eSource Redux

This month, at the request of the editors, I will deviate from my usual format to address a recent Guest Commentary by my colleagues, Stephen Raymond and Gerald Meyer. My purpose is several-fold. First, this commentary published in the June Applied Clinical Trials discusses an old column of mine (Applied Clinical Trials, May 2001) addressing the concept of eSource. The issue is a very important one, and is not yet the subject of any specific guidance by the FDA or other regulatory authorities. As such, it is essential to air the full spectrum of thinking on this topic. Dr. Raymonds views map to one end of the spectrum, while I have often propounded the other end. Second, there appears to be a shift in the FDA approach to eSource involving trusted third parties that is very important to discuss and fully understand, as it may affect all clinical trials with a centralized data source, not just eSource trials. The introduction of the trusted third party concept doesnt appear in regulation or guidance, but has been discussed openly in public conferences and informal FDA meetings, and is being implemented by many sponsors of Web-based clinical trials.

I will start with a prcis of the position of Dr. Raymond and Mr. Meyer. They argue that technology providers often amplify or limit aspects of regulation that extend beyond the actual regulation. In doing so, the technology providers can inhibit sponsors from having the courage to use technology to its fullest advantage. The specific example cited is that of eSource. They argue that, in my column, I have added words like investigator control or local control that go beyond the regulations which require the investigator to prepare, maintain, and retain case histories. They are concerned that I put a burden of local ownership on the investigator that goes beyond the literal and intended meaning of 21 CFR 11 and related guidance. There is much more depth and subtlety to their argument, and I refer the reader to both my original column and this commentary (Applied Clinical Trials, June 2002) before proceeding.

This is a good opportunity for me to share my regulatory philosophy and perspective with you. In my other life (other than a columnist, that is) I am the founder of a company that sells a Web-based clinical trial data management system. It is one that technically works equally well as an eCRF or as an eSource system. My approach to regulatory issues is not biased by the architecture of the EDC system my company developed. In fact, the system was built around my philosophy. In any case, I base my approach on several fundamental principles. The first of these principles is regulatory conservatismI dont believe in pushing the envelope to its greatest point. Rather, I would prefer to take a more conservative stance and let others be on the bleeding edge when regulatory issues are involved.

Secondly, I fundamentally disagree with the strict constructionism expressed in the guest commentary. Dr. Raymond and Mr. Meyer state: So one looks primarily to the regulations and the guidance. These do constitute what FDA in the full force of its deliberations wants. Here is where I deviate in my thinking. Much of the principle and practice of the U.S. pharmaceutical industry derives from the collective results of individual interactions with the FDA. Regulations hold the force of law and must be adhered to; guidance helps interpret regulations but doesnt hold the force of law. However, much of the practice of GCP, for example, was established over decades through modifications developed through discussions with FDA officials, the results of field audits, and discussions at both public and private (company) meetings. The concept of a three-part NCR form, double data entry, and other similar concepts used in the collection of clinical data in paper-based clinical trials did not arise in regulation or specific guidance. They were developed through collective interpretation of years of interactions with the FDA.

Similarly, key officials of the FDA (always confirming that they are expressing their own opinions and not that of the agency) have discussed eSource in public and private meetings, Food and Drug Law Institute (FDLI) public teleconferences, and elsewhere. Unfortunately, we do not yet have field inspection reports and other FOI documents to add to this interpretation. But these will follow over time.

As someone who follows this area very closely, I will try to summarize the consensus of these comments, as I see it. I have heard these in many open meetings, a number of closed meetings, and several explicit discussions with FDA officials. Even if I am exactly right about this today, I may be wrong tomorrow, as the area is still in flux. The disclaimer is that these are my opinions only, and dont hold the force of law.

The investigator must maintain case histories. This is directly from GCP 21 CFR 312 62.b. These are the investigators records, and he or she must prevent them from being modified without their knowledge. Though you wont find this phrase in 21 CFR 312, it is a fundamental principle of clinical research. It is the reason that three-part NCR CRFs existso that the investigator maintains an original copy of the CRF data.

