subtitled:

1
I Dont Look Good in Orange or Stripes
subtitled The Perils of Hard Coding Clinical
Data
Susan Fehrer
2
What is Hard Coding?

• Programmatic changing of data in a database,
  without an audit trail, that has been either
  incorrectly entered from a Case Report Form or
  other data collection medium
• or a query received from the site that should
  have been part of the database

3
What is an Audit Trail?

• Documentation
• who made the changes to the database
• when and why the changes were made
• From 21 CFR 11 a secure, computer generated,
  time-stamped electronic record that allows
  reconstruction of the course of events relating
  to the creation, modification, and deletion of an
  electronic record.

4
Hard Coding Examples

• Taken from years of industry experience
• Note the practice is more prevalent at
  pharmaceutical companies than at CROs

5
Hard Coding Examples

• Example 1 does not show any hard coding, but
  key words would raise some yellow and/or red
  flags
• xxx must run before yyy as it may affect failure
  and rx stop dates
• adds new dosing info
• adds new AEs and WHO grades, creates DB and does
  fixes
• fix the sched start date for aaa and bbb

6
Hard Coding Examples

• Example 2 also would raise some yellow and/or red
  flags from the comment only
• these should have worked but did not, hence hard
  code. Sally Programmer,
  mm/dd/yy

7
Hard Coding Examples

• Example 3 even contains comments
  hard codes per Person Q,
  mm/dd/yy to say that it is ok
• if randno106 and code then code0543
• else if randno305 and code then
  code0856

8
Hard Coding Examples

• Example 4 - probably for an NDA (note -
  study is a factor)
• if studynox patno007 viscd013 then
  wbc108.0
• if studynoy patno007 viscd014 then
  wbc116.4
• YIKES!

9
Hard Coding Examples

• Example 5 even changes a dose variable value!
  The comment at top of program is even ominous
• if xxxdose gt 98 then xxxdose .
• if yyydose gt 98 then yyydose .
• Comment createand make updates/corrections

10
Hard Coding Examples

• Example 6 an adverse event recode that may have
  unexpected effects
• if aespanaphylactic reaction randno1015
  then whograd3
• if randno1528 code 0020 then
  code1733

11
Hard Coding Examples

• Example 7 changes the start and end date of drug
  administration.by a year!
• if randno1525 xxxbegdt06jan95d then
  xxxbegdt06jan96d
• if randno1525 xxxenddt16jan95d then
  xxxenddt16jan96d

12
Hard Coding Examples

• Example 8 is the grand finale! Why not open the
  database for changes of this magnitude?
• if randno511 aefudt23sep93d code in
  (0053,0088) whograd9 then whograd3
• if randno524 aefudt22dec95d whograd9
  code0643 then delete
• No words are left to speak!

13
Hard Coding Examples

• Maybe these changes are very minor and will not
  affect the efficacy or safety analyses
• BUT it is very dangerous to make these changes.

14
Hard Coding Examples

• If any of these data issues do affect the safety
  and/or efficacy analyses, then the database MUST
  be opened and the data changed with required
  audit trail

15
What Programmers are Told

• It is too late to open the database and you must
  make the correction(s) sic
• The data change will not affect the overall
  safety or efficacy of the study, so go ahead and
  make the changes
• If you document the changes in a program like
  README.SAS and keep a hard copy of the reasons,
  why, it is OK.

16
What Programmers are Told

• It is too late to open the database and you must
  make the correction(s) sic
• It is never too late to open the database and
  make the correction. What you are being told is
  that the requestor cannot get all of the
  signatures in a timely manner and project
  timelines will be affected.
• Wouldnt you rather delay the timelines than
  compromise your standards?

17
What Programmers are Told

• The data change will not affect the overall
  safety or efficacy of the study, so go ahead and
  make the changes
• If these data issues are minor
• address them in the research report in an errata
  list
• and/or the programmer can footnote these data
  points in the table and listing that contain them

18
What Programmers are Told

• If you document the changes in a program like
  README.SAS and keep a hard copy of the reasons
  why, it is OK.
• This is almost self-explanatorywho really reads
  README.SAS when they get into a project? What if
  you leave the project/ company.who will know to
  look for a comment?

