Docstoc

vaCTMS SOP v2003 for redo

Document Sample
vaCTMS  SOP v2003 for redo Powered By Docstoc
					VAHS           CTMS SOP    11/5/2011   1 of 32



vaCTMS SOP



Appendix: vaCTMS SOP




VAHCS Electronic Clinical Trial Management System V.1.1 100804

Manual of Standard Operating Procedures



Study Title

[Study Name]



Study Sponsor

[ ]

Coordinating Center

MAVERIC (151MAV)
150 S. Huntington Ave
Boston, MA 02130
Telephone: 617.232.9500 x. 4201
Facsimile: 617.278.4422



Principle Investigators




Information Technology Officer

David Rose

Boston VAHCS (151MAV)

150 South Huntington Ave


                                                                 1
VAHS        CTMS SOP   11/5/2011   2 of 32



Boston, MA 02130

617.232.9500 x.6143
david.rose@va.gov




                                             2
VAHS        CTMS SOP   11/5/2011         3 of 32



Quick Look at Important Information




ALL INFORMATION GENERATED DURING THE COURSE OF THIS STUDY MUST BE DOCUMENTED
ON THE PORTAL WITHIN 24 HOURS OF RECIEPT.



DO NOT USE THE STUDY PORTAL UNLESS YOU HAVE ATTENDED, CERTIFIED AND DOCUMENTED
SYSTEM TRAINING.



ONLY DE-IDENTIFIED SUBJECT INFORMATION IS ALLOWED ON THE PORTAL.


THIS STUDY PORTAL DOES NOT TO SERVE AS AN EDC, QUERY RESOLUTION OR ADVERSE EVENT
REPORTING TOOL. ALL CLINICAL DATA, QUERY RESOLUTION AND ADVERSE EVENT REPORTING
IS TO BE COLLECTED ON THE DISTRIBUTED PAPER BASED CASE REPORT FORMS AND MANAGED
AS PER THE INVESTIGATORS BROCHURE.



IF YOU DO NOT HAVE YOUR REAL WRITTEN SIGNATURE ON FILE WITH THE FDA DO NOT USE THE
PORTAL. CONTACT THE STUDY COORDINATOR IMMEDIATELY FOR RESOLUTION.



DO NOT DELETE ANY RECORD THAT HAS BEEN SAVED AS COMPLETED. INSTEAD CREATE A NEW
RECORD AND STATE WHY THE CHANGE WAS MADE IN THE COMMENTS/ANNOTATIONS FIELD
ASSOCIATED WITH THE CHANGED RECORD. IF YOU HAVE INADVERTANTLY DELETED A RECORD
CONTACT THE SYSTEM ADMINISTRATOR IMMEDIATELY.




                                                                                   3
VAHS                CTMS SOP           11/5/2011                      4 of 32



Quick Look at Important Information................................................................................. 3
Introduction ......................................................................................................................... 5
Definitions........................................................................................................................... 6
System Setup/Installation*.................................................................................................. 8
   Technical Specifications and Requirements for Study Clinical Trial Management System
   ......................................................................................................................................... 8
   Software and Hardware History...................................................................................... 9
       Desktop (User must specify) ....................................................................................... 9
       Server ........................................................................................................................ 10
       Hardware Specifications ........................................................................................... 10
   Training ......................................................................................................................... 10
   Start up procedures ....................................................................................................... 11
   Technical Support ......................................................................................................... 11
   Lost Passwords.............................................................................................................. 12
Data Collection and Handling ........................................................................................... 12
   Subject Privacy and Confidentiality ............................................................................. 12
   Source Documents ........................................................................................................ 12
       Source Documents on Portal ..................................................................................... 12
       Non-Source Documents on Portal ............................................................................ 13
   Attributability................................................................................................................ 14
   Change Control ............................................................................................................. 14
       Protocols ................................................................................................................... 16
   Audit Trails ................................................................................................................... 16
   Date and Time Stamps .................................................................................................. 17
   Paper Print Out of Portal Information ........................................................................... 18
       Printing list information ............................................................................................ 18
       Printing documents ................................................................................................... 18
System Maintenance ......................................................................................................... 19
Data Backup, Recovery, and Contingency Plans.............................................................. 19
       System failure ........................................................................................................... 19
       Study Replication ...................................................................................................... 19
Security ............................................................................................................................. 19
   Logical Security ............................................................................................................ 19
       Digital Signatures...................................................................................................... 20
       Password ................................................................................................................... 20
       Desktop Security ....................................................................................................... 21
       Server Security .......................................................................................................... 21
       Security Software ...................................................................................................... 22
   Physical Security........................................................................................................... 22
System Dependability ....................................................................................................... 22
System Control.................................................................................................................. 22
       Software Version Control ......................................................................................... 22
Training of Personnel ........................................................................................................ 22
       Qualifications ............................................................................................................ 23
       Training ..................................................................................................................... 23
       Documentation .......................................................................................................... 23



