data management for clinical trials informatics n.
Skip this Video
Loading SlideShow in 5 Seconds..
Data Management for Clinical Trials (Informatics) PowerPoint Presentation
Download Presentation
Data Management for Clinical Trials (Informatics)

Data Management for Clinical Trials (Informatics)

307 Views Download Presentation
Download Presentation

Data Management for Clinical Trials (Informatics)

- - - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - - -
Presentation Transcript

  1. Data Management for Clinical Trials(Informatics) Robert Anderson, MHA, CCRA, CCRCP Director, Clinical Trials Administration The CRA Training Institute, Houston

  2. Clinical Research as an Activity • Fundamental to translation of basic research to medically useful interventions • Big business: est. $95 B spent annually in U.S. in biomedical research/drug and device testing • Academic centers lag behind commercial clinical trials organizations in knowledge and skills related to efficient and high quality clinical research. • Academic center market share of clinical trials now est. at 20%, was 80+% in 1990 • Generally inferior performance with respect to error rates, missing data, timeliness of submission

  3. Importance of Informatics to Clinical Research • Structured observation and structured record keeping are the essence of science • Primary differentiation between routine clinical care and research is how processes are controlled (i.e.., protocol-driven) and information is managed to make it useful for analysis

  4. “Classical” Data Management Flow for Clinical Research Scientific Hypotheses Specific Data Elements Required to Test Hypotheses Data Acquisition Instruments (forms) Computer Data Model and Tool Selection to Support Model and output to Analytical Software People and Process Development (Who does What, When and Where) Documentation: Standard Operating Policies & Procedures

  5. Research Data Management Goals • Create processes and systems that result in research data that is: • Accurate • Complete • Timely • Verifiable • Secure • Available for analysis

  6. Regulatory Context: Good Clinical Practice Standards • General and uniform set of principles for conducting clinical research • Two themes • Respecting rights of participants • Conducting research so that data is accurate and verifiable • Required by FDA but a good (higher) standard for NIH and other sponsored research

  7. GCP Standards Address... • Responsibilities of participating sites • Responsibilities of coordinating centers for multisite trials • Quality Assurance methods for data • Audits • Reporting to regulatory agencies

  8. GCP Principles of Data Management • All data should be independently verifiable • Normally done by comparison with locally kept medical records in interventional trials • Structured approach to record keeping • Physical structure: tabbed participant folders with dividers for different classes of information • Logical structure: database designs and tracking systems

  9. GCP Principles of Data Management • Research records are separately maintained from healthcare-related records • Source document = place where observation first recorded • Source document verification: comparison of Case Report Forms (CRFs) with source documents • corollary: CRFs are not usually considered source documents

  10. GCP standards example: Paper Case Report Forms • Follow instructions • Write legibly • Originals normally go to Coordinating Center; copies local • No marginalia (literally outside the box) • Forms designed so that all variables have a current value (may be code for Pending, Missing, Missed) • Correct units of measurement (best included with value as separate field)

  11. GCP Standards for Case Report Forms, cont’d • Proper methods of correction • Line through incorrect value (value still visible) • Correct value added • Correction initialed • White-out is always red in an auditor’s eyes - no correction fluids or erasures • Check forms for completeness prior to submission • Double check and verify ID info on CRF • Submit on time

  12. 21 CFR 11:Electronic Records & Signatures • Applies (only) to data submitted to FDA in support of drug & device applications • Address issues related to paperless data management systems where there is no source document for verification • Subpart C relates to digital signatures • Full compliance requires formal software validation testing and certification • To date, has paradoxically impeded rather than advanced use of electronic research data management systems

  13. General Forms Design Principles • Have definitions of all data to be collected in hand before starting the study • Avoids unnecessary forms revisions that often confuse Clinical Research Associates (CRA’s), participants, and creates statistical complexities • Avoids ‘fishing expedition’ approach to iterative protocol modification

  14. Web browser (“thin client”) electronic forms for data entry and retrieval • Strengths • Deploy to any location on the Internet • Platform independent (sort of… be careful and test all software on all potential clients) • No software to install or license on user’s machines • Weaknesses • Less efficient (compact interface) • Fewer controls available • Limited repertoire of ‘widgets’ (buttons, lists, etc.) • Slower • Dependent upon Internet connectivity

  15. Specialized Software for Clinical Trials • Registration • Randomization • Participant tracking • Site communications • Transaction or batch upload of local data to coordinating center • Websites for protocols, forms, administrative info

  16. Specialized Software for Clinical Trials, cont’d • Performance measures • Site actual vs. projected accrual • Data completeness • Data accuracy • Data timeliness • Usually displayed as trends over time • Performance measures should include reference values for performance at all sites combined

