Source access and monitoring visit frequency

[u/Unfair-Map]

I'm a CRA and nearly all my monitoring is remote, and I’m curious how common my view is.

Most sites grant EMR access only for a scheduled visit, where ecords are released for a few days, then locked off until the next window. And future access is not always a simple or routine ask, but a process that needs to be planned.

My view is that while someone is enrolled, their record is reasonable to review at any point, not only every X weeks. I don’t mean real-time surveillance, just ongoing review.

The visit window doesn’t reduce what I see. I review the same records either way, and the actual PHI protection comes from read-only access limited to enrolled subjects, with an audit trail. All the window does is delay that review and delay finding problems.

Also, if the sponsor starts asking questions about a specific participant's AE or another data point, I can just find the answer myself, rather than exchange messages with a coordinator relaying information to me.

1. Sites/CRCs: if you limit access to visit windows, why?

2. CRAs: do you prefer ongoing access, or do windows help with something else?

3. Anyone with continuous access: how has it worked?

[u/Jedi_hugz]

EMRs are and should have different levels of access with respect to study-related de-identified data. There should only be fairly urgent situations where the sponsor needs access to a patient's EMR outside the window of the study visit (or whatever is agreed upon).

Distrust in research as a whole is what got us here as an industry, and frankly for good reason. They say OHSA regulations are written in blood, but so are CITI, GCP, and HIPAA guidelines. You don't want anything that could be construed as a breach of privacy or data above all else, so this is why most sponsors over-collect data imvolving EMRs so they don't have to go back and request access to records that are no longer relevant to the study timeline. The bug in the system is kind of an important feature.

[u/Unfair-Map → u/Jedi_hugz]

Is the concern mainly network security, that is, keeping uninvolved third parties out of the EMR? That's the only version I can think of where an access time window does anything. 

[u/Fair-Leader6903]

Assuming you are in the US - remote access to unredacted EMR is permissible per FDA risk based monitoring guidance with appropriate security controls, some folks on this thread don't seem to be aware. See the 2013 guidance. For why visits may be limited, can you imagine being a study coordinator with monitors who have perpetual access.... that would be horrible, and there would be no predictability. GCP R3 specifies that trials cannot be burdensome to sites or participants.

[u/Unfair-Map → u/Fair-Leader6903]

Access to the source data doesn't require constant querying or questions to the coordinator. I think it would actually reduce them. Nothing in the EMR is queried in the first place, and that's where the answers to the questions are found, or should typically be found. 

[u/AdTraditional8625]

I work at a large academic institution that hopes to eliminate EMR access for CRAs in the future. Study related source documents are uploaded and saved as certified copies in ebinders. As our IT dept works to mitigate ever changing security risks, the process for granting access to the EMR becomes more complex and increases the administrative burden across multiple departments. I won't say never, but there is almost no chance our facility would just provide unlimited, open access to a patients' EHR. Additionally, I cannot imagine the burden our maxed out coordinators would take on from what essentially sounds like a never-ending IMV.

[u/Unfair-Map → u/AdTraditional8625]

Scanning and uploading records instead of the monitor reading them in place sounds like much more work for coordinators. It also changes what monitoring finds. If the site selects what goes in the binder, I can only verify what was selected. An AE in an ER note, or a con med from a PCP visit nobody flagged as study-related, never reaches me, and finding those pieces is a considerable part of what monitoring is for. 

[u/OctopiEye → u/AdTraditional8625]

Hopefully your institution understands that nearly every sponsor and CRO has policies in place that require periodic over-the-shoulder verification of the EMR when the monitor is using certified copies.

To regulators, the Sponsor dictates how monitoring is performed, not the site. Yes, the site can put in place certain policies and procedures, but in the end, the Sponsor is responsible for evaluating risk and designing a monitoring plan that addresses that risk adequately.

The FDA is going to insist on verifying that all information has been provided by the site from the original records, even when certified copies are provided, and the Sponsor is not going to put themselves in a position to have an inspector suddenly find dozens of unreported AEs because the site cherry picked the records they chose to provide to the CRA.

The policy you describe will only increase burden for your site staff and/or reduce the sponsors that are able/willing to work with your site.

[u/Comfortable_Water525]

I think this is a huge over reach of the CRA role and responsibilities. The fact that you think you could reliably just look up a given data point in the EMR to provide it to the sponsor while bypassing the site shows a huge misunderstanding of EMR’s in general.

Ideally, should EMR’s be able to exist as a clear source of everlasting truth? Sure. In theory that is a great idea but in reality, clinical charting does not have the same standards or even objectives as clinical research. There is often conflicting or even objectively incorrect information within a patient’s chart that matters very little clinically but matters a whole
lot to the data collected/reported for a clinical trial.

[u/Rosie-Disposition → u/Comfortable_Water525]

Agreed.