                                                                                                                                                 4
VAHS              CTMS SOP        11/5/2011                   5 of 32



Records Inspection ............................................................................................................ 23
     Records inspection .................................................................................................... 23
Certification of Electronic Signatures ............................................................................... 24
     Electronic Signature Certification............................................................................. 24
Detailed System Requirements ......................................................................................... 24
APPENDIX A.              Sample Letters of Non-Repudiation AgreementError! Bookmark not
defined.24



[Study Name] Electronic Clinical Trial Management System Standard
Operating Procedures


Introduction

This document addresses issues pertaining to computerized systems used to create,
modify, maintain, archive, retrieve, or transmit clinical data intended for submission to
the Food and Drug Administration (FDA). These data form the basis for the Agency's
decisions regarding the safety and efficacy of new human and animal drugs, biologics,
medical devices, and certain food and color additives. As such, these data have broad
public health significance and must be of the highest quality and integrity.




This SOP is established to document the following operational categories:

                   System Setup/Installation
                   Data Collection and Handling
                   System Maintenance
                   Data Backup, Recovery, and Contingency Plans
                   Security
                   Change Control
                   Alternative Recording Methods (in the case of system unavailability)


FDA established the Bioresearch Monitoring (BIMO) Program of inspections and audits
to monitor the conduct and reporting of clinical trials to ensure that data from these trials
meet the highest standards of quality and integrity and conform to FDA's regulations.
FDA's acceptance of data from clinical trials for decision-making purposes is dependent
upon its ability to verify the quality and integrity of such data during its onsite inspections



                                                                                                                                     5
VAHS          CTMS SOP   11/5/2011         6 of 32




and audits. To be acceptable the data should meet certain fundamental elements of
quality whether collected or recorded electronically or on paper. Data should be
attributable, original, accurate, contemporaneous, and legible. For example, attributable
data can be traced to individuals responsible for observing and recording the data. In an
automated system, attributability could be achieved by a computer system designed to
identify individuals responsible for any input.

This manual of Standard Operating Procedures addresses how these elements of data
quality are satisfied by the system being used to create, modify, maintain, archive,
retrieve, and transmit clinical data for the VAHCS [Study Name]. Persons using the data
from computerized systems should have confidence that the data are no less reliable
than data in paper form.

This document reflects long-standing regulations covering clinical trial records. It also
addresses requirements of the Electronic Records/Electronic Signatures rule (21 CFR
part 11).

These Standard Operating Procedures are to be applied where source documents are
created (1) in hardcopy and later entered into a computerized system, (2) by direct entry
by a human into a computerized system, and (3) automatically by a computerized
system.

Definitions


Audit Trail          means, for the purposes of this guidance, a secure, computer
                     generated, time-stamped electronic record that allows reconstruction
                     of the course of events relating to the creation, modification, and
                     deletion of an electronic record
Certified Copy       means a copy of original information that has been verified, as
                     indicated by dated signature, as an exact copy having all of the
                     same attributes and information as the original.
Commit               means a saving action, which creates or modifies, or an action which


                                                                                            6
VAHS           CTMS SOP   11/5/2011           7 of 32




                      deletes, an electronic record or portion of an electronic record. An
                      example is pressing the key of a keyboard that causes information to
                      be saved to durable medium.
Computerized          means, for the purpose of this guidance, computer hardware,
System                software, and associated documents (e.g., user manual) that create,
                      modify, maintain, archive, retrieve, or transmit in digital form
                      information related to the conduct of a clinical trial.
CTMS                  means Clinical Trial Management System
Direct Entry          means recording data where an electronic record is the original
                      capture of the data. Examples are the keying by an individual of
                      original observations into the system, or automatic recording by the
                      system of the output of a balance that measures subject’s body
                      weight.
Electronic Case       means an auditable electronic record designed to record information
Report Form (e-       required by the clinical trial protocol to be reported to the sponsor on
CRF)                  each trial subject.
Electronic            means an electronic record into which a subject participating in a
Patient Diary         clinical trial directly enters observations or directly responds to an
                      evaluation checklist.
Electronic            means any combination of text, graphics, data, audio, pictorial, or
Record                any other information representation in digital form that is created,
                      modified, maintained, archived, retrieved, or distributed by a
                      computer system.
Electronic            means a computer data compilation of any symbol or series of
Signature             symbols, executed, adopted, or authorized by an individual to be the
                      legally binding equivalent of the individual's handwritten signature.
Software              means confirmation by examination and provision of objective
Validation            evidence that software specifications conform to user needs and
                      intended uses, and that the particular requirements implemented
                      through the software can be consistently fulfilled. For the purposes



