

Consent forms and HIPAA research authorization forms (approved by IRB)

Regulatory approvals (IRB, RSC, PRC, etc) and any required reapprovals

Important sections, cont’d

All correspondence, including emails, letters, faxes, notes of phone calls

Signature log, including name, initials, signature, dates of involvement, and study responsibilities

Recruitment materials, including letters, advertisements, flyers, website postings, etc (approved by IRB)

Delegation of Responsibilities Log SAMPLE FORM

Note: The PI is ultimately responsible for all aspects of the study. Title/Study #:__________________________________________________________________________________________________________ Principal Investigator: ____________________________Coordinator: _____________________ Facility/Department/Division:_____________________________________________________

*Record staff responsibilities using the following codes, list all that apply: A) Subject Recruitment D) Assesses Subject for Adverse Events G) Regulatory Reporting/Paperwork B) Obtains Informed Consent E) Administers Study Medications H) Data Management C) Performs Study Assessments F) Drug Accountability I) Other: _____________________

Training

Obligation PI Signature and Date Study Personnel

Printed Name Title Study Personnel

Role (e.g. PI, Investigator,

Coordinator,

Pharmacist, etc.)

Responsibilities* (List all letters

that apply) Date

Signature of Study Personnel

Initials of Study

Personnel Start Date

End Date

Important sections, cont’d

Samples of all forms to be used for data collection, including screening logs, eligibility checklists, case report forms, drug accountability logs

Assessment tools to be used

Any subject who signs a consent form is considered enrolled regardless of whether they are screen failures.

Use the appropriate number that applies. * ** *** Race/Ethnicity Screen Failures Reasons for Withdrawals 1. American Indian or Alaska Native 1. Subject did not meet entry criteria(s) 1. Subject's request 2. Asian 2. Subject withdrew consent 2, AE/SAE 3. Native Hawaiian or Other Pacific Islander

3. Lost to follow-up 3. Lost to follow-up

4. Black or African American 4. Other, specify in comments. 4. Protocol non-compliance 5. White 5. Death 6. More Than One Race 6. Other, specify in comments. 7. Unknown or Not Reported

Screening Enrollment Study Completion

# Screen Date ID # Gender

Race/ Ethnicity

*

Screen failure

Reason ** Consented By

Date ICF Signed

Date of Study Completion or

Early Withdraw

Reason for withdrawal

*** Comments 1

Hispanic

2 Hispanic

3 Hispanic

4 Hispanic

5 Hispanic

6 Hispanic

7 Hispanic

8 Hispanic

9 Hispanic

10 Hispanic

Important sections, cont’d

Any reporting requirements, such as Annual report to FDA Continuing review approved by IRB Adverse event reports Protocol deviation/violation reports Evidence of periodic monitoring (per the

protocol’s DSMP) DSMB recommendations (if any)

Important sections, cont’d

Versions of all sponsor materials, if applicable, including: Sponsor’s clinical protocol, Investigator’s Brochure, Amendments, Sponsor’s correspondence Records of monitoring visits

ICH Essential Documents

Those documents which individually and collectively permit evaluation of a trial and the quality of the data produced

Focus heavily on pharmaceutical- sponsored trials Include groups of documents, generated

before the trial commences, during the clinical trial, and after termination of the study

GCP Essential Documents

Many sponsor-related items, such as CVs of investigators 1572s Laboratory certifications Laboratory normal values Master randomization list with plan to

decode

Individual Subject Files

Consent form and RAF, signed and dated* Eligibility Checklist Enrollment note Visit flowchart Case report forms Lab data AE summary Patient diaries

Enrollment Note Template SAMPLE FORM

[It is recommended that investigators create enrollment notes when enrolling subjects into their study to document the consent process. This template is offered as a guide but investigators are encouraged to create their own study specific templates as appropriate or to use a written (rather than check list) form of enrollment note to fit their individual needs.] Title/Study #: Principal Investigator: Subject Name: _________________________ ID#: _________________________ Yes No 1. Subject has met inclusion criteria.

2. Subject has no exclusion criteria.

3. Informed consent was obtained prior to any study procedures being performed.

4. Subject was provided with an explanation of study procedures, risks, benefits, and alternatives, was given the opportunity to ask questions, and agrees to participate.

5. Subject was given a copy of the informed consent.

6. Contact information of research staff given to subject.

7. Additional information:

Signature ________________________________________ Date _____________

*Separate storage

Signed consent forms

Key linking identifiers to codes

Study Termination/Close-out

Final report Publication Retention and storage of regulatory

documents per requirements

More complex scenarios

Yale PI is the Sponsor-investigator of an IND, or the lead investigator on a multi-site study

Additional responsibilities, including maintaining CVs and training certificates of all personnel from all sites, and IRB approvals (and reapprovals) from all sites

Multi-site coordination

Lead PI is responsible for data integrity and data and safety monitoring

Monitoring is an evaluation of the clinical research process which should occur throughout the life of the protocol

Lead PI is responsible for informing all co-investigators of progress, and events such as SAEs, etc

Common Audit Findings

ICF Issues52%

Training21%

Eligibility16%

AEs11%

Famous Last Words

We always do our safety follow-up phone contacts.

