SOP-402
Record Retention, Archiving and Destruction
- Number
- SOP-402
- Category
- Data, Privacy and Systems
- Edition
- Reference Edition 1.3
- Approx. pages
- 7
[YELLOW] the site fills in. [DEFAULT: green] a value the site may keep or change.
On this page
1. Purpose
This SOP describes how [SITE NAME] determines how long trial records must be kept, archives them so they stay complete, readable and retrievable, retrieves them when monitors, auditors or regulators ask, and destroys them securely when retention ends. The retention period for any record is the longest of all requirements that apply to it: FDA regulations, the clinical trial agreement, sponsor instructions, HIPAA, and state law.
2. Scope
This SOP applies to all trial records held by or for [SITE NAME], paper and electronic, after a study closes or when records are moved to archive during a study. It covers:
- the investigator site file (ISF or eISF) and other essential records
- participant research records, source documents, signed consent forms and HIPAA authorizations
- investigational product (IP) and specimen records
- site copies of data from sponsor systems (EDC, IRT, ePRO, portals) provided at closeout
- financial and payment records for the study
- site-level records that support many studies (SOPs, training files, equipment records, system validation records)
Out of scope: day-to-day filing during a study (SOP-204), closeout activities other than archiving (SOP-601), and computerized system controls (SOP-401). Where the clinical trial agreement, sponsor or IRB requirement is stricter than this SOP, the site follows the stricter requirement.
3. Responsibilities
| Role | Responsibilities |
|---|---|
| Principal Investigator (PI) | Accountable for retaining the investigator's records for the required period (21 CFR 312.62(c), 812.140(d)). Confirms the archive is complete at closeout. Tells the sponsor who is responsible for the records if the PI leaves. |
| Site Director | Owns the archive program and budget. Selects and contracts archiving vendors. Approves destruction. Arranges custody of records if the site closes, is sold or merges. |
| Regulatory Coordinator | Prepares records for archiving, records them on F-402-01, maintains the archive index, handles retrieval requests, and tracks retention dates. |
| Quality Lead | Checks archive completeness at closeout as part of SOP-601. Reviews the archive index and retention dates [DEFAULT: annually]. Witnesses or verifies destruction. |
| Finance / Contracts Lead | Records the retention terms of each clinical trial agreement at contract execution and confirms any archiving costs the sponsor pays. |
| Clinical Research Coordinator (CRC) | Assembles participant records for archiving and confirms that all source is present. |
4. Definitions
| Term | Definition |
|---|---|
| Essential records | Records that individually and collectively permit evaluation of the conduct of a trial and the quality of the data produced (ICH E6(R3) Appendix C). |
| Retention period | The period during which a record must be kept, accessible and readable. |
| Archive | The secure storage location (on-site room, off-site vendor, or electronic archive) for records no longer in active use. |
| Archive index | The list of what is in the archive, where, under which box or file identifier, and its retention end date, kept on F-402-01. |
| Retention end date | The date after which a record may be considered for destruction, determined under 5.1 and confirmed with the sponsor. |
| Certified copy | A copy verified by dated signature or generation through a validated process to have the same information as the original, including relevant metadata (SOP-401). |
| Secure destruction | Destruction that makes records unreadable and unrecoverable, documented by a destruction record. |
| Legal hold | An instruction to preserve records relevant to litigation, investigation or audit, which suspends destruction. |
5. Procedure
5.1 Determining the retention period
5.1.1
At contract execution, the Finance / Contracts Lead records the clinical trial agreement's retention clause (period, trigger, sponsor notification, who pays for storage) on F-201-01 and in the study record on F-402-01.
5.1.2
The Regulatory Coordinator determines the retention period for each study at closeout as the longest of:
- IND studies (21 CFR 312.62(c)): 2 years after the date a marketing application is approved for the drug for the indication under investigation; or, if no application is filed or the application is not approved for that indication, 2 years after the investigation is discontinued and FDA is notified.
- IDE studies (21 CFR 812.140(d)): 2 years after the later of the date the investigation is terminated or completed, or the date the records are no longer required to support a premarket approval application, product development protocol notice of completion, humanitarian device exemption, premarket notification or De Novo request.
- Clinical trial agreement: the period in the contract. Contract terms are often much longer than the FDA minimums because sponsors use the data for submissions in other countries.
- Sponsor notice (ICH E6(R3) Annex 1, 2.12.12): until the sponsor informs the site that the records are no longer needed, if that is later.
- HIPAA (45 CFR 164.530(j)): signed authorizations, IRB waivers of authorization, accounting-of-disclosure records and other required HIPAA documentation for 6 years from creation or the date last in effect, whichever is later.
- State law (Appendix A): state medical record retention periods for any record that is also part of the participant's medical record, including longer periods for minors (often running from the age of majority).
- Other law: for example DEA records for controlled-substance IP (at least 2 years under 21 CFR 1304.04), OSHA exposure records, and tax records for participant payments (SOP-310).
5.1.3
Because the investigator usually cannot know when a marketing application is approved or an investigation is discontinued, the site does not calculate an FDA end date on its own. The retention end date for IND and IDE records is "until the sponsor confirms in writing that retention is no longer required," unless the contract sets a later fixed date.
