Background Audit trails have been used widely to ensure quality of study data and have been implemented in computerized clinical trials data systems. Increasingly, there is a need to audit access to study participant identifiable information to provide assurance that study participant privacy is protected and confidentiality is maintained. In the United States, several federal regulations specify how the audit trail function should be implemented.
Purpose To describe the development and implementation of a comprehensive audit trail system that meets the regulatory requirements of assuring data quality and integrity and protecting participant privacy and that is also easy to implement and maintain.
Methods The audit trail system was designed and developed after we examined regulatory requirements, data access methods, prevailing application architecture, and good security practices.
Results Our comprehensive audit trail system was developed and implemented at the database level using a commercially available database management software product. It captures both data access and data changes with the correct user identifier. Documentation of access is initiated automatically in response to either data retrieval or data change at the database level.
Limitations Currently, our system has been implemented only on one commercial database management system. Although our audit trail algorithm does not allow for logging aggregate operations, aggregation does not reveal sensitive private participant information. Careful consideration must be given to data items selected for monitoring because selection of all data items using our system can dramatically increase the requirements for computer disk space. Evaluating the criticality and sensitivity of individual data items selected can control the storage requirements for clinical trial audit trail records.
Conclusions Our audit trail system is capable of logging data access and data change operations to satisfy regulatory requirements. Our approach is applicable to virtually any data that can be stored in a relational database.
Get full access to this article
View all access options for this article.
References
1.
KarrisonT. Data editing in a clinical trial. Control Clin Trials1981; 2: 15–29.
2.
GassmanJJOwenWWKuntzTE. Data quality assurance, monitoring, and reporting. Control Clin Trials1995; 16: 104S–36S.
3.
WingetMKincaidHLinP. A web-based system for managing and co-ordinating multiple multisite studies. Clin Trials2005; 2: 42–9.
4.
McFaddenETLoPrestiFBaileyLR. Approaches to data management. Control Clin Trials1995; 16: 30S–65S.
5.
KnatterudGLRockholdFWGeorgeSL. Guidelines for quality assurance in multicenter trials: a position paper. Control Clin Trials1998; 19: 477–93.
6.
HsuYLRedaDJ. A microcomputer-based clinical trial database incorporated with an 'audit trail' for correction process. Comput Methods Programs Biomed1989; 30: 239–48.
7.
HigginsSBJiangKPlummerWDJr. Pivot/remote: a distributed database for remote data entry in multi-center clinical trials. Medinfo1995; 8(Pt 2): 1097–1097.
8.
DyckPJTurnerDWDaviesJL. Electronic case-report forms of symptoms and impairments of peripheral neuropathy. Can J Neurol Sci2002; 29: 258–66.
9.
Ene-IordacheBCarminatiSAntigaL. Developing regulatory-compliant electronic case report forms for clinical trials: experience with the demand trial. J Am Med Inform Assoc2009; 16: 404–8.
10.
AbdellatifMRedaDJ. A Paradox-based data collection and management system for multi-center randomized clinical trials. Comput Methods Programs Biomed2004; 73: 145–64.
11.
NguyenLShahAHarkerM. DADOS-Prospective: an open source application for Web-based prospective data collection. Source Code Biol Med2006; 1: 7–7.
12.
HarrisPATaylorRThielkeR. Research electronic data capture (REDCap)—a metadata-driven methodology and workflow process for providing translational research informatics support. J Biomed Inform2009; 42: 377–81.
13.
LondonJWSmalleyKJConnerKSmithJB. The automation of clinical trial serious adverse event reporting workflow. Clinical Trials2009; 6: 446–54.
FDA. 21 CFR Part 11—Electronic Records; Electronic Signatures; Final Rule / Electronic Submissions; Establishment of Public Docket; Notice. Federal Register Thursday 20 March 1997.
16.
HHS. Protection of Human Subject (last revised in 2009)http://www.hhs.gov/ohrp/humansubjects/guidance/45cfr46.html.
HigginsSBJiangKSwindellBBBernardGR. A graphical ICU workstation. Proc Annu Symp Comput Appl Med Care1991: 783–7.
25.
KruseRLMehrDR. Data management for prospective research studies using SAS software. BMC Med Res Methodol2008; 8: 61–61.
26.
MeierJDMackmanADunnerMVasireddyS. Data access security. In. Building secure ASPNET applications: authentication, authorization, and secure communication, Microsoft Press, 2006; 122–126.
27.
HuangC-CLiouD-M. The study of standard-based electronic case report form design system. In. The 10th International HL7 Interoperability ConferenceKyoto, Japan, 2009.
28.
BrandtCADeshpandeAMLuC. TrialDB: a web-based clinical study data management system. AMIA annual symposium proceedings/AMIA Symposium2003; 794–794.
29.
MarksRBristolHConlonMPepineCJ. Enhancing clinical trials on the internet: lessons from INVEST. Clin Cardiol2001; 24: V17–23.
30.
Lopez-CarreroCArriazaEBolanosE. Internet in clinical research based on a pilot experience. Contemp Clin Trials2005; 26: 234–43.
31.
OliveiraAGSalgadoNC. Design aspects of a distributed clinical trials information system. Clin Trials2006; 3: 385–96.
32.
MarksRGConlonMRubergSJ. Paradigm shifts in clinical trials enabled by information technology. Stat Med2001; 20: 2683–96.
SiconolfiRMBishopS. RAMP (risk assessment and management process): an approach to risk-based computer system validation and Part 11 compliance. Drug Inf J2007; 41: 69–79.