  17. Data Acquisition Technologies

  18. Data acquisition Technologies:Keyboard Data Entry • Average keystroke error rates will be 0.1% to 1%, depending upon data type • Improve accuracy over baseline by: • Double entry and file comparison (‘gold standard’ but inefficient and expensive) • Special technologies for referential integrity items (e.g., barcode visit and participant ID) • Event-driven auditing and source document verification of scientifically important variables

  19. Data acquisition Technologies:Double keying • Common “best practice”: forms entered by two different data entry operators • Computer generates difference (diff) file • Third person (usually data manager with clinical expertise) reviews and resolves differences • Increases personnel costs by factor of 2 - 2.5 over single entry plus sample-based auditing

  20. Data acquisition Technologies:Barcoding • Applications • Referential integrity items: identifiers for participant, study, site, protocol, event/visit • Physical object tracking: e.g., tissue specimens, freezer inventory management systems • System-generated barcode labels • Various barcode standards: 3-of-9 generally used for scientific applications • Produced by TrueType fonts or dedicated barcode printers

  21. Data acquisition Technologies:Barcoding, cont’d • Barcode readers • “Keyboard wedge” - wand or handheld scanner plugged between keyboard and computer • Self-contained scanners with infrared or USB bulk data upload (derived from warehouse inventory systems)

  22. Data acquisition Technologies:Mark-sensing Technologies • Example: Scantron ( • Strengths • Mature technology • Efficient for re-usable form scanning • Weaknesses • Low information density: poor for most biomedical uses • Susceptible to “frame shift” errors by users • Requires forms printing • Cost effective at level of ~ 100K forms

  23. Mark sensing technologies

  24. Data acquisition Technologies:POF: Plain Old Fax • Design issues • Include signature or initials on faxable forms • Strengths • Widely used surrogate for paper • Weaknesses • Not considered a source document • Legibility • Requires additional effort to enter data into computable form

  25. Data acquisition Technologies:Fax + Optical Character Recognition • Example: Teleform ( • Strengths • Can substitute for data entry staff • Includes design, recognition, and verification functionality • 90+% recognition accuracy depending upon data type • Weaknesses • Error rates equivalent to single entry, higher than double entry • Cost vs. person hours becomes favorable only at large numbers of forms (50-100K)

  26. Data acquisition Technologies:Direct Computer Entry by Participants • Can use thin client (HTML forms) or ‘thick client’ i.e., workstation forms (e.g., MS Access) • Strengths • If well designed, eliminates data entry step • Can add multimedia explanations and tutorials • Can be more enjoyable for study participants than paper forms • Weaknesses • Requires basic computer skills (mouse +/- keyboard) • Requires literacy skills • Requires staff assistance and verification

  27. Data acquisition Technologies:Computer to Computer Messaging • Example: import lab results from lab system directly into research database for study participants. • Strengths • If well designed, eliminates data entry step • Timeliness • Accuracy • Weaknesses • Requires specialized computer programming expertise • Requires standards for representing clinical data (most widely used = HL-7) • Requires willingness of systems managers at source of data (e.g., medical center Information Services) to allow data connections

  28. Data acquisition Technologies:PDA’s • Example: Pendragon software • Strengths • Portable, relatively low cost • Nonprogrammer interfaces to MSAccess • Weaknesses • Limited screen size and navigation speed • Not suitable for text entry • Security: lost or stolen PDA

  29. Data Archiving and Database Design

  30. Commonly used data archiving and analysis software • Single investigator, simple trial: • Spreadsheet (MS Excel) • Beware using spreadsheets for HIPAA-regulated data – no audit trail capability • Workgroup-capable database management software (MS Access, Filemaker Pro, 4th Dimension, MS Visual FoxPro) • Data Center, multiple studies • Enterprise relational database system • Sybase, Oracle, MS SQL Server • Dedicated statistical analysis packages • SAS, BMDP, SPSS, S Plus, JMP

  31. Commonly used data archiving and analysis software, cont’d • Pharmaceutical companies - multiple drugs, multiple sites, multiple studies, FDA audits • Dedicated clinical trials software (e.g., BBN ClinTrials, Oracle Clinical)

  32. Sample data model for one-time administration of a survey one one Person (Participant) * ParticipantID [primary key] Last_name First_name Address City State Zip Phone Fax E-mail MRN Birthdate SSN Gender Last_update Update_by Study_Data *ParticipantID Date Answer1 Answer2 Answer3 Answer4 Last_update Update_by Best practices: store Person table on removable media with physical security OR store Person encrypted by private key

  33. Simple clinical study with a variable number of identical repeat visits one many Person (Participant) * ParticipantID Last_name First_name Address City State Zip Phone Fax E-mail MRN Birthdate SSN Gender Last_update Update_by Study_Data *ParticipantID VisitID VisitDate BPsystolic BPdiastolic Weight Sodium Potassium Chloride Bicarb BUN Creatinine Last_update Update_by Note: In best pactice, primary key of Study_Data is the combination of Participant ID and the study visit, which defines a unique protocol event. VisitDate is the calendar date that event occurs.