5.1.4
Records that serve more than one purpose follow the longest applicable period (for example a signed consent form that is also in the medical record follows the longer of the trial and state medical record periods).
5.1.5
Site-level records that support multiple studies (SOPs and versions, training records, CVs and licenses, equipment calibration records, computerized system validation records, delegation logs) may be kept outside the study files (ICH E6(R3) Appendix C, C.2.12). The site keeps them as long as the longest retention period of any study they supported, so they remain available for each study's inspection; this period is site practice, not an ICH requirement.
5.2 Preparing records for archive
5.2.1
At closeout (SOP-601), after the sponsor's close-out visit and resolution of all queries, the Regulatory Coordinator and CRC:
- reconcile the ISF against the ISF index (F-204-01) and Appendix C essential records list
- confirm each participant's research record is complete, including signed consent forms and authorizations for every version signed
- obtain from the sponsor and file the site's copies of sponsor-held data (for example EDC data with audit trails on durable media or a portal with guaranteed access for the retention period, IRT reports, ePRO data for site participants, safety reports downloaded from portals)
- remove duplicates, sticky notes and non-record drafts, but never remove original source or anything with an annotation
- confirm that electronic records in site systems are exported or retained under 5.4
5.2.2
The PI confirms the archive is complete by signing the closeout checklist (F-601-01).
5.2.3
Paper records are packed in labeled boxes. Each box label shows only the site name, protocol number, sponsor, box number and retention end date, never participant names.
5.2.4
The Regulatory Coordinator records each box or electronic archive on F-402-01: protocol, sponsor, contents description, box or file identifier, date archived, location, retention trigger and end date, and the person who archived it.
5.2.5
The Regulatory Coordinator sends the sponsor written notice of archive location and the name and contact details of the person responsible for the records (ICH E6(R3) Annex 1, 2.12.13).
5.3 Paper archive storage
5.3.1
On-site archives are in a locked room or locked cabinets with access limited to [ROLES], protected from fire, water and pests as far as practical, and away from active work areas.
5.3.2
Off-site archiving vendors are selected, contracted and overseen under SOP-105 (F-105-01). The contract covers secure storage, environmental protection, retrieval times, chain of custody, confidentiality, a BAA where PHI is stored, and access for FDA inspectors and sponsor auditors.
5.3.3
Boxes go to the vendor with a transmittal listing box identifiers, signed by the vendor on receipt. The receipt is filed with F-402-01.
5.3.4
The Regulatory Coordinator confirms the vendor's inventory matches F-402-01 at least [DEFAULT: annually].
5.4 Electronic records: readability and migration
5.4.1
Electronic trial records and their audit trails must remain complete, readable and retrievable for the full retention period (ICH E6(R3) Annex 1, 4.2.7 and Appendix C, C.2.6).
5.4.2
For each site-deployed system holding trial records (SOP-401, F-401-01), the Quality Lead records how records will be kept after study closeout: in the live system, an archive module, or an export in a durable, readable format (for example PDF/A with audit trail reports, or the vendor's archive package).
5.4.3
Electronic archives are stored in at least two locations, encrypted, with access controls and backup under SOP-401.
5.4.4
When a system is retired, a vendor contract ends, or a file format becomes obsolete, the System Owner migrates archived records before access is lost, verifies the migration (record counts and sampled content and metadata) and records the verification (SOP-401, 5.11).
5.4.5
The Regulatory Coordinator checks a sample of electronic archives [DEFAULT: every 2 years] by opening files to confirm they are still readable, and records the check on F-402-01.
5.4.6
Sponsor portals are not an archive unless the sponsor guarantees, in writing, site access for the full retention period. Otherwise, the site downloads its essential records before the portal closes.
5.5 Retrieval
5.5.1
Requests to retrieve archived records (from the sponsor, monitor, auditor, IRB, FDA, or for a participant request or legal matter) go to the Regulatory Coordinator.
5.5.2
The Regulatory Coordinator records each retrieval on F-402-01: date requested, requester, records requested, date retrieved, who received them, purpose, date returned and condition on return.
5.5.3
For an FDA inspection, the site retrieves records so they are available to FDA at reasonable times, as 21 CFR 312.68 and 812.145 require: on-site records [DEFAULT: the same business day as the request], and off-site records within the vendor's contracted retrieval time, [DEFAULT: no more than 2 business days]. The site follows SOP-702. When an inspection or remote regulatory assessment is announced, the Regulatory Coordinator requests off-site records from the vendor the same business day.
5.5.4
Retrieved records stay under site control. Originals are not sent to sponsors or other parties; copies are provided where needed, with identifiers redacted as SOP-400 requires.
5.5.5
Records are returned to the archive and their return logged once the need ends.
5.6 Change of custody (PI departure, site closure, sale or merger)
5.6.1
When the PI leaves the site, the Site Director names the person who will be responsible for the PI's archived records and the Regulatory Coordinator informs each sponsor in writing (ICH E6(R3) Annex 1, 2.12.13).
