View source for Reference:GBR Guidance Access to Electronic Health Records by Sponsor representatives in clinical trials 44447 System Security

{{ReferenceData
|has_document=Document:GBR Guidance Access to Electronic Health Records by Sponsor representatives in clinical trials 44447
|module=4
|unit=4.3.4
|scope=G
|doc_part=System Security
|language=EN
|entry_by=Florian Adragna
|contributors=
|tags=TAG-00127-Com-meC ++ TAG-00294-Rem-gFe ++ TAG-00063-Dat-per ++ TAG-00017-Spo-die ++ TAG-00137-Mon-che
|tags_display=[[Glossary:TAG-00127-Com-meC|Systems validation]], [[Glossary:TAG-00294-Rem-gFe|Remote access]], [[Glossary:TAG-00063-Dat-per|Data protection]], [[Glossary:TAG-00017-Spo-die|Sponsor]], [[Glossary:TAG-00137-Mon-che|Monitoring]]
|comment=System security for remote access monitoring
|content=System Security
[...]
There should be the implementation of robust security procedures by the sponsor and investigator site/institution, such as; password criteria and renewal rules, firewalls, virus and malware protection, penetration testing (to identify vulnerabilities), system monitoring for detection of inappropriate/unusual activities/intrusions and changes to network configurations, threat intelligence software, physical security considerations at data centres and timely implementation of any security updates/patches.
[...]
Controls Implemented by the Sponsor (or authorised delegated party, e.g. CRO)
[...] 
3. Remote Log-in Access to the EHR system at UK sites must only be undertaken from a physical location in the UK, an EEA state, or another state covered by a UK adequacy decision
4. The device through which remote Log-in Access to the EHR system is used should be provided by the sponsor, or the sponsor should have undertaken an assessment of the security processes applied to the device(s) [...]5. The sponsor must not record any video calls where screen sharing of guided direct access or of paper source documentation has taken place. There must be no records of any trial participant information in any “chat” function of the remote video call.
[...]
6. The model clinical trial agreements require that Monitors (or Auditor) are suitably trained to understand information governance requirements. There should be training courses put in place by the sponsor to cover the protection of trial participants’ data confidentiality in relation to the contractual obligations of the sponsor with the investigator site/institutions. [...]
}}