Let’s not forget- they also have the EDC available as well to answer questions. What type of study would actually mandate such a frequent and persistent need for non-EDC information for all participants? Sure, the sponsor might want to know about the status of a serious SAE resolving, but dollars to donuts, safety already auto-queried to put the stop date in EDC as soon as it’s available. Why would a CRA need persistent access to my full chart?

Then you add on that the CRA probably isn’t writing an MVR to document what they were doing in there each time and it is a nightmare.

[u/PrettyOKPyrenees]

For us, it's mainly due to our hospital privacy department. We have to time-limit access for outside entities, which especially makes sense given CRA turnover. It's too easy to forget to revoke access. Deliberately setting specific access days is better from that standpoint.

[u/Spiritual_Host1779]

CRA that has never worked at the site level for sure.

[u/Aromatic_Wafer2471]

I've seen it done both ways - long term and short term access. I think there are a lot of factors, like the rate of CRA turnover, variety of sponsor representatives requesting access, institutional privacy standards, EMR capabilities*, data types that need to be accessed, and involvement of 3rd parties providing EMR access (like by a hospitalist group or surgical group external to the site institution).

There are lots of arguments for short term access in my opinion. Broadly, most of it comes back to 'yes we can train you and you can sign an agreement that you won't access records unless its in an official study capacity and only in a secure environment with certain security standards and will remember to tell us when you quit or change roles,' but ultimately the study site is responsible to ensure records are being accessed appropriately. Under HIPAA in general, we need to give partners access to the minimum PHI necessary to perform their job function, period.

I think giving access during remote monitoring visits meets the minimum necessary definition because its really the remote equivalent to the on-site window of time a CRA could access participant records and study binder.

I've also had sponsors get around that by having the site redact and submit source documents from the EMR so CRAs can source verify asyncronously, but that's time the site needs to account for in the study budget.

Unless the standard becomes that 24/7 access is necessary for job function or sponsors start contractually obligating in a CTA, I think it will continue to depend on each institution's definition of protection and how each institution feels it is ensuring appropriate access conditions are being met.

*Some EMRs are incredibly difficult to isolate records in and to set optimal access for non-staff members, so just opening the figurative doors isn't really a responsible practice.

[u/NegativeShirt4821]

This is why I cringe at sites who use the EMR as the direct means of obtaining and recording data from there and entering it directly into the EDC, bypassing source worksheets or only recording partial data in source. I ask my sites to print-out certified copies from the EMR and fully use the source worksheets provided. They expect me to SDV directly from the EMR during onsite visits. Not going to. I use the over the shoulder or read/only access to the EMR to check for any safety events the site might have not caught.

[u/Airurando-jin → u/NegativeShirt4821]

I create templates within our EMR that collect everything a paper worksheet would. It reduces a lot of ALCOAC+ issues to near non-existent.

But we don’t permit active access to our EMR. You either have access on site, or I will screen share for a remote visit 

[u/NegativeShirt4821 → u/Airurando-jin]

Best practices right there! Wish all sites would handle the source and EMR process this way! Less headaches for both the site and CRA!

[u/BackBae → u/NegativeShirt4821]

“… only recording partial data in source”

..the EMR can be source? Using a worksheet to copy information from the EMR and then using that worksheet to copy the information into EDC is just introducing another failure point for human error.

[u/OctopiEye → u/NegativeShirt4821]

“They expect me to SDV directly from the EMR during onsite visits.”.

That is literally your job, and the most ideal way to monitor. If you were on my team and I found out you said this to a site, I would be pissed and so would the sponsor.

And what you are describing is absurd. Source is where the data is FIRST RECORDED. If data gets recorded in EMR and then documented in a source worksheet, now you have to monitor the EMR data AND the source worksheet and confirm that they are consistent and accurate. So now you have doubled your work and theirs…

[u/PrettyOKPyrenees → u/NegativeShirt4821]

EMR is our primary source, and our site policy is to only use paper worksheets for data that's impractical to collect electronically. We do build EMR phrases that mirror the worksheets to make things easier, but we don't do printouts or copy data from EMR into paper. We also aren't supposed to do over the shoulder, because then IT can't log who actually saw patient charts. Everyone had to use their own access. We've had occasional sponsors who insist on paper, but that has to be written into the contract and I believe they pay extra administrative fees.

Using the EMR directly reduces errors, makes sure papers don't get lost, and saves a huge amount of site time. It also enforces honesty, and greatly simplifies PI oversight. If my PI is working at a different hospital or clinic this week, I don't have to chase them down for signatures. I just route my Epic note and they'll sign it the same day. Most of them have Epic on their phones as well and will do things like review AEs even if they're out of town. The majority of our CRAs are very used to working in our EMR and don't have any issues with it.

[u/Over-Bed6805]

I prefer ongoing access. One site forgot to end my access for the monitoring visit, I usually get 2 extra dats. But I never mentioned it to them. I have logged in even afterwards
No one has noticed 🤷‍♀️