5.6.2
For IDE studies only, if the investigator transfers custody of records to another person who accepts responsibility for them, FDA must be notified within 10 working days after the transfer (21 CFR 812.140(e)). The Regulatory Coordinator coordinates this notice with the sponsor. 21 CFR 312 has no equivalent investigator notice to FDA; for IND studies the site notifies the sponsor in writing of the new custodian and the sponsor decides on any FDA notification.
5.6.3
If [SITE NAME] closes, is sold or merges, the Site Director arranges, before closure, a written custody agreement with a successor or archiving vendor for all records within their retention period, notifies each sponsor of the new custodian, and keeps funding for storage and retrieval. Records are never abandoned or destroyed because a site closes. Business continuity planning is in SOP-705.
5.7 Destruction
5.7.1
No trial record is destroyed until all of these are true:
- the retention end date under 5.1 has passed
- for sponsor studies, the sponsor has confirmed in writing that the records may be destroyed or returned. The site sends a written notice of intended destruction and, if the contract requires it, waits for the sponsor's reply
- no legal hold applies
- the Site Director has approved destruction on F-402-01
5.7.2
If the sponsor does not respond to a destruction notice, the site does not destroy. The Regulatory Coordinator sends [DEFAULT: two follow-up notices 90 days apart] and escalates to the Site Director, who decides whether to keep storing the records or return them to the sponsor at the sponsor's cost as the contract permits.
5.7.3
Destruction methods:
- paper: cross-cut shredding, pulping or incineration by staff or a vendor with a BAA, with a certificate of destruction for vendor destruction
- electronic media and devices: sanitization by clearing, purging or physical destruction appropriate to the media, following NIST SP 800-88 (current revision), with a certificate for vendor destruction
- electronic records in hosted systems: deletion by the vendor with written confirmation, after confirming the records are not needed for any other study or purpose
5.7.4
The Quality Lead or a second staff member witnesses on-site destruction or checks the vendor certificate against the destruction list.
5.7.5
The Regulatory Coordinator records on F-402-01 the records destroyed, method, date, the sponsor authorization reference, and the person who destroyed or witnessed destruction, and keeps the destruction record [DEFAULT: permanently].
5.7.6
Records in the participant's medical record are destroyed only under the site's medical record policy and state law, not under a sponsor's authorization alone.
5.8 Legal holds
5.8.1
When the Site Director receives notice of litigation, a government investigation, an FDA inspection or a sponsor audit involving a study, they issue a legal hold in writing. The Regulatory Coordinator flags affected records on F-402-01. Destruction of those records is suspended until the Site Director releases the hold in writing.
6. Related Forms and SOPs
- F-402-01 Record Archiving and Retrieval Log
- F-201-01 Contract and Budget Review Checklist
- F-204-01 Investigator Site File Index
- F-601-01 Study Closeout Checklist
- F-105-01 Service Provider Qualification and Oversight Record
- F-401-01 Computerized System Inventory and Access Log
- SOP-105 Oversight of Service Providers and Vendors
- SOP-201 Confidentiality Agreements, Clinical Trial Agreements and Budgets
- SOP-204 Essential Documents and the Investigator Site File
- SOP-310 Participant Payments and Reimbursement
- SOP-400 Participant Privacy and HIPAA in Research
- SOP-401 Computerized Systems and Electronic Records
- SOP-601 Study Closeout
- SOP-702 FDA Inspections and Remote Regulatory Assessments
- SOP-705 Business Continuity and Emergency Preparedness
- Appendix A State Law Worksheet
- SOP-901 Member Site Onboarding, Integration and Exit (Model N only)
- SOP-905 Network Data, Systems, Privacy and Records Across Sites (Model N only)
- Appendix B Central and Site Responsibility Matrix (Model N only)
7. References
| Reference | Title |
|---|---|
| 21 CFR 312.62(c) | Investigator recordkeeping and record retention (IND) |
| 21 CFR 312.68 | Inspection of investigator's records and reports |
| 21 CFR 812.140(d) and (e) | Records retention period and records custody (IDE) |
| 21 CFR 812.145 | Inspections (IDE) |
| 21 CFR 1304.04 | Maintenance of records and inventories (controlled substances) |
| 45 CFR 164.530(j) | HIPAA documentation and six-year retention |
| ICH E6(R3) Annex 1, 2.12.11 to 2.12.14 | Investigator retention of essential records, custodian and direct access |
| ICH E6(R3) Annex 1, 4.2.7 and 4.2.8 | Retention and Access; Destruction |
| ICH E6(R3) Appendix C | Essential Records for the Conduct of a Clinical Trial (C.2 Management of Essential Records) |
| FDA Guidance (Oct 2024) | Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations: Questions and Answers (certified copies; retention of electronic records) |
| NIST SP 800-88 (current revision) | Guidelines for Media Sanitization |
Independent Site SOP Library. Licensed CC BY-NC 4.0 by the American Institute for Medical Research (AIMR), with added permission for any site's internal use (license terms). Not legal advice: each adopting site confirms state law, IRB and sponsor requirements with its own counsel and owns every step it approves.