Direct access to patient records required for monitors

Clinical trial inspections (GCP inspections) carried out by the Danish Medicines Agency have frequently revealed that the sponsor’s representatives (monitors and auditors) have not been given direct access to the investigator’s or institution’s medical records or that the access provided has been inadequate. This is a deviation.

This calls for us to clarify the requirements for such access.

Monitors are required to have direct access to medical records and other systems supplementing medical records to ensure adequate quality control for establishing that the data being reported from the investigator to the sponsor match the source data.

At our inspections, we have observed, for instance, that monitors are only given access to printed parts of the records or that the access provided is in the form of looking over the institutional staff’s shoulder. This is not considered direct access or record lookup. We also commonly saw that the sections of the medical records that were printed or made accessible did not cover all relevant information. The parts that are considered relevant are determined by the specific study protocol (e.g. inclusion and exclusion criteria) and will be assessed by the individual monitor/auditor/inspector.‘

Direct access’ and ‘lookup access’ mean that the individual user must have their own user name and password for the system.

The requirement that the sponsor’s representatives must have direct access to medical records appears in ICH E6(R3). It was also required by ICH E6(R2). In E6(R3), the requirement for direct access appears from both the responsibilities of the investigator and the sponsor and the study protocol section:

2.8.10 The informed consent discussion and the informed consent materials to be provided to participants should explain the following as applicable:(o) That by agreeing to participate in the trial, the participant or their legally acceptable representative allows direct access to source records, based on the understanding that the confidentiality of the participant’s medical record will be safeguarded. This access is limited for the purpose of reviewing trial activities and/or reviewing or verifying data and records by the regulatory authority(ies) and the sponsor’s representatives, for example, monitor(s) or auditor(s), and in accordance with applicable regulatory requirements, the IRB/IEC(s);

2.12.14 Upon request of the monitor, auditor, IRB/IEC or regulatory authority, the investigator/institution should make available for direct access all requested trial-related records.

3.6.3 The sponsor should obtain the investigator’s/institution’s and, where applicable, service provider’s agreements:(d) To permit monitoring and auditing by sponsors, inspections by regulatory authorities (domestic and foreign) and, in accordance with applicable regulatory requirements, review by IRBs/IECs, including providing direct access to source records and facilities, including to those of service providers.

3.16.4 Record access (a) The sponsor should ensure that it is specified in the protocol or other documented agreement that the investigator(s)/institution(s) provide direct access to source records for trial-related monitoring, audits, regulatory inspection and, in accordance with applicable regulatory requirements, IRB/IEC review. (b) The sponsor should ensure that trial participants have consented to direct access to source records for the purposes outlined in 3.16.4(a) (see section 2.8.10(n)).

B.11 Direct access to source records. The sponsor should ensure that it is specified in the protocol or other documented agreement that the investigator(s)/institution(s)/service provider(s) will permit trial-related monitoring, audits, regulatory inspection(s) and, in accordance with applicable regulatory requirements, review by the institutional review board/independent ethics committee (IRB/IEC), providing direct access to source records.

The requirement for direct access is also described in REGULATION (EU) No 536/2014 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 16 April 2014 on clinical trials on medicinal products for human use. The regulation states that the protocol must include a statement from the sponsor (either in the protocol or in a separate document) confirming that the investigators and institutions involved in the clinical trial are to permit clinical trial-related monitoring, audits and regulatory inspections, including provision of direct access to source data and documents. Finally, the Danish Act on the Review of Health Research Projects and Health Data Research Projects contains a similar provision. According to section 3(3), the sponsor, the sponsor’s representatives and the investigator may, by looking up data in the trial participant’s medical records and other systems supplementing the medical records, collect health data when necessary for conducting the health research project, including for carrying out quality control and monitoring, which the sponsor, the sponsor’s representatives and the investigator are obliged to carry out under the Danish Medicines Act or this act. The collection of data pursuant to the first sentence is subject to the trial participant or their legally designated representative having given their informed consent to participate in the research project in accordance with subsection (1) or (2).

As failure to provide direct access to source data is often a systematic deviation and could lead to the data integrity of a trial being influenced, such deviations will often be categorised as major or in some cases even critical.

Change log:

September 1, 2025 - New text