Skip to content

Office of Quality Compliance

Main Navigation

UUSOP-06: Study Records Management

Version Date: Nov 17, 2023

  1. Introduction and Purpose
  2. Definitions and Acronyms
  3. Procedure
    1. Standards and Responsibilities
    2. Source Entry and Corrections
    3. Study Participant Charts
    4. Regulatory Binder (Trial Master File)
    5. Maintenance and Storage of Study Records
    6. Monitoring and Auditing of Study Records
    7. Study Record Close-out
    8. Archiving Study Records
  4. Materials Required
  5. References
  6. Document Approval
  7. Revision History


Introduction and Purpose 

The purpose of this SOP is to describe the methods for the collection and maintenance of study records in the conduct of clinical research at the University of Utah and applicable covered entities.

FDA regulations and GCP guidelines require the investigator and institution to maintain all information in original records of clinical findings, observations or other activities in clinical research necessary for the reconstruction and evaluation of the study.

Subject-specific records (study participant charts) are compiled for each study subject and contain source documentation of research records such as the signed informed consent form, medical history, medication logs, treatment records, protocol assessment results, and adverse events.

General study records such as current and past versions of the study protocol and informed consent form, IRB approvals, investigator’s brochure, training records, delegation of authority log, and monitoring reports are maintained in the regulatory binder.

Not all documents will be consistently utilized for every type of study but in general, the principles of this procedure will be the same across all types of clinical research. 

 

Definitions and Acronyms 

Clinical Research: Clinical research includes all research involving human participants. It does not include secondary studies using existing biological specimens or data collected without identifiers or data that are publicly available.

Clinical Trial: Clinical trials are clinical research studies involving human participants assigned to an intervention in which the study is designed to evaluate the effect(s) of the intervention on the participant and the effect being evaluated is a health-related biomedical or behavioral outcome.

Source Data: All information in original records of clinical findings, observations, or other activities in a clinical trial necessary for the reconstruction and evaluation of the study.

Source Documents: Original documents, data, and records (e.g., hospital records, clinical charts, laboratory reports, subjects’ diaries, pharmacy dispensing records, radiologic scans and imaging records, etc.) on which source data are recorded.

CRF: Case Report Form
CRO: Contract Research Organization
EHR:        Electronic Health Record
FDA: United States Food and Drug Administration
GCP: Good Clinical Practice
ICH: International Council on Harmonization
IRB: Institutional Review Board
PHI: Protected Health Information
PI: Principal Investigator
SAE: Serious Adverse Event
SOP: Standard Operating Procedure



