SOP-401
Computerized Systems and Electronic Records
- Number
- SOP-401
- Category
- Data, Privacy and Systems
- Edition
- Reference Edition 1.3
- Approx. pages
- 9
[YELLOW] the site fills in. [DEFAULT: green] a value the site may keep or change.
On this page
1. Purpose
This SOP describes how [SITE NAME] selects, assesses, uses and controls computerized systems that create, modify, maintain, archive, retrieve or transmit trial records. It sets the site's approach to fitness for purpose, user access, audit trails, electronic signatures, certified copies, backup and recovery, security, and the use of artificial intelligence (AI) tools. The approach is risk-proportionate, as ICH E6(R3) Annex 1, 4.3 and FDA's 2024 electronic systems guidance describe: the site applies more control to systems that hold source data, consent records or essential records than to systems that only support scheduling or communication.
2. Scope
This SOP applies to every computerized system used for trial activities at [SITE NAME], whether deployed by the site or by the sponsor, including:
- electronic health record (EHR) and practice management systems
- clinical trial management system (CTMS)
- electronic regulatory binder or electronic investigator site file (eReg/eISF)
- eConsent platforms (site-deployed or sponsor-deployed)
- eSource and electronic visit templates
- temperature monitoring systems
- telehealth platforms, participant payment platforms and recruitment databases
- sponsor systems used by site staff: EDC, IRT/IWRS, ePRO, safety portals, laboratory and imaging portals, document exchange portals
- shared drives, email, scanners and multifunction printers used to create certified copies
- AI tools of any kind
Out of scope: device calibration (SOP-312) and privacy rules for PHI (SOP-400), although both apply alongside this SOP. Where the protocol, sponsor or IRB requirement is stricter than this SOP, the site follows the stricter requirement.
3. Responsibilities
| Role | Responsibilities |
|---|---|
| Principal Investigator (PI) | Accountable for the integrity of trial data under their responsibility irrespective of media (ICH E6(R3) Annex 1, 2.12.1). Approves which site systems hold source for each study. Reviews and endorses data as the sponsor requires. |
| Site Director | Approves acquisition and retirement of site-deployed systems. Signs vendor agreements. Approves the use of AI tools. Owns the site's letter of non-repudiation to FDA where required. |
| Quality Lead | Maintains the system inventory and risk assessments on F-401-01. Files vendor validation evidence. Runs periodic access reviews and audit trail reviews. Includes systems in internal audits (SOP-700). |
| Security Officer ([SECURITY OFFICER NAME]) | Implements technical security controls (accounts, passwords, multi-factor authentication, patching, antivirus, encryption, backup). Manages security incidents with the Privacy Officer. May be an outsourced IT provider overseen by the Site Director. |
| System Owner (named per system on F-401-01) | Day-to-day administrator for a site system: grants and removes access, manages configuration and changes, liaises with the vendor. Any trained staff role. |
| Regulatory Coordinator | Requests and removes sponsor system access for staff. Files sponsor system training records and user manuals in the ISF. |
| All Research Staff | Use only their own credentials. Complete system training before access. Report system problems and suspected security incidents immediately. |
4. Definitions
| Term | Definition |
|---|---|
| Computerized system | A system of hardware, software and associated procedures and personnel that performs a function in a trial. |
| Site-deployed system | A system the site selects, contracts for or configures for trial records (for example eReg, CTMS, site eConsent, eSource, temperature monitoring). |
| Sponsor-deployed system | A system the sponsor provides for site use (for example EDC, IRT, ePRO, sponsor eConsent). The sponsor is responsible for its validation. |
| Fit for purpose | Shown, by risk-proportionate evidence, to perform reliably for its intended use in the trial. |
| Validation | Documented evidence that a system conforms to its requirements for completeness, accuracy and reliability and performs consistently with its intended purpose (ICH E6(R3) Annex 1, 4.3.4). For off-the-shelf systems used as configured by a vendor, the site relies on vendor validation plus its own verification of its configuration and use. |
