e SRA e Source Readiness Assessment e SRA

e. SRA e. Source Readiness Assessment

e. SRA introduction Health records used in hospitals Using EHRs as e. Sources for clinical research is rising. New Zealand These e. Sources need to be assessed before every clinical trial! Germany Ø Responsibility of the Sponsor Company!1, 2 Korea Ø Different questionnaires per Sponsor Company Japan Ø Big burden for sites to complete and followup every questionnaire USA Ø Very technical questions 0% 20% 40% Electronic Health records 60% 80% 100% Paper health records 1. EMA reflection paper on e. Source in clinical trials: ‘the sponsor must assess the systems in use by investigators to determine how well they meet the requirements of GCP’ (2010) 2. FDA guidance on use of EHR data in clinical investigations: ‘Sponsors are responsible for assessing the validity, reliability, and integrity of any data used to support a marketing application for a medical product. ’ (2018) 2 e. Clinical Forum

e. SRA introduction Example: Martini Hospital in Groningen, the Netherlands Ø 50 - 80 trials each year Ø Assessment Questionnaire every 2 weeks Ø Each sponsor has the same essence in their questions, but different wording Ø Time consuming to work through each questionnaire Ø >1 hour to read, determine the answer and to fill in the form Ø Wait for sponsor feedback Ø Rework in case of errors 4 May 2019 e. Clinical Forum

e. SRA – e. Source Readiness Assessment Ø Universal tool to assess readiness of site systems to provide e. Source for clinical trials, and evaluate and manage the risk. Ø Provided for free by the e. Clinical Forum to all sites, sponsors, CROs globally Ø Questionnaire based on FDA, EMA, PMDA, and ICH regulations and guidance documents. Ø Martini Hospital: e. SRA finished in 30 minutes www. eclinicalforum. com/esra 5 May 2019 e. Clinical Forum

e. CF Process for determining e. SRA Questions New or updated Regulatory Doc statements mapped to e. CF Requirement. e. CF REG discusses and discusses e. SRA Questions e. CF e. SRA Team determines e. SRA questions in format suitable for Sites to answer e. CF e. SRA Team discusses e. CF Requirements with regard to Investigator Site Systems 6 May 2019 e. Clinical Forum e. CF Requirements List updated

Regulatory Documents as Basis for e. SRA V 2019 • • • GCP E 6 R 2 7 • • 21 CFR Part 312: IND Application 21 CFR Part 11; ERES CSUCI Risk-Based Monitoring Guidance e. Source Guidance Mobile Medical Applications Guidance HHS: HIPAA FDA EHR in CR Guidance 21 CFR Part 56 IRBs 21 CFR Part 812 IDEs May 2019 • • EU / e. Source Reflection Paper Directive 2001/20/EC: Med Products for Human Use Annex 11: Computerised Systems Dir 2014/536/EC: CT on Med Products for Human Use IRT Reflection Paper Risk Based Quality Management Reflection Paper EU GDPR EU 910/2014 Electronic ID and Trust Services • ERES (Electronic Records / Electronic Signatures) Guidelines • Electronic trial data capturing in CT Guidance (JPMA) • Protection of Personal Information Act e. Clinical Forum

e. SRA Handbook & Writable. pdf Assessment Tool Downloadable for free without providing user info at www. eclinicalforum. org/esra 8 May 2019 e. Clinical Forum

What Healthcare Systems need to be Assessed? Investigator Site Systems Ø Any system that is originating patient data that is used in a regulated clinical trial should be evaluated for its suitability. Ø Examples: - Electronic Health Record Systems (EHR or EMR Systems) - Laboratory/Diagnostic Systems - Imaging Systems - Pharmacy Systems (if used to hold records of patient medication dosing) Ø Note: Only areas / modules of an electronic system that are being used to enter, store, manage, or otherwise handle records that will be used for clinical research need to be evaluated. For example, the portion of an EHR system that might be used to handle insurance claims would not need to be evaluated. 9

