Electronic Record Retention per FDA Requirements - Electronic Data Capture (EDC)

[SongCoyote]

Greetings!

I work for an Electronic Data Capture (EDC) software company serving clinical trials. Our record retention policy for customer data collected via our system mirrors the essential requirements of QSR and ISO.

We just had a customer request that we destroy their data once the study closes and they have collected it. We would of course be willing to make an exception to our internal retention policy at customer request (with that decision documented in the contract, etc.) but I am wondering if that would put us in violation of the FDA retention policies.

What I have been able to find reading through related sections is that under most circumstances the data has to be available where it was created, and that ultimately the sponsor and CRO have responsibility for it. But this doesn't directly answer whether we can, even at customer request, destroy what amounts to our copy of their data.

Any advice on this would be gratefully accepted. Thanks for your time and consideration.

Regards,
Gareth Storm

[Wes Bucey]

If I were in your organization's position, I would prefer to request an official ruling from FDA rather than count on us "experts" here in the Cove.

At first blush, my guess would be that your organization is no more responsible for record keeping in the situation you pose than an ISP or telephone utility would be as an adjunct to transmitting data from one point to another. They keep a record of the transaction for billing purposes, but the phone company does not keep a recording of the phone conversation. I can imagine a scenario where a worker in the field collects data and transmits it to the home office - (Is he responsible for keeping an original? I doubt it.)

[SongCoyote]

Thank you for the response, Wes - I appreciate your time.

Since we have never been inspected by FDA (knock on wood) and are unlikely to be because of our position in the clinical food chain I am reluctant to seek out their attention. Given how much of an edge case this is I might have to do so, though, unless my educated theory coupled with your "first blush" are accurate.

The data we carry is more sensitive in some ways than most phone conversations, but I think your analogy makes sense. Thanks again!

Cheers,
Gareth

[Wes Bucey]

In Reply to Parent Post by SongCoyote

Thank you for the response, Wes - I appreciate your time.

Since we have never been inspected by FDA (knock on wood) and are unlikely to be because of our position in the clinical food chain I am reluctant to seek out their attention. Given how much of an edge case this is I might have to do so, though, unless my educated theory coupled with your "first blush" are accurate.

The data we carry is more sensitive in some ways than most phone conversations, but I think your analogy makes sense. Thanks again!

Cheers,
Gareth

For the most part, the anecdotal evidence I get from ASQ Section members who are in Big Pharma and Medical Devices here in my geographic area tells me the FDA inspectors are different from FAA inspectors in that higher level FDA officials do not blindly defend a questionable call by an individual inspector, but will listen to a reasoned explanation bolstered with documents (in your case, a customer contract which essentially makes your organization a mere "agent" for your customer versus an independent arm's length transaction where your organization develops data independently and sells it to a third party, retaining responsibility and liability for the accuracy of the data.)

Woe betide, however, the organization which tries to foist off responsibility on an individual or organization just to avoid liability for itself. The biggest pharma in my area tried to lay bad record keeping at the doorstep of some low level employees, citing "job responsibilities" which tried to quarantine responsibility from the organization and its top managers. They ended up paying millions in fines and even more millions implementing safeguards PLUS giant consulting and legal fees PLUS having a major production line closed for over a year by the FDA.

Thus I repeat: "This is a situation which "could" bite you in the butt. Better to take the chance on scrutiny now." The very fact of "hiding your head in the sand" (by saying, "What I don't know can't hurt me.") will incite the ire of FDA more if it is subsequently found the contract clause was against FDA requirements.

I recall a recurrent line in liability lawsuits: "Knew or should have known." The point is: certain crafts and professions are held to a standard of conduct which includes keeping up to date on the changes in requirements. Thus, a real estate broker can't claim freedom from liability for abetting racial bias by saying, "I didn't know you couldn't refuse to sell to someone because of his/her race or ethnicity." Similarly, an organization engaged in a regulated industry can't claim, "We didn't know that rule applied to us." as a defense when violating that rule.

[v9991]

I am not much into clinical trials&GLPs but here's few thoughts based on my little exposure to the GMPs and part11s of pharma..

just in case if you have not already seen this...
not really sure if you can simply do away with the mirror which you are holding...
here's one reference i could trace from FDA...
http://www.fda.gov/downloads/Drugs/G.../UCM070266.pdf

C. Source Documentation and Retention
When original observations are entered directly into a computerized system, the electronic record is the source document. Under 21 CFR 312.62, 511.1(b)(7)(ii) and 812.140, the clinical investigator must retain records required to be maintained under part 312, § 511.1(b), and part 812, for a period of time specified in these regulations. This requirement applies to the retention
of the original source document, or a copy of the source document.

When source data are transmitted from one system to another (e.g., from a personal data assistant to a sponsor’s server), or entered directly into a remote computerized system (e.g., data are entered into a remote server via a computer terminal that is located at the clinical site), or an electrocardiogram at the clinical site is transmitted to the sponsor’s computerized system, a copy of the data should be maintained at another location, typically at the clinical site but possibly at some other designated site. Copies should be made contemporaneously with data entry and
should be preserved in an appropriate format, such as XML, PDF or paper formats.

I completely agree with Wes''s point there, the solution ought to be approached with lot more caution... however, before we work out a alternative/solution, we need to explore how requirements/compliance is assured...
if client has certain apprehension/policy of holding data at your-location... you can possibly make a two-copies for one each of investigator & sponsor...supported by technical/legal agreement, that they will be made available for any regulatory inspection/investigation initiated at your end, if any.. BUT once again word of caution about your responsibilities&liabilities in the clinical study of which you are part to...(see Wes's point ...ignorance of law OR transferring the risk/ownership through set of documentation doesnt help you wash your own responsibilities of study requirements)

hope that it helps...