| Audit trail | A secure, computer-generated, time-stamped record that independently records the date and time of operator entries and actions that create, modify or delete electronic records (21 CFR 11.10(e)). |
| Electronic signature | A computer data compilation of any symbol or series of symbols executed, adopted or authorized by an individual to be the legally binding equivalent of the individual's handwritten signature (21 CFR 11.3(b)(7)). A signature drawn with a finger or stylus is a handwritten signature applied to an electronic record. |
| Certified copy | A copy (irrespective of media) of the original record that has been verified, by a dated signature or by generation through a validated process, to have the same information as the original, including relevant metadata. |
| Metadata | Information that gives context to data, for example the date and time of entry, the user who entered it and changes made. |
| Part 11 | 21 CFR Part 11, Electronic Records; Electronic Signatures. Applies to electronic records required by FDA predicate rules that are created, modified, maintained, archived, retrieved or transmitted in electronic form. |
| AI tool | Any software that generates text, summaries, classifications, transcriptions or predictions using machine learning, including general chatbots, AI features built into other software, ambient scribes and transcription services. |
5. Procedure
5.1 System inventory
5.1.1
The Quality Lead keeps a system inventory on F-401-01 listing, for each system: name and version, vendor, whether site- or sponsor-deployed, intended use, the studies it supports, whether it holds source data, consent records, essential records or PHI, System Owner, risk category (5.2), validation evidence location, backup arrangements, and date of last access review.
5.1.2
A new site-deployed system, or a new use of an existing system for trial records (for example starting to use the EHR's research module as eSource), is added to F-401-01 and assessed under 5.2 before use.
5.1.3
For each study, the Lead CRC records on the Source Data Location List (SOP-306) which system holds source for each data type, so that the original record can be identified for monitors and inspectors.
5.2 Risk assessment and fitness for purpose (site-deployed systems)
5.2.1
The Quality Lead, with the System Owner, assigns a risk category based on intended use, the importance of the data, and the system's potential to affect participant safety, rights or the reliability of results (ICH E6(R3) Annex 1, 4.3.4(a)):
- High: holds source data, consent records or the sole copy of essential records; drives safety or dosing decisions (for example site eConsent, eSource, eISF, temperature monitoring for IP storage)
- Medium: holds trial records that also exist elsewhere, or supports trial conduct (for example CTMS with visit tracking, participant payment platform)
- Low: no trial records or only copies (for example scheduling tools without PHI, intranet)
5.2.2
For high and medium systems, the site obtains and files proportionate evidence of fitness for purpose before use:
- vendor validation summary or certificate, statement of Part 11 compliance controls, and the vendor's quality and security documentation (for example SOC 2 report or equivalent)
- the site's own requirements for its use (what the system must do for the site)
- the site's verification that its configuration works as intended (for example test a consent workflow end to end, test that an audit trail captures a change, test alarm notifications)
- a written agreement with the vendor covering scope, responsibilities, security, data ownership, access to data throughout the retention period and return or transfer of data at termination (FDA 2024 Q&A, IT service providers)
5.2.3
Vendors of high and medium systems are qualified and overseen under SOP-105 and recorded on F-105-01.
5.2.4
The site applies Part 11 controls (5.3 to 5.6) to site-controlled systems that hold records required by FDA regulations in electronic form in place of paper, such as eISF, site eConsent, eSource and electronic IP accountability.
5.2.5
EHR systems used for patient care are sources of trial data. FDA has stated it does not intend to assess EHR systems for Part 11 compliance. The site still controls EHR access (5.3), restricts monitor access (SOP-400), and records how EHR data reach the CRF. Where the site uses an EHR research module or templates designed as eSource, the Quality Lead assesses those functions under 5.2.1.
5.2.6
Unresolved issues found during assessment are recorded with mitigations on F-401-01 and approved by the Site Director before use (ICH E6(R3) Annex 1, 4.3.4(i)).
