Reference:GBR Guidance Access to Electronic Health Records by Sponsor representatives in clinical trials 44447 -

Document information
Reference	GBR Guidance Access to Electronic Health Records by Sponsor representatives in clinical trials 44447
Validity area	GBR
Scope(s)	G
Document name	Guidance Access to Electronic Health Records by Sponsor representatives in clinical trials
Version / Revision	2021-09-08 00:00:00
Status	Current
Document type	Official recommendation
Language(s)	EN
Description	Guidance Access to Electronic Health Records by Sponsor representatives in clinical trials The following guidance has been jointly developed by the Heath Research Authority (HRA) and MHRA, in consultation with the Information Commissioners Office (ICO), on behalf of the UK.
Official source	Official link
Restricted access	No
Submitted by	Florian Adragna
Contributors

Reference Details
Module	Module 4 — Unit 4.3.4
Scope	G
Document part	-
Language	EN
Original entry by	Florian Adragna
Contributors
Tags	Direct access, Remote access, Monitoring, Audit, Real-world evidence
Comment	Remote direct access to EHR by sponsor monitors or auditors

Content

Remote direct access to Electronic Health Records (EHR) by Sponsor Monitors (or Auditors) in clinical trials [...] Remote direct access to the health records of clinical trial participants may be undertaken by the Monitor (or Auditor) logging into the EHR system (‘Log-in Access’) remotely rather than onsite or via video calls, where investigator site/institution personnel use screen sharing of EHR systems (‘Guided Access’) or to display original paper records. Log-in Access requires far less investigator site/institution personnel involvement during the review so it is preferable and should be fully considered and discounted prior to using Guided Access.

The investigator site/Institute may upload scanned or electronic copies of source documents into a secure portal (‘Upload Access’). This however would not be considered direct access unless it is a complete and certified copy of the EHR system in an investigator provided portal. [...] Use of Internet Document Sharing Portals to share trial participant source documents Where the portal is provided by the sponsor (or delegate), there must be redaction by the investigator/institution of any data that may directly or indirectly identify the participant. To protect the privacy of the trial participant only the participant trial identification number must be used. These records should be deleted after the Monitor (or Auditor) has completed the review. The details of who will perform the deletion and when, should be prearranged between the sponsor and the investigator (for example, the deletion could be after all data queries for the participant have been resolved and the case report form locked or when an audit, if conducted, has completed).

For portals provided by the investigator site/institution, unredacted scanned or electronic source documents may be uploaded. The investigator/institution should consider the applicable requirements for direct Log-in Access to the EHR system set out below when using such a portal. [...] The process for the provision of the documentation should not put an excessive and unreasonable time burden on the investigator site/institution personnel or excessive and additional costs on the investigator site/institution that has not been agreed beforehand. [...] Consideration of Participant Consent [...] Supplemental information concerning method of the Monitor (or Auditor) access is available and should be provided to the participant in the participant information sheet by including the link to the HRA website: http://www.hra.nhs.uk/patientdataandresearch in the GDPR transparency statement. This web page should also be provided by the investigator to the trial participants as a paper copy upon request by the trial participant (for example if the participant cannot access the internet).

EHR System Functionality It is recognised that some EHR systems may not have the necessary functionality to allow Log-in Access, whether remote or on-site. [...] To facilitate Log-in Access to the EHR system, the EHR system should have the following functionality in addition to restriction to trial participants set out above: 1. To forbid changes to the data and information in the EHR system by the Monitor (or Auditor) [...] 2. [...] user access controls with two-factor authentication [...] 3. [...] automatic time-out, where the user is logged out of the EHR system following a period of inactivity 4. To prevent unnecessary and inappropriate copying and sharing of information from the EHR, the EHR system should restrict printing, copying, and downloading [...] 5. Monitoring (or auditing) activity using remote Log-in Access to the EHR system should only be undertaken when investigator site/institution staff are aware of and have agreed to it happening, as per on-site visits [...]