Access to EHR by sponsor representatives in clinical trials

AI Summary

The Medicines and Healthcare products Regulatory Agency (MHRA) issued guidance for clinical trial sponsors, contract research organizations (CROs), and investigator sites regarding the management of personal data within Electronic Health Records (EHRs). While the document does not list specific calendar dates for inspections, it highlights recurring issues identified by MHRA inspectors during their assessments. Main violations include the inappropriate practice of printing EHR records for monitoring, which frequently results in incomplete medical histories, missing safety information, and the omission of critical annotations. Such practices increase the risk of data breaches and non-compliance with the General Data Protection Regulation (GDPR). Under the regulatory framework of ICH Good Clinical Practice (GCP) and UK data protection laws, the guidance mandates that EHR systems provide monitors with restricted, read-only access limited strictly to trial participants. Required actions for organizations include implementing two-factor authentication, maintaining robust audit trails, and ensuring that remote access originates from the UK, EEA, or countries with adequacy agreements. Sponsors must provide specialized information governance training and ensure employment contracts reflect personal accountability for data security. If system limitations currently prevent restricted access, sites should use short-term mitigations, such as guided screen-sharing, rather than printing. These measures ensure participant privacy while maintaining the integrity of source data verification necessary for clinical trial safety and reliability.