                                                                                               7
VAHS                CTMS SOP      11/5/2011                    8 of 32




                            of this document, design level validation is that portion of the
                            software validation that takes place in parts of the software life cycle
                            before the software is delivered to the end user.
Source                      means original documents and records including, but not limited to,
Documents                   hospital records, clinical and office charts, laboratory notes,
                            memoranda, subjects' diaries or evaluation checklists, pharmacy
                            dispensing records, recorded data from automated instruments,
                            copies or transcriptions certified after verification as being accurate
                            and complete, microfiches, photographic negatives, microfilm or
                            magnetic media, x-rays, subject files, and records kept at the
                            pharmacy, at the laboratories, and at medico-technical departments
                            involved in the clinical trial.
Transmit                    means, for the purposes of this guidance, to transfer data within or
                            among clinical study sites, contract research organizations, data
                            management centers, or sponsors. Other Agency guidance covers
                            transmission from sponsors to the Agency.




System Setup/Installation*

Technical Specifications and Requirements for Study Clinical Trial
Management System




CSP IT eCTMS Technical         Micorosoft® Servers:
     Specifications            Sharepoint Portal Services,
       7/22/2004               Windows 2000, 2003
                               Advanced, IIS-6, SQL 2000.
                                                             IT Coordinating Center




Micorosoft®            Micorosoft®             Micorosoft®               Micorosoft®
Windows                Windows                 Windows                   Windows
2000Professional,      2000Professional,       2000Professional,         2000Professional,   Study Sites...
Office 2003, IE6       Office 2003, IE6        Office 2003, IE6          Office 2003, IE6




                                                                                                              8
VAHS          CTMS SOP     11/5/2011              9 of 32




Coordinating Center Software Requirements

Sharepoint Portal Server V2, Microsoft Windows 2000 Server and Windows 2003 Advanced Server,
Internet Information Services, SQL Server 2000, any other server packages required to run the
developed software.



Coordinating Center Hardware Requirements

Dell and Micron servers featuring multiple Intel Xeon processors running at speeds up to 3.06 GHz, with
as much as 6 GB RAM, and RAID arrays providing hundreds of gigabytes of fault tolerant storage.



Study Site Software Requirements

Microsoft’s Windows 200 Professional operating system, MS Office Pro 2003, and using Microsoft
Internet Explorer 6.0 (Service Pack 1) as the default web browser



Study Site Hardware Requirements

The target processing environment on the client side requires PC’s running, with Intel processors
running from 450 GHz up to 3.0 GHz, powered by anywhere from 128 to 2056 MB of RAM. Printer-
Scanner-Copier.




*see Detailed System Requirements



Software and Hardware History
The following is a list of software at the time of study startup. An updated list is to be maintained by the
informatics specialist and available for inspection on the Coordinating Center portal.



Desktop (User must specify)
           NAME                                                   DATE OF SERVICE

Office Professional 2003



                                                                                                           9
VAHS         CTMS SOP     11/5/2011           10 of 32




MacAfee Antiviral



IE6



Other VA




Server
           NAME                                               DATE OF SERVICE

Sharepoint Sever 2003                          8/17/2004



Windows Server 2003                            8/17/2004
Standard



SQL Server 2000 SP3                            8/17/2004

McAfee PortalShield                            8/17/2004

APC UPS Interface Software                     8/17/2004



Hardware Specifications


XEON 2.8GB processor, 1gb memory, 2-36gb drives mirrored, and 3 142gb drives raid 5. Backup to tape,
DVD drive and rack mounted.




                                                                                                  10
VAHS           CTMS SOP    11/5/2011             11 of 32




Training

All personnel accessing the system must first complete and document training supplied by Coordinating
Center staff.



DO NOT USE THE PORTAL UNLESS YOU HAVE ATTENDED, CERTIFIED AND DOCUMENTED SYSTEM
TRAINING


Start up procedures

1. Install Office 2003


VAHCS has ownership of 250,000 licenses for Office 2003. Contact you local hospitals IT department for
installation of you copy of Office 2003 Professional.