19

• IND 21CFR312.62(b) states that you must prepare
  and maintain adequate and accurate case
  histories
• 21CFR312.68 permits the FDA to have access to and
  copy and verify any records or reports required
  under 312.62(b).
• All submissions 21CFR11 applies

20

• Case histories record all observations and other
  data pertinent to the investigation on each
  subject administered the study drug or used as a
  control.
• Case histories include Case Report Forms and
  supporting data.

21

• 21CFR11 applies to electronic records which are a
  combination of text, graphics, data, or other
  information in digital form, that are created,
  modified, maintained, archived, retrieved, or
  distributed by a computer system.

22

• The FDA considers electronic records, electronic
  signatures, and handwritten signatures executed
  to electronic records to be trustworthy,
  reliable, and equivalent to paper records and
  handwritten signatures.

23

• The procedures and controls of electronic records
  include validation, ability to generate accurate
  and complete copies of records suitable for
  inspection, review, and copying by the agency,
  protection of records to enable accurate
  retrieval, limiting system access, use of audit
  trails, system controls, and personnel training
  and experience.

24

• .all of which are subject to inspection by the
  FDA.

25
Compliance

• Compliance to these federal regulations is
  enforced by Compliance Policy Guide, Section
  160.850, Title Enforcement Policy 21 CFR Part
  11 Electronic Records Electronic Signatures
  (CPG 7153.17), 13 May 1999.

26
Compliance

• Policy states when persons are not fully
  compliant with Part 11, decisions on whether or
  not to pursue regulatory actions will be based on
  a case by case evaluation.

27
Factors Affecting Regulatory Action

• Nature and extent of Part 11 deviation(s)
• FDA will consider Part 11 deviations to be more
  significant if those deviations are numerous, if
  the deviations make it difficult for the agency
  to audit or interpret the data, or if the
  deviations undermine the integrity of the data or
  the electronic system.

28
Factors Affecting Regulatory Action

• Nature and extent of Part 11 deviation(s)
• FDA would have little confidence in data from
  companies that do not hold their employees
  accountable and responsible for actions taken
  under their electronic signature.

29
Factors Affecting Regulatory Action

• Effect on product quality and data integrity
• FDA would consider the absence of an audit trail
  to be highly significant when there are data
  discrepancies and when individuals deny
  responsibility for record entries.

30
Factors Affecting Regulatory Action

• Adequacy and timeliness of planned corrective
  measures
• Firms should have a reasonable timetable for
  promptly modifying any systems not in compliance
  (including legacy systems) to make them Part 11
  compliant and should demonstrate progress in
  implementing their timetable.
• Requirements for procedural controls should be in
  place.

31
Factors Affecting Regulatory Action

• Compliance history of the establishment,
  especially with respect to data integrity
• Deviations are considered more significant if a
  firm has a history of Part 11 violations or of
  inadequate or unreliable recordkeeping.
• Until firms attain full compliance with Part 11,
  FDA investigators will exercise greater vigilance
  to problems in complying with Part 11.

32
Factors Affecting Regulatory Action

• FDA Division of Bioresearch Monitoring Program
  (BIMO) is authorized to monitor the conduct and
  reporting of clinical trials to ensure that data
  from these trials meet the highest standards of
  quality and integrity.

33
What Can You Do?

• Refuse to programmatically change database data
  in order to have the database match the Case
  Report Form
• Program so FDA could walk in tomorrow and do a
  complete audit
• Document all programs
• Keep validation materials

34
Orange or Stripes?

• Prisoners wear orange uniforms or white uniforms
  with black stripes
• Dont let it
• be you!

SAS guru
35
References

• FDA, Compliance Policy Guide, Section 160.850,
  Title Enforcement Policy 21CFR Part 11
  Electronic Records Electronic Signatures (CPG
  7153.17)
• FDA, Guidance for Industry Computerized Systems
  Used in Clinical Trials, April 1999
• FDA, 21 CFR Part 11 Electronic Records
  Electronic Signatures 20 March 1997
• FDA, 21CFR Part 312 Investigational New Drug
  Application 5 November 1996
• FDA, Bioresearch Monitoring, Office of
  Compliance 14 January 1999
• www.fda.gov