5.2.7
Vendor upgrades and configuration changes to high systems are assessed by the System Owner for impact before release, and re-verified where the change affects trial functions (ICH E6(R3) Annex 1, 4.3.4(c)). The change and verification are recorded.
5.2.8
Sponsor-deployed systems are validated by the sponsor. The site uses them as the sponsor instructs (ICH E6(R3) Annex 1, 2.12.4), completes sponsor training, files user manuals and training records in the ISF, and reports system problems to the sponsor help desk with the ticket number recorded.
5.3 User access
5.3.1
Every user has a unique account. Shared, generic or group logins are not permitted for any system holding trial records or PHI. Staff never disclose passwords or let another person work under their login.
5.3.2
Access is role-based and limited to what the person's delegated tasks require. Access to a study's records in a site system matches the person's entries on the delegation log (F-302-01).
5.3.3
Access is granted only after the user completes training on the system (and protocol training where applicable). The System Owner records grant date, role and approver on F-401-01 or in the system's own access log.
5.3.4
Multi-factor authentication is enabled for every system that supports it and is mandatory for remote access to systems holding PHI.
5.3.5
Access removal:
- when a staff member leaves, access to all site systems is removed on [DEFAULT: the last working day]
- when a staff member's role changes or they come off a study, study-specific access is adjusted within [DEFAULT: 5 business days]
- for sponsor-deployed systems, the Regulatory Coordinator asks the sponsor or CRO to revoke access the same business day the person leaves or comes off the study (ICH E6(R3) Annex 1, 2.12.10(b); SOP-307) and records the request on F-401-01
5.3.6
The Quality Lead reviews user lists for high systems against current staff and delegation logs at least [DEFAULT: every 6 months] and records the review on F-401-01. Accounts with no current need are disabled.
5.3.7
Workstations lock automatically after [DEFAULT: 15 minutes] of inactivity. Users lock screens when leaving them.
5.4 Audit trails and data changes
5.4.1
Site-deployed systems holding trial records must have an audit trail that is always on, cannot be edited or disabled by users, and records who made each entry or change, when, the old and new values, and the reason where the system supports it.
5.4.2
Staff correct electronic records using the system's correction function so that the original entry remains visible in the audit trail. Records are not deleted and re-created to hide an error.
5.4.3
The Quality Lead or System Owner reviews audit trails of high systems in a risk-based way, for example during internal QC (SOP-700) or when a data integrity concern arises, looking for entries outside normal hours, back-dated entries, changes long after the event, or changes by users without delegation.
5.4.3.1
For each site-controlled system that holds source, the Quality Lead or System Owner reviews the audit trail for [DEFAULT: a quarterly sample of 10 records per system] and records the review (date, records sampled, findings) on F-401-01. Audit trails of vendor-hosted systems are reviewed as the vendor agreement and the vendor's process provide.
5.4.4
System clocks are synchronized to a reliable time source and are not changeable by users.
5.4.5
Audit trails are retained with the records they relate to for the full retention period (SOP-402).
5.5 Electronic signatures
5.5.1
Electronic signatures in site-controlled systems that hold FDA-required records must meet 21 CFR Part 11 Subpart C:
- each signature is unique to one individual and is not reused or reassigned
- the site verifies the person's identity before issuing signature credentials
- the signed record shows the printed name of the signer, the date and time of signing, and the meaning of the signature (for example review, approval, authorship)
- signatures are linked to their records so they cannot be removed, copied or transferred
- non-biometric signatures use at least two distinct components (for example user ID and password), with both components required at the first signing in a session
5.5.2
Before staff use electronic signatures in FDA-required records, [SITE LEGAL NAME] submits a letter of non-repudiation to FDA certifying that the electronic signatures are intended to be the legally binding equivalent of handwritten signatures (21 CFR 11.100(c)). One letter may cover all signatures used by the organization. The Site Director keeps a copy.
5.5.3
A signature drawn with a finger or stylus on a tablet (for example on eConsent) is a handwritten signature and must be linked to the electronic record it signs.