2. Download and install IE 6.0 or above


Set browser settings to “Default” setting: On the menu bar select “Tools”>”Internet
Options”>”Advanced” and press the button “Restore Defaults” on the popup window.



3. Logon to your site and change your password


In order to help remember your sites location, save your site as a “Favorite” or set as your homepage
(“Tools”>”Internet Options”>”General” tab>type in [Site URL] into home page field and press “OK.”



Technical Support
Detailed help screens are available on the Study Portal. Technical support is available from the study
Informatics Specialists during regular business hours (EST):



VHABHSMAVERIC-IT@va.gov




                                                                                                         11
VAHS          CTMS SOP      11/5/2011             12 of 32



Emergencies (portal site down or dysfunctional ) call: (617) 513-2482



Lost Passwords

Contact the Study Informatics Specialist to retrieve a lost password.


VHABHSMAVERIC-IT@va.gov



Emergencies (portal site down or dysfunctional ) call: (617) XXX.XXXX



Data Collection and Handling


Subject Privacy and Confidentiality
Any reference to a study subject must be de-identified according to current HIPAA guidelines.



ONLY DE-IDENTIFIED SUBJECT INFORMATION IS ALLOWED ON THE PORTAL.

Source Documents

Source documents should be retained to enable a reconstruction and evaluation of the trial. When
original observations are entered directly into a computerized system, the electronic record is the
source document. Clinical investigators should retain either the original or a certified copy of all source
documents sent to a sponsor or contract research organization, including query resolution
correspondence.



THIS STUDY PORTAL DOES NOT TO SERVE AS AN EDC, QUERY RESOLUTION OR ADVERSE EVENT
REPORTING TOOL. ALL CLINICAL DATA, QUERY RESOLUTION AND ADVERSE EVENT REPORTING IS TO BE
COLLECTED ON THE DISTRIBUTED PAPER BASED CASE REPORT FORMS.




                                                                                                          12
VAHS           CTMS SOP     11/5/2011            13 of 32



Source Documents on Portal
This study will use the portal as the source document for VAHCS retention of all official versions of the
following study related information:



Documents:



    1.   Protocol
    2.   Investigator Brochure
    3.   CTMS Standard Operating Procedures
    4.   Study Brochures and Patient Information


Certified, scanned copies of source documents:



    1.   Approved Informed Consent Templates
    2.   Laboratory certifications
    3.   Pharmacy agreements
    4.   Budget and financial agreements
    5.   Site and study monitoring reports
    6.   Investigator and participant Credentialing, CVs and Licenses


Lists:



    1.   Subject log
    2.   Key Events Log
    3.   Participant Directory
    4.   Telephone Log
    5.   Communications Log
    6.   Training Log


Non-Source Documents on Portal
The following is a list of documents to be maintained on the portal but are not meant to serve as source
documents. Instead they serve a web based downloadable repository of templates of these documents
to facilitate distribution to the field. These documents must be maintained in similar fashion as to other
paper based documents as described in the most recent version of the Investigators Brochure.




                                                                                                            13
VAHS          CTMS SOP     11/5/2011            14 of 32



    1. Case Report Forms
    2. Queries
    3. Adverse Events


Attributability

The data entry system is designed to ensure attributability. Therefore, each entry to an
electronic record, including any change, should be made under the electronic signature
of the individual making that entry. However, this does not necessarily mean a separate
electronic signature for each entry or change. For example, a single electronic signature
may cover multiple entries or changes.

Your login information serves as your electronic signature. Changes made to the Portals document
libraries and lists are time stamped and attributed to the currently active log in name. FDA requires a
paper list of all participant signatures be approved by them before any electronic CTMS can be used for
study records. All personnel must have their real written signatures filed with the FDA before
participating in the Study Portal.



IF YOU DO NOT HAVE YOUR REAL WRITTEN SIGNATURE ON FILE WITH THE FDA DO NOT USE THE
PORTAL. CONTACT THE STUDY COORDINATOR IMMEDIATELY FOR RESOLUTION.



Change Control

Any change to a record required to be maintained should not obscure the original information. The
record should clearly indicate that a change was made and clearly provide a means to locate and read
the prior information. Changes to data that are stored on electronic media will always require an audit
trail, in accordance with 21 CFR 11.10(e). Documentation should include who made the changes, when,
and why they were made.



Audit information includes; user id, date & time, filename and actions performed. Administrators
can extract audit information to a file to enable further analysis using tools such as Microsoft
Excel.



