Clinical Trials Validation, 21 CFR Part 11 Compliance By: Terri Shkuda Kim Gajewski Sam Walkow

Introduction Validation Definition Validation Goal The process of testing and the documentation of that testing Validation Goal To verify that system functions work as intended Who should validate? Any instance hosting clinical trials Any organization with a validation policy

Regulatory & System Validation System validation allows for an institution to earn the trust of the researchers so that their data will be protected and documented evidence will be available to prove that the system was developed, implemented and operated in a controlled manner throughout the life cycle of the system. The driving forces for validation are to ensure that human subject data is protected, risk is reduced, data is secure and the system is available. System validation is useful on a global scale, however you would need to tailor the validation to your own government agency’s requirements. For example, US Government regulations that are addressed: HIPAA 21 CFR Part 11

21 CFR Part 11 Title 21 of the Code of Federal Regulations for the U.S.: Electronic Records; Electronic Signature (21 CFR Part 11) In order to submit information to the Food and Drug Administration (FDA), researchers need to show compliance with 21 CFR Part 11. In particular, it “….applies to electronic records that are created, modified, maintained, archived, retrieved or transmitted...”1 Validating the REDCap system serves as only part of this compliance picture. The project’s study team will need to provide documentation of their processes as well to show compliance. The REDCap application can be only considered 21 CFR Part 11 capable. 1http://www.fda.gov/RegulatoryInformation/Guidances/ucm125067.htm#i

Study + System = Part 11 Compliance Research Project Team Study SOPs Data Management Plan Administrative Controls Technical Controls Physical Controls Study Team Processes Software Development Life Cycle Institution’s System Validation

REDCap Consortium’s Regulatory & Software Validation Committee The REDCap Regulatory & Software Validation committee, provides documentation to support system validation, HIPAA and 21 CFR Part 11 compliance. It provides the Functional Specification with its corresponding core validation test scripts to support your own validation activities. Duke University has shared their Validation SOPs which are posted on the Community site. The committee also provides a document on the community site that addresses 21 CFR Part 11 predicate rules as well as FAQs.