5.5.4
Each user signs an acknowledgment at first issue of signature credentials that their electronic signature is the legally binding equivalent of their handwritten signature. The acknowledgment is kept in the training file.
5.6 Certified copies
5.6.1
When the site replaces an original record with a copy (for example scanning paper source into eISF and destroying the paper, or exporting an eConsent record), the copy must be a certified copy.
5.6.2
The site certifies copies by one of two methods:
- manual certification: the person making the copy compares it with the original, confirms that it is complete and legible (all pages, both sides, including notes and signatures), and signs and dates the copy or an attached certification statement, recording that it is a certified copy
- validated process: a scanning or export process the Quality Lead has verified to produce complete, accurate copies, with a record of the check, the date and time of creation and the operator recorded automatically or on a log
5.6.3
Certified copies of electronic records include the relevant metadata (for example timestamps and change history), or the original is retained.
5.6.4
Paper originals are destroyed only after a certified copy exists, the sponsor agreement does not prohibit it, and the Quality Lead has approved destruction for that record type. Original signed consent forms are retained as originals unless the site has a validated certified copy process and the sponsor agrees.
5.6.5
Copies of outside medical records (for example from a participant's other physicians, used for eligibility or adverse event reporting) do not need to be certified. The CRC records the date received and the source.
5.7 Backup, recovery and system failure
5.7.1
For each high and medium site-deployed system, F-401-01 records how data are backed up (by the vendor for hosted systems, by the site for local systems), how often, where backups are held, and how restoration is done.
5.7.2
For hosted systems, the vendor agreement states backup frequency, retention, recovery time and how the site gets its data back if the contract ends.
5.7.3
Restoration from backup is tested for site-managed backups at least [DEFAULT: annually], and the result recorded.
5.7.4
The site keeps contingency procedures for system outages that would block access to data essential to participant safety (ICH E6(R3) Annex 1, 4.3.6), for example paper backup visit forms and consent forms (current IRB-approved versions), offline copies of emergency unblinding instructions, and manual temperature logs. Paper records created during an outage are entered or scanned into the system afterward with a note explaining the outage. Business continuity is covered in SOP-705.
5.7.5
Incidents that may have a significant or persistent impact on trial data or system security are reported to the sponsor and, where applicable, the IRB (ICH E6(R3) Annex 1, 2.12.10(e)), and recorded on F-401-01.
5.8 Security
5.8.1
The Security Officer maintains, for site-managed devices and networks:
- current operating system and software security patches
- endpoint protection (antivirus or equivalent) and firewalls
- full-disk encryption on laptops, tablets and phones that hold or access PHI
- remote wipe for mobile devices
- secure Wi-Fi with separate guest network
- secure disposal of devices and media (SOP-402)
5.8.2
Staff do not store trial records or PHI on personal devices, removable media or personal cloud accounts. USB drives are used only if encrypted and site-issued.
5.8.3
Staff complete security awareness training, including phishing, at hire and [DEFAULT: annually].
5.8.4
Suspected security incidents (phishing click, malware, lost device, unexpected account activity) are reported immediately to the Security Officer and handled together with the Privacy Officer under SOP-400 (F-400-01).
5.9 Email, messaging and file sharing
5.9.1
Part 11 does not cover email or messaging, but trial information sent this way must be appropriately secure. Staff use the site's approved email (with encryption for PHI) or approved secure portals for trial records and PHI.
5.9.2
Email and messages that contain trial decisions or source information (for example a PI's eligibility confirmation, a sponsor's protocol clarification) are saved to the study file or eISF.
5.10 AI tools
5.10.1
Only AI tools on the site's approved list may be used for any work involving trial information. The approved list is kept on F-401-01 with permitted uses for each tool.
5.10.2
PHI, participant identifiers, and sponsor confidential information (protocols, investigator's brochures, unpublished data) are never entered into an AI tool unless the Site Director has approved that tool for that data type, and:
- for PHI, the vendor has signed a BAA or equivalent agreement, and
- for sponsor confidential information, the clinical trial agreement or the sponsor in writing permits it, and the vendor does not use inputs to train its models
5.10.3
Public consumer AI tools are not used with any participant information, even if names are removed, because combinations of details can identify participants.