Document and form libraries (Protocol, Documents I, Documents II, Correspondence)



                                                                                                      14
VAHS           CTMS SOP     11/5/2011                15 of 32



       Contributors can view, add, edit and delete items.
       Content approval is required by the Study Coordinator for a changed or new document.
       Versions are maintained of all documents.
       An audit trail that cannot be edited or deleted by study personnel is maintained for all
        document and form libraries. The audit trail is a chronological list reporting all changes to the
        document library by event, user, time and date. The audit trail is available for viewing and print
        out by study authorities.


Lists (Event Log, Directory, Subject Log, Training Log, Telephone Log, IT Event Log)



Contributors can and view and add items but cannot edit or delete. Once a list item has been saved to
medium it will be retained for the lifecycle of the study. It can however be hidden from public view but
remains accessible to study authorities for review.




DO NOT DELETE ANY RECORD THAT HAS BEEN SAVED AS COMPLETED. INSTEAD CREATE A NEW RECORD
AND STATE WHY THE CHANGE WAS MADE IN THE COMMENTS/ANNOTATIONS FIELD ASSOCIATED WITH
THE CHANGED RECORD.



There are several automated process built into the system enforced by administrative access
permissions to allow automation of audit and change control.



Privileges and rights are distributed according to the user’s role in the study. Accumulative record
indicating, for any point in time, the names of authorized personnel, their titles , and a description of
their access privileges is to be maintained in the “Directory” panel of the local study portal.



Reader- View items

Contributor- View, Add List Items, Edit List Items

Web Designer - View, Add List Items, Edit List Items, Delete List Items, Manage List Permissions

IT Administrator- Change server time stamp, Add-delete users, Control of all system application
functionality




                                                                                                            15
VAHS           CTMS SOP      11/5/2011              16 of 32



Study and Site Coordinators and Study and Site Investigators are granted “Contributor” privileges.




Protocols
The protocol library cannot be edited, added or deleted at the site level. To ensure commonality of the
active protocol across the study sites, new versions of the protocol are programmatically “Pushed” to all
sites from the Study Coordinating Center Portal for local IRB approval. The site investigators and
coordinators should view the Study Coordinating Center Portal daily for review of new announcements.
Alternatively, the “Alert” functionality of the Portal may be used to provide notification to new
announcements.



Audit Trails
Section 21 CFR 11.10(e) requires persons who use electronic record systems to maintain an audit trail as
one of the procedures to protect the authenticity, integrity, and, when appropriate, the confidentiality
of electronic records.



Persons must use secure, computer-generated, time-stamped audit trails to independently record the
date and time of operator entries and actions that create, modify, or delete electronic records. A record
is created when it is saved to durable media, as described under "commit" in Definitions.



Audit trails must be retained for a period at least as long as that required for the subject electronic
records (e.g., the study data and records to which they pertain) and must be available for agency review
and copying



Personnel who create, modify, or delete electronic records should not be able to modify the audit trails.



Clinical investigators should retain either the original or a certified copy of audit trails.



FDA personnel should be able to read audit trails both at the study site and at any other location where
associated electronic study records are maintained.




                                                                                                       16
VAHS          CTMS SOP      11/5/2011             17 of 32



Audit trails should be created incrementally, in chronological order, and in a manner that does not allow
new audit trail information to overwrite existing data in violation of §11.10(e).



V System and viewable on Portal


       Date and author attribution maintained with document versions.
       Explanation of change required to be input into system before edit is accepted.
        (protocols may not be edited on sub sites)



Three levels of Audit trails function to satisfy requirements of 21 CFR 11.



Level One. The Syntergics Audit feature records all changes to documents and lists and is uneditible by
the individual effecting the change. Only designated study IT personnel have the capability to effect a
change to this audit trail. The audit trail may be easily accessed for viewing and is capable of printing
out a list of all changes to system. (describe A). This audit trail describes system level changes to
documents and lists (upload, edit, download, delete, etc.) but does not describe transactional
information, for example changes in the body of text. To capture this information versions of
documents are saved automatically upon saving of the change to the media. These versions are
unalterable and may not be deleted by the individual effecting the change.



Level Two. Audit trail is maintained on portal system lists describing who, what, when and why changes
were made. Only administrator may edit audit trail



Level Three. Redundant backup mirror of studies are preserved monthly.




Date and Time Stamps

Controls are in place to ensure that the system's date and time are correct. Study
personnel must log into the system to effect a change on the local time stamp.




