1. 1 Training the FDA on: eSystems Used in Clinical Trials SEC Associates, Inc.

2. © 2007 SEC Associates, Inc. 2 Agenda Overview of Training Request & Objectives CDRH Staff College & Attendees eSystems Used in Clinical Trials eSystems Support Electronic Source Data Use of Excel and Email Hot spots and concerns for inspections Typical Case Studies Observations and Impressions

3. © 2007 SEC Associates, Inc. 3 Objectives Understand the typical types of eClinical applications used by the industry for running and managing clinical trials. Understand the industry’s interpretation and application of 21CFR11 for eClinical systems, especially in regard to medical device trials. Pinpoint the areas industry views as the biggest risks to data integrity and/or to regulatory compliance within eClinical functionality. Comprehend specific processes and methodologies for detecting eClinical compliancy issues.

4. © 2007 SEC Associates, Inc. 4 FDA Organization

5. © 2007 SEC Associates, Inc. 5 Staff College & Attendees Run by CDRH, to provide professional development to 40 FDA staff members Request from Michael Marcarelli – Director, Division of Bioresearch Monitoring FDA Offices Represented: Office of the Commissioner / Office of Good Clinical Practice Office of Compliance (CDRH) Office of Compliance and Biologics Quality (CBER) Office of Device Evaluation (CDRH) Office of In Vitro Diagnostics (CDRH) FDA Roles Represented: Compliance Officers Reviewers Investigators

6. © 2007 SEC Associates, Inc. 6 eSystems Used in Clinical Trials CTMS – Clinical Trials Management Systems CDMS – Clinical Data Management Systems eCRF – Electronic Case Report Forms ePRO – Electronic Patient Reported Outcomes IVRS – Interactive Voice Response Systems LIMS – Laboratory Information Management Systems ECG – Electrocardiograph Systems Digital Imaging – MRI, Xray, Ultrasound, CT Scan, etc. AERS – Adverse Event Reporting Systems SAS – Data preparation and Statistical Analysis Admin – Document Systems, ERPs, Email, Training Records, etc.

7. © 2007 SEC Associates, Inc. 7 eSystems Support Internal Infrastructure Automated Interfaces Manual data entry SDLCs and Change Management COTS versus Custom Software Hosting models including ASP Alternative recording methods

8. © 2007 SEC Associates, Inc. 8 Electronic Source Data Definitions – What qualifies as electronic source data Roles and Responsibilities – Who owns the data and who is responsible for it Location of Data – Issues of geography, access and security Copy – Certified or some other type of verification User Requirements – The CDISC guidelines for managing electronic source data Electronic Health Records – Potentials and Pitfalls Scenarios – 5 paradigms for capturing, moving and protecting electronic source data

9. © 2007 SEC Associates, Inc. 9 Use of Excel and Email The FDA is aware of the wide spread use of Excel for: Data Capture Data Transfer Data Calculations Tracking tool (e.g., investigator sites, IRB approvals, etc) The FDA is aware of the wide spread use of email for: Documenting protocol information Approving documents and protocol decisions Data Transfer At most, the FDA seemed mildly concerned about the use of Excel, and not troubled about the use of Email.

10. © 2007 SEC Associates, Inc. 10 Hot spots and Inspection Concerns Focus on Documentation not Validation Protocol Specific Configuration & Development Inadequate Risk Assessment Performed Thin Client & Web Based Applications Manual Data Entry Commercial Off The Shelf Systems

11. © 2007 SEC Associates, Inc. 11 Hotspots and Inspection Concerns Alternative Recording Methods Multiple Instances of the Same System Complicated Configuration of COTS Data Modifications in Only one Place Automated Audit Trails are too Vague Audit Trails Are Not Easily Accessible

12. © 2007 SEC Associates, Inc. 12 Typical Case Studies A CRO has developed and “validated” a brand new EDC system that captures eCRF data through a hand held, wireless, voice recognition PDA device. When a patient comes in for a visit, the physician simply reads each of the questions / categories from the eCRF on the hand held device, and the answers to those questions are verbally stated by the patient and/or physician. The software translates the verbal answer into the appropriate area on the form. Once the visit is complete, the data is transmitted wirelessly over the internet to the CRO. Upon acceptance of the transmission, the handheld device sends a copy of the CRF to the local physician’s printer. The data on the handheld device is only deleted when the hard drive gets full. That process is automatic.

13. © 2007 SEC Associates, Inc. 13 Typical Case Studies You’ve drawn the assignment to inspect a small Medical Device company. One of the first things you ask for are the SOPs and Training Records. The host of the audit politely explains that those are not currently available, but should be accessible this afternoon. When you ask why that is, the host indicates that they use a 3 rd party provider to host their document management system and they are currently doing system maintenance. The ETA for bringing the system backup up is 1:00 p.m.

14. © 2007 SEC Associates, Inc. 14 Observations and Impressions Validation is only one of many areas to inspect. Most FDA personnel are not IT experts. They do not live and breath eSystems and 21CFR11. Focus is on data trustworthiness, not a specific validation process. A variety of personalities exist in the FDA (as you would expect). Pharma / Medical Device companies are the primary responsible party - - for everything. Suppliers and 3 rd party providers are expected to be scrutinized and managed. Audit details will rarely be inspected.

15. © 2007 SEC Associates, Inc. 15 Observations and Impressions Insights about the new FDA Guidance on Computerized Systems Used in Clinical Investigations Speculation about the long term and strategic vision for 21CFR11 Need and desire to keep it simple: √ What kinds of things does your computer system do? √ Have you documented any of that? √ What evidence do you have that it performs as expected? Validation is an important business practice, not just a regulatory requirement Continuing commitment to balance industry constraints with the public need for safety and efficacy – “The Least Burdensome Approach”

16. © 2007 SEC Associates, Inc. 16 Questions?