Introduction
Records management presents an ongoing challenge for all healthcare entities; however, it is especially complex and challenging for clinical research due to the existence of two separate sets of records—the legal medical record and the research record. Each record set has a set of regulatory requirements that govern the management of documents included in the record. Navigating those myriad requirements requires a systematic approach.
General Overview
The records generated in conjunction with clinical research must serve several purposes, so it is understandable that their management is governed by multiple external organizations with specific standards and/or rules and regulations. The research study record includes documentation prepared by the principle investigator and contains study notes, informed consent forms, Health Insurance Portability and Accountability Act (HIPAA) authorization forms, offsite lab results, as well as other outside records. A legal medical record must also be maintained for each patient as per federal regulatory and state licensing requirements and should contain clinical data (both inpatient and outpatient), as well as consent forms and the specific entity admission terms and conditions.
The primary guidance for creating a compliance-based records retention system is based upon the Food and Drug Administration’s (FDA) good clinical practices (GCPs),[2] which provides resources within the FDA for the review of issues surrounding clinical research trials. In addition, the following list (which is not exhaustive) includes standards, laws, and other types of regulations that must be considered when establishing a sound records retention system:
-
HIPAA privacy and security regulations;
-
General Data Protection Regulation (EU GDPR);[3]
-
Joint Commission accreditation requirements;
-
Association for the Accreditation of Human Research Participation Programs (AAHRPP) accreditation requirements;
-
Federal rules in the Code of Federal Regulations (CFR);
-
U.S. Food & Drug Administration (FDA) guidelines; and
-
Individual state laws and regulations governing medical record confidentiality and privacy.
While development of the research record is essential from a regulatory and GCP perspective, ensuring that the subject/participant is aware of the record and its contents is very important and a right of the participant. That right is included in the subject’s bill of rights and includes the following elements:
-
HIPAA authorization
-
Definition of the patient safety considerations for including and excluding information in the chart
-
Documentation expected to be found in the medical record
-
Records excluded from the medical record and found only in the research record
-
Review of the study, possible risks and benefits, alternatives, participation and care, personal and financial concerns, ability to withdraw, and confidentiality
The following chapter outlines the basic structure for the establishment of a compliance-based research records retention system.
What is the Role of the Investigator in Record Management?
The primary role of the investigator is to ensure the safety of the patient; however, the investigator provides administrative, as well as scientific, leadership to the research team. An essential role of the investigator in research includes instituting appropriate processes to maintain research records that comprehensively document the progress of the study. Record keeping requirements should be formalized and incorporated into the institution’s policies and procedures. In addition, the Institutional Review Board (IRB) approval letter for the specific study should include the specifications of what must be included in the research record, such as the informed consent form, HIPAA authorization, etc. In addition, if the IRB approval letter does not specifically state that certain records relating to the patient should be excluded from the patient’s medical record, then all records should be maintained and included in the medical record.
The investigator must maintain documentation of, and comply with:
-
Procedures as described in the protocol,
-
Decisions of the IRB,
-
GCP guidelines,
-
Institutional policies and procedures, and
-
Other standard operating procedures and/or other applicable regulations, including registration of the study as applicable in ClinicalTrials.gov[4] .
To document the safety of the participant in the study, the investigator must document any deviations from the protocol and/or the approval process. Should there be deviations from the protocol without prior IRB approval, the investigator must document that the deviations support the elimination of immediate danger to the subject and the reason there was not enough time to obtain the appropriate approvals. Documentation occurring after approval of the study must follow the requirements imposed by federal regulations and the institution permitting the study. The written consent form should be revised whenever important new information becomes available that may be relevant to the subject’s consent.[5] If the new information might impact a study participant’s willingness to participate, the information must be communicated to the participants and the IRB. These changes, along with new consent forms should be documented in the research record.
Investigational new drug (IND) and investigational device exemption (IDE) protocols require additional reporting to FDA for problems that are serious, unexpected, and possibly related to the experimental treatment. Records should be maintained for the notification by the investigator to the sponsor of the serious adverse event. Adverse events are those that result in death, life threatening experience, hospitalization or prolonging of hospitalization, significant disability, or a birth defect. Investigators must file a serious adverse event report with the sponsor and the IRB, which will initiate a report to the FDA. IND sponsors must notify FDA and the National Institute of Allergy and Infectious Diseases (NIAID) within 24 hours of such events. In some circumstances the investigator must also file an adverse event report.
FDA-regulated studies require the investigator to maintain records that document disposition of an investigational drug. Section 21 of the Code of Federal Regulations (C.F.R.) 312.62 states that the record should include dates, quantity used, and use by human subjects. If the investigation is terminated, suspended, discontinued, or completed, the investigator shall return the unused supplies of the drug to the sponsor, or they must be destroyed. Federal regulations require investigators maintain these records for a period of two years following the date a marketing application is approved for investigation of an indicated use of the drug; or, if no application is to be filed or if the application is not approved for such indication, until two years after the investigation is discontinued and FDA is notified.[6]