                                                                                                        17
VAHS          CTMS SOP     11/5/2011             18 of 32




The ability to change the date or time is limited to authorized study personnel and such
personnel should be notified if a system date or time discrepancy are Study and Site
Coordinators and Investigators and designated study Informatics Officers. Changes to
date or time should be documented on the Portals list of Key Events.

Dates and times are to be local to the activity being documented and should include the year, month,
day, hour, and minute. All dates associated with modifications of Portal libraries and lists are displayed
in year, month, day, hour, and minute. The Agency encourages establishments to synchronize systems
to the date and time provided by trusted third parties. We currently use below two government sites to
synchronize our server clock online, and we use National Institute of Standards and Technology protocol
standards (Please see www.ntp.org).



time-A.timefreq.bldrdoc.gov
time-nw.nist.gov


In addition desktops operating windows 2000 or XP may set their desktop clock to be
synched directly with NIST or Microsoft Windows Network Server.

Access to the remote server clock is restricted to this studies designated Informatics
Officer.

Paper Print Out of Portal Information
Capability is built into the system to maintain paper copies of all information input into the portal’s
document libraries and lists. If users desire to periodically print hard copies of study information this
action is facilitated on the page entitled “Study Binder” accessible from the “Quick Launch” panel of the
portal site’s Home Page.



Printing list information
Be certain that all task panes are open by clicking the down arrow on the links bar of the pane and
selecting “restore.” Press the “Print” button at the top of your screen to begin printing.



Printing documents
To print a single document open select to open the document and select to print on the file menu. To
print multiple documents, navigate to the document library window by selecting the document library




                                                                                                        18
VAHS           CTMS SOP     11/5/2011              19 of 32



name on the library pane’s title bar. Then select “explorer view” under “views” in the left panel of the
screen. Then highlight documents to print and right click mouse to select “print.”


System Maintenance

Data Backup, Recovery, and Contingency Plans
Backup and recovery logs will be maintained by system administrators to facilitate an assessment of the
nature and scope of the data loss resulting from a system failure.



    1. Backup and Recovery Plan Description
          a. Backup and recovery procedures should be clearly outlined in the SOPs and be sufficient
              to protect against data loss. Records should be backed up regularly in a way that would
              prevent a catastrophic loss and ensure the quality and integrity of the data. Backups
              will be performed via Windows backup up once per week and images maintained at an
              offsite facility.
          b. Backup and recovery logs will be maintained to facilitate an assessment of the nature
              and scope of data loss resulting from a system failure.




System failure
If the CTMS appears unstable or is unusable contact the system administrator immediately. Photocopies
of forms that duplicate the function of the lists on the study portal arrived with the original study packet
and are to be used as back up until the system is stabilized. Forms needed because a blank has not been
reserved for photocopy purposes will be available from the study coordinator. When the system returns
online and is stable, data from the paper forms must be transferred to the web site. Save all such paper
forms with other study materials as per the Investigators Brochure and training. Your “electronic
signature” on the list item will certify the electronic version as the “source.” Record and describe the
event in the “Key Events” panel of the Portal



Study Replication
After the close of the study the Portal will be saved to DVD where it is available for replication in entirety
and original format. Replication will require a system running Microsoft Sharepoint Server. Instructions
for performing this operation will be on a “Read Me” file available on the DVD. One copy of this DVD
will be given to each participating Principle Investigator to be maintained at the participating site.




                                                                                                           19
VAHS          CTMS SOP     11/5/2011             20 of 32




Security

Logical Security
The system will remain dedicated to the purpose for which it is intended and validated.



Access to the data at the clinical site is restricted and monitored through the system's software with its
required log-on, security procedures, and audit trail. The data should not be altered, browsed, queried,
or reported via external software applications that do not enter through the protective system software.


A cumulative record, for any point in time, the names of authorized personnel, their
titles, and a description of their access privileges is to be maintained and accessible on
the local study portal within the “Directory” panel.

Digital Signatures
FDA requires that individuals have the authority to proceed with data entry. The system is designed such
that users need to enter electronic signatures, as a combined identification codes/passwords at the start
of a data entry session.


The data entry system should also be designed to ensure attributability. Therefore, each
entry to an electronic record, including any change, is be made under the electronic
signature of the individual making that entry. However, this does not necessarily mean a
separate electronic signature for each entry or change. For example, a single electronic
signature may cover multiple entries or changes.

The printed name of the individual who enters data is displayed by the data entry screen
throughout the data entry session. This is intended to preclude the possibility of a
different individual inadvertently entering data under someone else’s name.

If the name displayed by the screen during a data entry session is not that of the person
entering the data, then that individual should log on under his or her own name before
continuing.