The e. SRA Questionnaire - 35 questions Content/Regulatory Areas - Records for Clinical Research – 4 questions - Attributability to the patient - De-identification of records - Saving patient Informed Consents and authorizations - Audit Trail – 3 questions - date, time, author, reason for change; readily available - System Date/Time – 3 questions - Controls for system date and time/ability to identify local time - System Administration by different individuals than those entering data - Access Control – 9 questions - Unique access method, restricted access permissions, appropriate training - Enforcement of regular password changes - Automatic logoff after inactivity, limitation of login attempts, recording of unauthorized login attempts, user report including user privileges 10 May 2019 e. Clinical Forum

The e. SRA Questionnaire – 35 questions Content/Regulatory Areas (continued) - Data Review – 2 questions - Data review incl. audit trail in understandable format, option to print source data for inspection and auditing - Data Backup, Retention and Recovery – 6 questions - Regular backup of the system to a separate, secure location. Validation of backup - Retention of source data for the legal period, including verification - Disaster Recovery and Contingency Plan - System Development and Maintenance – 8 questions - User Training - Good software development life cycle practices including changes, upgrades, patches, component replacements etc. - Regular validation of the system as installed at the site. Version control. - Exchange of data with other systems: data integrity and confidentiality - Installation and regular updates of antivirus software - Formal agreements with 3 rd parties - Electronic signatures 11 May 2019 e. Clinical Forum

FDA 2018: “… sponsors should consider whether such systems have the … privacy and security controls in place to ensure that the confidentiality, integrity, and security of data are preserved. ” § Records for Clinical Research (2) § Audit Trail (5) § System Administration Control (3) § Access Control/Data Security (9) § Data Review (2) § Data Backup, Retention & Recovery (6) § System Development & Maintenance (4) § Electronic Data Transfer (2) § Electronic Signatures (1) § Notification of Breach to Authority (1) § Total Questions: 35 12 May 2019 e. Clinical Forum

e. SRA v. 2019 Compared to e. SRA v. 2018 • One question deleted • One question added • 4 questions ‘if yes, please specify. . . ’ added, e. g; • Q 17. Does the system force users to change their password at established intervals or is there a documented manual process to ensure periodic change of passwords? If ‘yes’, please indicate in the comment block, the established interval. • Remote access is on the agenda for consideration for e. SRA v. 2020 Updates are based on feedback of its users and updates to underlying regulations and guiance! 13 May 2019 e. Clinical Forum

Success: e. SRA V 1 (Oct ‘ 15 – Mar ‘ 18) SW Vendors CROs Sponsors IRB Other Regulators e. Clinical Network Registrations (e. SRA) Sites 1960+ registered users 14 May 2019 1390+ registered organizations (1220+ sites) 510+ completed site assessments uploaded e. Clinical Forum Participation from 49 Countries Argentina Austria Australia Bahrain Belgium Bosnia-Herzegovina Brazil Canada Chile China Columbia Croatia Czech Republic Denmark Estonia France Georgia Germany Hong Kong Hungary India Ireland Israel Italy Japan Latvia Lebanon Lithuania Malaysia Netherlands New Zealand Norway Poland Portugal Russia Serbia Singapore Slovakia Spain South Korea Sweden Switzerland Taiwan Tunisia Turkey Ukaraine United Kingdom United Arab Emirates United States

Why should a sponsor choose to use e. SRA? • It is free to use! • Employees of the Sponsor do not have to research regulatory documents anymore regarding e. Sources • Specialised team of e. CF • e. SRA does not determine if an e. Soure can be used • Still up to the Sponsor Company to interpret e. SRA • Sponsor document is being created to assist sponsors in their use of e. SRA (expected 4 Q 2019) • Always open to feedback: e. SRA@eclinicalforum. org 15 May 2019 e. Clinical Forum

16 May 2019 e. Clinical Forum

For more information e. SRA: http: //eclinicalforum. org/e. SRA Article Applied Clinical Trials: http: //www. appliedclinicaltrialsonline. com/determining-if-data-electronic-healthrecord-systems-can-be-trusted-clinical-trial-setting Interview Ellen Rusch, Martini Hospital: http: //eclinicalforum. org/e. Source-Readiness-Assessmente. SRA/netherlands-initiative-to-assess-electronic-health-record-systems-using-ecf-esra-tool e. SRA@eclinicalforum. org 17 May 2019 e. Clinical Forum