The PI verifies all subjects’ eligibility before enrollment.

We ask about AEs at every visit.

The 1st Rule to Data Storage How do I store my data?

SECURELY!

Data Security

Recent developments: Loss of a CD with identified data Theft of a laptop with identified data Theft of a desktop computer with

identified data Theft of a briefcase with identified data

Best practices

Work in progress Several task forces working on these

issues Review some basics to think about

and incorporate into practice

Confidentiality

Common Rule has always required that confidentiality be protected to the extent possible

Good medical practice also incorporates pledges of confidentiality

Steps must be taken to minimize the risk of breaches of confidentiality

Common Rule definition

Private information includes information about behavior that occurs in a context in which an individual can reasonably expect that no observation or recording is taking place, and information which has been provided for specific purposes by an individual and which the individual can reasonably expect will not be made public (for example, a medical record)

Private information must be individually identifiable (i.e., the identity of the subject is or may readily be ascertained by the investigator or associated with the information) in order for obtaining the information to constitute research involving human subjects

HIPAA

Adds layers of ensuring privacy and data security

HIPAA Security focuses on electronic media, but Privacy covers all forms of data

Uses somewhat different definitions

Both CR and HIPAA

Need to get permission to access, share personal information, via consent or authorization.

If authorized, sharing is allowed per the specifics of the approved documents

Jargon

Anonymous Coded De-identified

Terms are not synonymous!

Jargon

Anonymous:1: not named or identified <an

anonymous author> <they wish to remain anonymous>2 : of unknown authorship or origin <an anonymous tip>3 : lacking individuality, distinction, or recognizability

Merriam-Webster, on-line

Jargon

Coded: a system used for brevity or secrecy of

communication, in which arbitrarily chosen words, letters, or symbols are assigned definite meanings

Dictionary.com

Implies there is a link somewhere

Jargon

De-identified: Not a word Usually thought to refer to stripping the

18 HIPAA identifiers (including dates) So may be more stringent than

anonymous, but also could be coded or not

Jargon

Anonymous is not de-identified nor coded

Some use the term ‘no identifiers’

Anonymous should be reserved for situations when there are no identifiers and no code to link back

Anonymous would allow recording of dates

Coded

Some code is used to track subjects and their data

Must be master file listing identifiers (name) with code to allow decoding, addition of new data

NEVER store the link with the data

Separate means separate!

Jargon

Moveable media: CDs, diskettes, jump drives, laptops, palm tops, Blackberry, flash drives, Encryption

Secure networks Password

protection

Advice

Do not keep data with identifiers on moveable media

May become more than just advice

Advice

“Tell them never to leave their laptops in the back seat of the car.”

Kristina Borror,

OHRP

Other methods to secure data

Password protection Fingerprinting Auto log-off Lock-down cables on laptops Restrictions on downloading

Confidentiality section of the HIC application

Describe all sites where data will be used or stored

Describe how the data will be transmitted or transported

Describe specifically who will have access Describe how the data will be secured If copies of data are on moveable media,

describe security measures for these media

Sharing with co-investigators

Avoid unprotected email Coded data best

Destruction

Old data/old computers Via ITS, Procedure 1609, Media Control:

http://mire.med.yale.edu/hipaapolicies/ When use or retention of any media containing confidential information

(including protected health information) is completed, the confidential information must be destroyed, rendered unrecoverable, or returned to the system owner.

The primary means for electronic media reuse is zeroing, or degaussing and the primary means for electronic media disposal is zeroing, degaussing, or physical destruction, as applicable to the medium.

Deleting data or reformatting the disk is NOT if electronic media contains electronic Protected Health Information or other confidential information.

Destruction cont.

Zeroing uses a disk utility (e.g., Data Removal Service software) to write “zero” to all areas of a disk, thereby overwriting any data that may be on the disk. Zeroing is required rather than simply formatting or initializing the disk which simply marks the disk as blank, so that it only appears empty - other disk utilities are available that can "unformat" the disk and recover the data, so formatting/reformatting is not an acceptable practice.

Degaussing or demagnetizing is a procedure that reduces the magnetic flux on the disk to virtual zero by applying a reverse magnetizing field. Degaussing a magnetic storage medium removes all the data stored on it.

In general, other electronic media (DVD, CD, diskette, zip drive etc.,) must be physically destroyed to be rendered unreadable.

Medical campus: use the online instructions or contact the ITS-Med Help Desk http://its.med.yale.edu/help/

Conclusions

Take steps to develop a specific document management plan tailored to the protocol

Take steps to implement data security measures

Stay tuned!

References

Common Rule: http://www.hhs.gov/ohrp/humansubjects/guidance/45cfr46.htm

ICH GCP: http://www.fda.gov/cder/guidance/959fnl.pdf

HIPAA Privacy and Security: http://info.med.yale.edu/hic/hipaa/index.html

Quotable Quotes

If it isn’t documented, it didn’t happen No one-size-fits-all solution How do I store my data? Securely! Bread-crumb trail Separate means separate An amendment is an amendment