When someone leaves a workstation, the person should log off the system. Failing this,
an automatic log off will occur for long idle periods.



                                                                                                       20
VAHS          CTMS SOP     11/5/2011             21 of 32



Password
All efforts must be made to maintain confidentiality of the user’s password.



The password is to be changed at regular intervals of every three months.

Desktop Security
To ensure that individuals have the authority to proceed with data entry, the data entry system is
designed so that individuals need to enter electronic signatures by combined identification
codes/passwords at the start of a data entry session.


When someone leaves a workstation, the person should log off the system. Failing this,
an automatic log off will occur for long idle periods. For short periods of inactivity, an
automatic screen saver will occur that prevents data entry until a password is entered.

Individuals should only work under their own passwords or other access keys and
should not share these with others. Individuals should not log on to the system in order
to provide another person access to the system. If the current user name displayed by
the screen during a data entry session is not that of the person entering the data, then
that individual should log on under his or her own name before continuing. The printed
name of the individual who enters data will be displayed by the data entry screen
throughout the data entry session. This is intended to preclude the possibility of a
different individual inadvertently entering data under someone else’s name.

Protocol and Informed Consent, Source documents residing on the system are securely maintained on
backup medium


Controls are in place both server side and by VA policy on the desktop to prevent,
detect, and mitigate effects of computer viruses on study data and software.



Server Security
The Information Security Program in support of this system is based on the International Standards
Organization’s Code of Practice for Information Security Management (ISO17799). Technical security
measures, such as Cisco Pix, provide firewall protection, intrusion detection, and web-publishing rules.
The MAVERIC software assurance team tests and deploys software updates in order to maintain the



                                                                                                           21
VAHS           CTMS SOP      11/5/2011             22 of 32



highest level of security and software reliability. Software hot-fixes and service packs are tested and
deployed based on their priority and level of risk. Security related hot-fixes are rapidly deployed into the
environment to address current threats. A comprehensive software validation activity ensures software
stability through regression testing prior to deployment.

Finally, Microsoft Gold Certified operations ensure that the proper change management and
configuration management procedures are always followed.



Security Software
McAfee antiviral (desktop)

McAfee Portal Shield (Server)

Physical Firewall



Physical Security

Facility Security:

Locked building with electronic intrusion system

Locked cage for second level server security

System Dependability
Because this software is purchased off-the-shelf, validation has been done by the company that wrote
the software (Microsoft, Redmond WA) and this documentation is available through the Coordinating
Center’s quality assurance personnel. Coordinating Center’s quality assurance has performed functional
testing (e.g., by use of test data sets) and researched known software limitations, problems, and defect
corrections.



System Control

Software Version Control
With any change to a new version of software, the change must be updated in this SOP, announced and
distributed to all participating sites. All changes to versions of software will be recorded on the “IT
Event Log” maintained on the Study Coordinator’s Portal.




                                                                                                          22
VAHS          CTMS SOP     11/5/2011              23 of 32



Training of Personnel


Qualifications
Each person who enters or processes data should have the education, training, and experience or any
combination thereof necessary to perform the assigned functions. Individuals responsible for
monitoring the trial should have education, training, and experience in the use of the computerized
system necessary to adequately monitor the trial.



Training
Training will be provided to individuals in the specific operations that they are to perform.



Training will be conducted by qualified individuals on a continuing basis, as needed, to ensure familiarity
with the computerized system and with any changes to the system during the course of the study.



Online videos of standard portal operations are available to all users of the study portal.



Documentation
Employee education, training, and experience will be documented on the “Training Log” list on the
Study Coordinators Portal.



Records Inspection

Records inspection
FDA may inspect all records that are intended to support submissions to the Agency, regardless of how
they were created or maintained. Therefore, systems should be able to generate accurate and complete
copies of records in both human readable and electronic form suitable for inspection, review, and
copying by the Agency. Persons should contact the Agency if there is any doubt about what file formats
and media the Agency can read and copy.



Study Informatics Specialists will provide hardware and software as necessary for FDA personnel to
inspect the electronic documents and audit trail at the site where an FDA inspection is taking place.




                                                                                                         23
VAHS          CTMS SOP      11/5/2011             24 of 32



Certification of Electronic Signatures

Electronic Signature Certification
As required by 21 CFR 11.100(c), persons using electronic signatures to meet an FDA signature
requirement shall, prior to or at the time of such use, certify to the agency that the electronic signatures
in their system, used on or after August 20, 1997, are intended to be the legally binding equivalent of
traditional handwritten signatures.