5.10.4
Any AI output used in a trial record (for example a drafted visit note, a summarized medical history for eligibility review, a transcribed telehealth note, a translated document, a drafted response to a query) must be reviewed, corrected as needed and accepted by a qualified, delegated person before it becomes part of the record. That person is the author of the record and is accountable for its accuracy.
5.10.5
AI tools do not make, and are not relied on for, eligibility decisions, causality or severity assessments, dosing decisions or any medical judgment. The PI or Sub-I makes these decisions.
5.10.6
Where an AI tool generates or alters source content (for example an ambient scribe drafting a visit note), the study's Source Data Location List (SOP-306) records the tool's use, and the human review in 5.10.4 is documented by the reviewer's signature on the record.
5.10.7
Participant-facing AI (for example chatbots for recruitment or reminders) needs IRB approval as participant-facing material and a privacy review before use.
5.10.8
Use of AI tools in a way the sponsor's agreement or protocol prohibits is a deviation recorded under SOP-308.
5.11 Retirement and data migration
5.11.1
Before retiring a site-deployed system or changing vendors, the System Owner and Quality Lead plan how trial records and audit trails will be migrated or archived so they remain complete, readable and retrievable for the full retention period (SOP-402).
5.11.2
Migration is verified (record counts, sample comparison of content and metadata) and the verification is recorded. Data are not deleted from the old system until verification is complete and the Site Director approves.
6. Related Forms and SOPs
- F-401-01 Computerized System Inventory and Access Log
- F-105-01 Service Provider Qualification and Oversight Record
- F-302-01 Delegation of Authority Log
- F-103-01 Staff Training Log
- F-400-01 Privacy Incident Report
- F-308-01 Protocol Deviation Log
- SOP-105 Oversight of Service Providers and Vendors
- SOP-204 Essential Documents and the Investigator Site File
- SOP-301 Informed Consent Process and Documentation
- SOP-306 Source Documentation and Data Integrity (ALCOA+)
- SOP-307 Case Report Forms, EDC Entry and Query Resolution
- SOP-400 Participant Privacy and HIPAA in Research
- SOP-402 Record Retention, Archiving and Destruction
- SOP-700 Internal Quality Control and Quality Assurance Audits
- SOP-705 Business Continuity and Emergency Preparedness
- SOP-905 Network Data, Systems, Privacy and Records Across Sites (Model N only)
- SOP-904 Shared Staff, Cross-Site Coverage and Central Services (Model N only)
- Appendix B Central and Site Responsibility Matrix (Model N only)
7. References
| Reference | Title |
|---|---|
| ICH E6(R3) section 4 | Data Governance (4.2 Data Life Cycle Elements; 4.3 Computerised Systems) |
| ICH E6(R3) Annex 1, 2.12 | Records (including 2.12.9 and 2.12.10 on systems at the investigator site) |
| 21 CFR Part 11 | Electronic Records; Electronic Signatures (including 11.10, 11.50, 11.70, 11.100, 11.200, 11.300) |
| FDA Guidance (Oct 2024) | Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations: Questions and Answers |
| FDA guidance (July 2018) | Use of Electronic Health Record Data in Clinical Investigations |
| FDA guidance (Sept 2013) | Electronic Source Data in Clinical Investigations |
| FDA guidance (Aug 2003) | Part 11, Electronic Records; Electronic Signatures: Scope and Application |
| 45 CFR 164 Subpart C | HIPAA Security Rule |
| FDA Compliance Program 7348.811 | Bioresearch Monitoring: Clinical Investigators and Sponsor-Investigators |
Independent Site SOP Library. Licensed CC BY-NC 4.0 by the American Institute for Medical Research (AIMR), with added permission for any site's internal use (license terms). Not legal advice: each adopting site confirms state law, IRB and sponsor requirements with its own counsel and owns every step it approves.