Procedure 

  1. Standards and Responsibilities
    1. Documentation of source data is necessary for the reconstruction, evaluation, and validation of clinical findings, observations and other activities of a clinical research study. Source documentation serves to corroborate the integrity of study data and confirm observations that are recorded.
    2. The PI is ultimately responsible for the collection and maintenance of research records, and to ensure the accuracy, completeness and availability of these records in the conduct of a study. However, the PI may assign study record tasks to sub-investigators or coordinating staff, as indicated on the delegation of authority log or other delegation process.
    3. Clinical research data recorded on source documentation should be:
      • Attributable: the origin or source of the data should be identified and recorded as part of the record. This includes an audit trail for electronic and automated records, and signature/initials and date for record entries. All source documents should also include study-, subject- and visit-identifiers, as appropriate.
      • Legible: data and records should be clearly capable of being read and interpreted.
      • Contemporaneous: data should be recorded at the time of the event or observation.
      • Original: represented by the first entry or recording of the data.
      • Accurate: the data should be a true reflection of the original observation or results; errors should be corrected appropriately.
      • Complete: study records should contain all information and data pertaining to the study and subject’s health (e.g. adverse events) throughout participation.
    4. The study protocol will identify the screening (including medical history) and baseline assessments, study procedures and interventions, and follow-up assessments that must be completed as part of the research.
      1. Source documentation should be created and compiled (as originals or copies) in the study participant chart to demonstrate compliance to each eligibility criterion, each protocol requirement, and to provide evidence for validation of each case report form entry.
        1. PI/Sub-I review and signoff of participant eligibility should occur prior to study enrollment. 
        2. In rare instances, such as studies with rapid enrollment, it may not be possible to obtain official PI/Sub-I signoff on eligibility before enrolling and initiating study procedures. For such studies, an alternate signoff process may be appropriate (e.g., email or phone review and confirmation). Any alternate process would require all of the following elements:
          1. The alternate process for eligibility review and PI/Sub-I signoff must be included in the IRB application prior to implimentation.
          2. Details regarding the PI/Sub-I review and confirmation of eligibility must be recorded on the documentation of informed consent form (or equivalent), followed by official PI/Sub-I signoff on the eligibility checkist as soon as possible, but within 72 hrs.
      2. Source data may be recorded directly into the CRF, when specifically outlined in the study protocol or other study documents.
    5. EHR systems used by the University of Utah and applicable covered entities utilize electronic signatures and have audit trail functions. However, these systems are not validated or documented as compliant with 21 CFR Part 11, as the FDA does not intend to assess the compliance of electronic health records with Part 11.
  2. Source Entry and Corrections
    1. Recorded observations used as source data must be signed/initialed and dated by the PI or study team member making the source entry.
      1. Electronic records (e.g. EHR) are signed electronically. Printed copies of EHR source documents may be included in the study participant chart- these documents should include the electronic signature and date stamp on the printed copy.
        1. The practice of transcribing source data from the EHR to a “study visit form” or “source worksheet” prior to CRF entry should be avoided as much as possible. This introduces an additional transcription step and additional chance for error.
      2. When creating source data, blue or black ink should be used – never use pencil, do not write-over original entries, never obliterate the original entry with correction fluid, markers, etc. and do not backdate entries.
    2. All source documents should contain clear identifiers that associate the document with the trial (e.g. study title, study number), study participant (e.g. subject number, initials), and study visit (e.g. date, visit number, cycle).
    3. If an error is discovered on a source document, it should be corrected appropriately.
      1. Handwritten source data are corrected by drawing a single line through the incorrect information, adding the correction adjacent to the original entry and completing the entry with initials, date and reason for the change (if necessary). The original entry must not be obscured.
      2. The EHR and other automated systems used to create and maintain electronic source documents should have an audit trail to document any corrections made to the source. 
  3. Study Participant Charts
    1. Study participant charts should be organized consistently across all subjects.
      1. Charts should be organized with documents filed in reverse chronological order, with the most recent documents on top. A consistent template for chart organization to should be adhered to for all study participants enrolled in a particular study. A separate chart may be kept to compile detailed records for subjects that do not enroll and are considered screen failures.
    2. For a detailed list of documents that should be filed in the study participant charts see UUSOP-06 Supplement A.
    3. Study Participant Charts should be maintained current and updated after each study visit or on a regular (e.g. monthly) basis until the subject’s study participation is complete.
    4. Some studies may have a mix of paper source documents and source either directly entered into the electronic data capture system or stored electronically (e.g EHR). In these cases, an outline where to find each source document is helpful to avoid confusion during inspections. This outline should include details of what data is directly entered into the CRF and therefore will not have a corresponding source document.  
  4. Regulatory Binder (Trial Master File)
    1. Essential documents and general study records should be collected and maintained in the Regulatory Binder/Trial Master File (in paper or electronic format).
      1. A consistent template for regulatory binder organization should be adhered to.
    2. For a detailed list of documents that should be filed in the Regulatory Binder see SOP 006 Supplement A.
    3. Some essential documents such as the Delegation of Authority log and Screening log may be updated with new entries throughout the conduct of the study. If new documents are issued with updated information (e.g. protocol amendment, renewed medical license, change in financial disclosure, etc.) the original and updated documents should be maintained in the regulatory binder.
    4. If any essential documents above are maintained electronically, or in a central location, a note-to-file should be placed in the regulatory binder to indicate the location of these records.
  5. Maintenance and Storage of Study Records
    1. Study participant charts and regulatory binders should be maintained current and up-to-date throughout the conduct of the clinical research.
    2. All research records containing PHI must be maintained in an area of restricted access during work hours, and in a locked room or cabinet after hours or when not in use.
    3. Records created or maintained in the EHR are considered source documents. Copies of these records from the EHR that are included in the study participant charts are not considered source documents and do not need to be certified as such.
  6. Monitoring and Auditing of Study Records
    1. All subject and regulatory records (including electronic) must be made available for review by sponsor representatives, University compliance offices, IRB auditors, departmental monitors/auditors, regulatory inspectors, and other authorized individuals.
    2. When using an electronic data capture system for direct source entry, or when storing study records electronically, consideration must be given whether the system/program has the capacity for external review by the entities listed above. 
    3. All monitors external to the University are required to complete a HIPAA training module and sign a confidentiality agreement to gain access to electronic systems, for both on-site and remote-based monitoring. The confidentiality agreement only needs to be completed once, unless the University makes substantial changes to the agreement and requires re-signature, and the HIPAA training must be completed annually for each external monitor. 
      1. Confirmation of appropriate documentation must be performed prior to granting external monitors access to electronic systems. For monitoring through eReg and EpicLink (see sections 6.4.1 and 6.4.2 below), the confirmation is performed automatically. However, for all other electronic systems (see section 6.4.3 below), study teams are responsible for confirming appropriate monitor documentation prior to granting access.
      2. The Research Study Monitor Confidentiality and Non-Disclosure Agreement is available here: https://pulse.utah.edu/dc/Documents/Confidentiality%20Agreement%20-%20Research%20StudyMonitor.docx?d=w2d738af39015499fae84f34f3d0257cf 
      3. The HIPAA Training is available here: https://healthcare.utah.edu/patient-privacy/students.php
    4. The electronic review of study documents may be performed through the following systems/methods:
      1. eReg:
        1. Is a 21 CFR Part 11-compliant electronic regulatory management system.
        2. Is the preferred method for sharing all regulatory records associated with clinical trial monitoring/auditing activities.
        3. Is the required method for sharing all regulatory documents with monitors/auditors of investigator-initiated clinical trials holding an IND/IDE at the University of Utah (for a definition of IND/IDE, see UUSOP-11 and -12, respectively).
        4. For complete information regarding eReg procedures, training, access, tips and frequently asked questions see: https://ctsi.utah.edu/crso/oncore/ereg.
      2. Epic Link
        1. Epic Link is a secure, HIPAA-compliant web portal that provides study monitors/auditors with read-only access to electronic health records (EHR) of study participants stored in “Epic”, the University of Utah Health's medical record system.
        2. Epic Link is a University-supported method for sharing Epic EHR documents.
          1. Epic Link cannot be used for sharing medical records from other EMR systems, such as Cerner (used by Primary Children’s Hospital).
        3. For complete information regarding Epic Link procedures, training, requesting access, tips and frequently asked questions see: https://ctsi.utah.edu/crso/oncore/study-monitor.
      3. Other Services and Platforms:
        1. The use of other services and platforms to share clinical research regulatory and participant records must adhere to the requirements of University Policy 4-004.
          1. PIs and/or designees are responsible for knowing the types of data that are being shared for review/audit, as defined under Rule R4-004C, and ensuring that study records are only stored and shared through services/platform approved for the data type.
          2. University-approved and -managed platforms/services for restricted and sensitive data are the prefferred method for storing and sharing research data and materials. PIs and designees should make reasonable efforts to use University-managed solutions.
            1. Storing and sharing study records with a monitor/auditor using a platform/service listed in the University-approved and -managed platforms/services table requires use of the University instance. The University Office of Software Licensing can assist with access and setup (https://software.utah.edu; software@utah.edu; 801-581-4000 x 1).
          3. Storing and sharing study records with a monitor/auditor on a service/platform not currently managed by a University organization and not listed in the University-approved list will require approval by the Vice President for Research Office (VPR), or designee. The PI/designee must present a valid business need to justify using an alternative service or platform. If approved, the PI/designee must contact the University Purchasing Department (askme@purchasing.utah.edu; 801-581-7241) to determine the required procurement process, in accordance with Policy 3-100: University Procurement. The Purchasing Department will coordinate with other University offices as needed to ensure storage and access terms (e.g., Compliance Services, Information Security, Information Privacy, the Office of General Counsel, and others).
          4. The use of personal storage options (e.g., personal instances of cloud-based platforms) are not allowed.
        2. Cautions/Considerations: When granting monitor/auditor access to study records located on cloud-based platforms, take special care to remember:
          1. Set time-limits for access. If unable, remember to remove access upon completion of the monitoring event.
          2. Set read-only access. Remote downloading of EHR documents by the monitor during remote review is prohibited. Any request for duplication of study documents must be made to the study team, who will facilitate the secure delivery of requested documents.
          3. Be thoughtful when granting access to avoid mistakenly granting access to unauthorized persons.
          4. Prevent unintentional access to downstream folders/files when granting access to folders containing sub-folders.
          5. Prevent unintentional file caching from the use of sync folders on local machines (e.g., BoxDrive).
  7. Study Record Close-Out
    1. Prior to closing a study, a complete study record should be established. 
      1. Regulatory, Participant, and Investigational Product records should be reviewed, verified for completion, and filed appropriately.
      2. Documents that require PI review and signature at close-out, such as Delegation of Authority, Adverse Events, and Deviation Logs, should be completed.
      3. Once all documents are verified as complete, they should be filed appropriately.
        1. If documents have been filed in separate locations, as discussed in section 4.4, consider returning the document to the pertinent study binder at the conclusion of the trial.