  34. Clinical study with a baseline evaluation followed by variable number of identical repeat visits one Baseline *ParticipantID VisitDate DataItem1 DataItem2 DataItem3 Last_update Update_by Person (Participant) * ParticipantID Last_name First_name Address City State Zip Phone Fax E-mail MRN Birthdate SSN Gender Last_update Update_by one many Follow_Up *ParticipantID VisitID VisitDate BPsystolic BPdiastolic Weight Sodium Potassium Chloride Bicarb BUN Creatinine Last_update Update_by

  35. Data Security

  36. Information Security Elements • Availability- when and where needed • Authentication -a person or system is who they purport to be (preceded by Identification) • Access Control - only authorized persons, for authorized uses • Confidentiality - no unauthorized information disclosure • Integrity - Information content not alterable except under authorized circumstances • Attribution/non-repudiation - actions taken are reliably traceable

  37. Research Records Security,General Principles • Physical Security • Locked file storage for physical files • Programmable locks best • Change combination on a regular basis (common practice: twice a year) • Person-identifiable data • Keep separate from other study data • Consider additional protections such as two person access requirements

  38. Research Records Security, cont’d • Electronic Security • No workstations viewable from public areas • Password-protected login • Screensaver timeouts • Separate login and password for database access • Store demographics data separately and encrypted if feasible • Regular backups and offsite backup storage

  39. Research Records Security, cont’d • Network Security • Safest but least useful: disconnect workstations with research data from network • Keep all workstations and servers patched with latest security updates • Run antivirus software on all machines • Consider firewall computer to protect Internet access point, and/or workstation firewall software

  40. Information Security Elements • Availability- when and where needed • Authentication -a person or system is who they purport to be (preceded by Identification) • Access Control - only authorized persons, for authorized uses • Confidentiality - no unauthorized information disclosure • Integrity - Information content not alterable except under authorized circumstances • Attribution/non-repudiation - actions taken are reliably traceable

  41. Security Rule: Basic Concepts • Applies security principles well established in other industries • Like Privacy Rule, affects Covered Entities that create, store, use or disclose Protected Health Information (PHI) • Unlike the Privacy Rule, affects only PHI in electronic format (not oral or paper-based) • Like the Privacy Rule, written for health care; research not the principal focus • Scalable: burden relative to size and complexity of organization

  42. Two types of Rule elements • Required standards • “Addressable” standards • CE must decide whether the standard is reasonable and appropriate to the local setting, and cost to implement • Can either • Implement the standard as published • Implement some alternative (and document why) • Not implement the standard at all (and document why)

  43. Three Categories of Standards • Administrative safeguards • Policies and procedures to prevent, detect, contain and correct information security violations • Physical Safeguards • IT equipment and media protections • Technical Safeguards • Controls (mostly software) for access, information integrity, audit trails

  44. Administrative Safeguards • Required • Risk Analysis • Risk Management Plan • Sanctions Policy • Information System Activity Review (audits) • Security Incident Response & Reporting • Data Backup Plan • Disaster Recovery Plan • Emergency Mode Operations • Periodic Evaluations of Standards Compliance

  45. Physical Safeguards • Required • Workstation Use Analysis • Workstation Security • Disposal of media • deletion of PHI prior to disposal, or • Secure disposal so data nonrecoverable • Media Reuse • Deletion of PHI prior to re-use

  46. Technical Safeguards • Required • Unique User Identification • No shared logins • Emergency access procedures • Audit controls • Logs of who created, edited or viewed PHI • Person and/or Entity Authentication • No systems without access control

  47. Implications for Research • Avoid HIPAA Security Rule entanglements if possible by: • Thoughtful definition of Covered Entity with respect to research activities • E.g., Vanderbilt is Hybrid Covered Entity; research not a covered function except for research that uses or creates medical records • Use of de-identified data and/or Limited Data Sets wherever possible • Not storing PHI in electronic format in research settings

  48. If a research project maintains e-PHI… • Responsible group must designate a Security Officer who has responsibility for implementing HIPAA-compliant policies and procedures for research use of e-PHI • Must do and document a risk analysis • Must create risk management plan based on the risk analysis • Must create and keep current a HIPAA Security Rule compliance document that includes description of how 17 Required elements are met, and decisions regarding Addressable elements

  49. Widespread current research practices that don’t meet the standard • Research workgroups that create or use PHI in electronic format but have no written security procedures, policies or training • Workstations with no login security (e.g., Windows98) • Data management and analysis applications used to store PHI that have no ability to generate audit trails • E.g., Excel spreadsheets with PHI in them

  50. Using the Internetfor Clinical Research