Electronic data makes this much more complicated. Electronic medical records are often collected and stored by a hospital offsiteperhaps hundreds or thousands of miles from an investigator. Such reports shouldnt be a problem as an eSource if the investigator has access to these records and the hospital or data center are agents of the investigator in some way. This is the typical arrangement, required by law in many states. There should be no concern here if the systems are of sufficient quality to qualify as medical records. The problems with eSource arise when considering eSource into an electronic CRF. In this scenario there is no patient data other than that collected on an electronic CRF. There are three versions of this scenario, all with different implications for GCP. In each scenario the FDA has made it clear that the systems, validation, and adherence to operating procedures around the eSource trial would be subject to very close scrutiny, as the integrity and attributability of the data rested entirely in an electronic system. The three scenarios are:

Scenario A. The eCRF collects the data locally on the investigators computer, or within the investigators network (centrally at a hospital, for example). This scenario doesnt represent an issue as long as proper security, validation, and data integrity precautions are followed concerning the local computer. The FDA has accepted primary electronic data for years and would not object to this methodology because it represents local investigator maintenance of the record.

Scenario B. The eCRF collects the source data centrally into a server at a sponsors site. This is the most problematic of scenarios. It is the equivalent of an investigator sending all three copies of a paper CRF in for data entry. Even if one copy came back to the site for permanent storage, the attributability (a key component of the ALCOA provisionsattributable, legible, contemporaneous, original, accurate highlighted in the Guidance on Computerized Systems Used in Clinical Trials) of the data would be lost. Because the sponsor administers the clinical trials system and database, they could theoretically modify the data without the investigators knowledge. If a copy were later given to the investigator for archival purposes, there would be no way for the investigator to prove that it had not been modified.

One could argue that strict SOPs could obviate a problem, but the stakes and ease of manipulation are too compelling to permit this at this time. Perhaps over time, and with the use of a foolproof encryption schema (which is probably impossible to achieve) such a scenario could be allowed. However, it is my understanding currently that eSource directly into a sponsors server would not meet the FDA standards of GCP.

Scenario C. The eCRF collects the source data centrally into a server at a trusted third party (TTP). This concept has only recently been articulated by the FDA (the earliest public mention of this that I am aware of was November 2001 at the FDLI phone conference). Essentially, the TTP hosts the trial and maintains the database and trial software.

Because the sponsor pays for the TTP, it may reasonably be assumed that the TTP is the sponsors agent. Therefore, SOPs or other procedures must clearly establish that the TTP acts, in reference to the data, as the investigators agent. If the SOPs are properly written to ensure that a record may not be changed without the investigators permission and knowledge, and appropriate safeguards are in place (perhaps a contract between the TTP and the site, or rigorous SOPs concerning data access and modification), then it should be possible to perform an eSource trial using a TTP.

When contemplating a TTP, one needs to keep the principles of GCP in mind. If the TTP hosts the trial, but all administration of the system and database are performed by sponsor personnel, this might not be viewed as substantially different from Scenario B. The TTP must give assurances (either contractually, or otherwise) to the investigator that their data will not be modified without their express knowledge.

The relationship between sponsor and TTP is one that is not yet clearly defined in practice or in guidance. As above, a simple hosting facility might not suffice. On the other end of the spectrum, a CRO that accepts Transfer of Obligations from a sponsor under GCP might also be seen as a sponsors representative rather than an investigators. Only time and experience will help to define these various possibilities.

In summary, it is certainly possible under current interpretations of GCP to perform clinical trials for submission using an eSource strategy for data collection. While the landscape is ever shifting, it is currently difficult, if not impossible, for companies to adopt eSource with confidence. The time has come for the FDA to directly address this issue through specific guidance. Only then will this argument be settled in a way that gives the industry sufficient comfort to proceed.