    2. For a detailed checklist of closeout tasks and activities, refer to the Closeout Checklist provided in the Toolkit, here: https://qualitycompliance.research.utah.edu/toolkit.php.

  8. Archiving Study Records
    1. For a period of time following completion of a clinical study, the study records may be examined and subject to review by internal departmental monitors/auditors, or externally by the study sponsor or FDA inspectors.
      1. The PI should retain secure possession of the study records on-site after study completion for a reasonable period of time for potential review.
    2. FDA investigational drug and device regulations state that the PI is required to maintain study records for 2 years following the date a marketing application is approved; or, if no application is to be filed or if the application is not approved for such indication, for 2 years after the investigation is discontinued.
    3. After maintaining the study records on-site for a period of time, the clinical research records may be moved for long-term archiving to University Archives and Records Management, or another appropriate and secure archive system.

 

Materials Required 

  • Study source documents and general study records
  • Access to the EHR system

 

References 

 

Document Approval 

Erin Rothwell, Ph.D.
Interim Vice President for Research, University of Utah
DATE: December 7, 2023

 

Revision History 

Version Date

Change Summary

09Aug2019

Original Version

26Jun2020

Version #2 – minor updates for clarity and ease of reading

17Nov2023

Addition of section 1.4.11 regarding alternate processes for PI/Sub-I review and signoff of participant eligibility; addition of section 6.3-6.4 regarding systems for monitor/auditor access to study records; addition of Section 7. Study Record Close-out

 

Printed or photocopied versions are considered unofficial copies unless it is the original signed document.

Last Updated: 3/22/24