UK Warns Against Printing Out EHRs For Clinical Trial Monitors
MHRA Has Confidentiality Concerns, Offers Short-Term Fix
Executive Summary
New UK guidance explains how clinical trial sponsors and investigator sites can ensure that trial monitors securely process data in electronic health record systems that do not have a restricted access functionality.
The UK medicines regulator has criticized the practice at some clinical trial sites of printing out electronic health records (EHRs) to support their review and verification by trial monitors as part of source data verification activities.
Printing out EHRs “risks the loss of some or all of the data should it need to be moved within the site” and “creates a risk of inappropriate disclosure, distress and harm to patients, data breach and possible enforcement action,” the Medicines and Healthcare products Regulatory Agency has warned.
To address the issue, the MHRA and the UK Health Research Authority (HRA) have jointly issued guidance explaining how sponsor-appointed trial monitors should be provided with on-site access to EHRs.
The guideline was developed in consultation with the Information Commissioner’s Office. It should be read in conjunction with the MHRA/HRA joint advice on Data Protection Impact Assessments, which deals with the management of personal data processed for the purpose of healthcare research.
Short-Term Fix
A key challenge with using EHRs is ensuring that records of patients who are not participating in the trial - but are maintained on the same system - are not accessed by the trial monitor.
The MHRA/HRA guideline states that EHR systems should ideally be designed to ensure that a trial monitor’s access is limited to the records of clinical trial participants and that this access is auditable. Where EHR systems have not been designed to allow this, it “should be addressed at the next system update,” but “resorting to printouts” in the meanwhile “is not an appropriate mitigation.”
The guideline recommends using other short-term solutions, such as relying on the information governance obligations imposed upon sponsors and their representatives through model clinical trial agreements. These model agreements are standard templates for industry-sponsored clinical trials used by hospitals under the National Health Service (NHS) and include, among other things, obligations for trial monitors to process the data of clinical trial participants securely. (Also see "UK govt plans to refine "model" clinical trials agreements" - Pink Sheet, 10 Sep, 2009.)
The model agreements also include provisions for trial monitors to hold employment contracts with the sponsor, contract research organization or the authorized delegate. “This provides for personal accountability and sanctions for breach of confidence or misuse of data… [including] accessing EHR data of persons other than relevant clinical trial participants,” the guideline explains.
In addition, the standard training provided to trial monitors on using the specific EHR system should cover actions to be taken in the event of any inadvertent breach. The MHRA/HRA believe it is not appropriate or necessary for trial monitors and investigators sites to enter into further non-disclosure agreements.
Inspection Findings
During inspections, the MHRA has come across instances of some NHS organizations printing out medical records for monitors to review where EHR systems do not have the restricted access functionality.
Inspectors have seen several problems with this approach. These include:
-
- Gaps in printouts as reports are generated from one date to another and these are not always continuous. In some cases, this has resulted in weeks of missing data and also missing safety information.
- Information held in “annotations” in the systems not being printed out, such as causality assessment for adverse events.
- The printing process placing a burden on investigator sites.
In addition, there are concerns that the printed data may be out of date (due to the time taken to collate it) or incomplete (due to incompatibilities in the IT system). This could increase the risk of breaching the EU General Data Protection Regulation and may have a negative impact on the clinical trial.
Moreover, the MHRA is concerned that printouts can get misplaced. “When paper patient records are lost (or found in places where they are not supposed to be) there is a significant impact on public trust,” it said.