Is the Audit Trail Review required for Electronic Health Records?

A new post on Electronic Health Records (eHRs) has just been published on the MHRA Inspectorate blog. According to the post, MHRA´s GCP (Good Clinical Practice) inspectors have recently seen various types of eHRs during their investigator site inspections and in several cases they have given major findings. Some examples of the issues which have been identified during inspections include the following:

Audit Trails

• No Audit Trail available, or no ability to access the Audit Trail and thus no information available relating to any original / changed data, who changed it or when. 
• Entries into the eHRs could be deleted and amended.
• eHR Audit Trails had not been reviewed and the Audit Trail provided post inspection for the eHR was deficient as it did not show what type of changes were being made (e.g. new entries, deletions or amendments). Due to these deficiencies, Data Integrity could not be confirmed.
• Dates of entry were typed into the system rather than a system-assigned creation date. The entry date that appeared then was the date typed by the user. Thus, it could not be verified when the actual entry occurred.
• The Audit Trail showed that non-medically or non-clinically qualified personnel had been making entries in the eHR on behalf of the medics.
• The eHR was used for the investigator to review laboratory results related to primary outcome measures. The system had no Audit Trail to demonstrate that this had been done; therefore, no medical oversight could be demonstrated.

Access & Security

• Monitors used printouts of source documents from the eHR systems for Source Data Verification (SDV), but there was no evidence that these copies had been certified.
• Source data printouts did not contain all the relevant source data.
• Monitors were not aware of the location of all of the source data / documents.

Scanning & Certified Copies

• Lack of Quality Control (QC) of scanning and upload to the eHR to ensure it was a certified copy of the original.
• eHRs were a scanned archive of the paper medical records. Finding and verifying source data was hindered as the eHR was not easy to navigate.
• Original source paper medical records were destroyed too early.

The MHRA finally emphasizes that it is really important for the sponsor and the sponsor´s representatives to "address and identify the source data and eHRs as early as possible during the site set up phase and while the contracts are being drafted".

The full post on Electronic Health Records is available on the MHRA Inspectorate blog.