As set forth in 21 CFR 11.100(c), the certification shall be submitted in paper form
signed with a traditional handwritten signature to the Office of Regional Operations
(HFC-100), 5600 Fishers Lane, Rockville Maryland 20857. The certification is to be
submitted prior to or at the time electronic signatures are used. However, a single
certification may cover all electronic signatures used by persons in a given organization.
This certification is a legal document created by persons to acknowledge that their
electronic signatures have the same legal significance as their traditional handwritten
signatures. An acceptable certification may take the following form:

"Pursuant to Section 11.100 of Title 21 of the Code of Federal Regulations, this is to certify that [name of
organization] intends that all electronic signatures executed by our employees, agents, or
representatives, located anywhere in the world, are the legally binding equivalent of traditional
handwritten signatures."


Detailed System Requirements




Recommended Microsoft Configurations:



Windows Server 2003



Use Microsoft Installation and System requirements.



Windows SQL Server 2000




                                                                                                          24
VAHS          CTMS SOP     11/5/2011              25 of 32



Use Microsoft Installation and System requirements.




SharePoint Portal Server v2,




Before you install Microsoft SharePoint Portal Server "v2.0" 2, ensure that you have installed the required
hardware and software.



Server Requirements



Hardware Requirements



The following are recommended minimum hardware requirements for the server:



Intel Pentium III-compatible processor

256 megabytes (MB) of random access memory (RAM)

550 MB free hard disk space

Important: The disk must be formatted as NTFS file system.



Program and data file paths cannot be to removable or networked storage. Setup verifies this.



Software Requirements



The server must be running one of the following operating systems:



Note: For Microsoft SharePoint Portal Server "v2.0", only Windows Server 2003 Release Candidate 2 is
supported.


                                                                                                         25
VAHS           CTMS SOP    11/5/2011             26 of 32




Windows Server 2003, Standard Edition, plus the latest service pack

Windows Server 2003, Enterprise Edition, plus the latest service pack

Windows Server 2003, Datacenter Edition, plus the latest service pack

Windows Server 2003, Web Edition, plus the latest service pack



In addition to the operating system, the following operating system components must be installed:



Application Server with the following components:

ASP.NET

Internet Information Services (IIS) with the following components:

Common Files

Internet Information Services Manager

SMTP Service

World Wide Web Service with the following components:

Active Server Pages

World Wide Web Service



All servers in a server farm must run the same version and language of the operating system, and (where
applicable) the same version and language of

Microsoft SQL Server 2000, with the following exception-the configuration database can run Windows
2000 Datacenter Server or Windows Server 2003, Datacenter Edition, regardless of what other servers in
the farm are running. Setup does not verify this.



Software Coexistence Issues



The document library server component of Microsoft SharePoint Portal Server "v2.0" Beta 2 cannot run
on servers on which the following are installed:




                                                                                                       26
VAHS          CTMS SOP     11/5/2011             27 of 32



Microsoft Exchange Server (any version)

Microsoft Site Server (any version)

Microsoft Office Server Extensions

Microsoft Web Storage System (any version)

Microsoft SharePoint Portal Server 2001



Database Requirements



The configuration database can be installed on the following:



SQL Server 2000, plus the latest service pack

SQL Server 2000 Enterprise Edition, plus the latest service pack

SQL Server 2000 Desktop Engine (MSDE 2000)



The server on which the configuration database is installed must be running one of the following
operating systems:



Windows Server 2003, Standard Edition, plus the latest service pack

Windows Server 2003, Enterprise Edition, plus the latest service pack

Windows Server 2003, Datacenter Edition, plus the latest service pack

Windows Server 2003, Web Edition, plus the latest service pack

Windows 2000 Datacenter Server



Network Requirements



Multiple-server configurations are supported only on servers that are members of a Windows NT 4.0,
Windows 2000, or Windows Server 2003 domain.




                                                                                                     27
VAHS          CTMS SOP    11/5/2011              28 of 32



Client Requirements



Hardware Requirements



The following are recommended minimum hardware requirements for client computers:



Intel Pentium III-compatible 200 MHz processor

64 MB of RAM

50 MB hard disk space on Windows 98 and Windows NT 4.0, 30 MB disk space on



Windows 2000 and Windows XP

Note: The disk can be formatted as NTFS, FAT, or FAT32.



Software Requirements



Client computers must be running one of the following operating systems:



Windows 98

Windows NT 4, plus the latest service pack

Windows 2000 Professional, Server, or Advanced Server, plus the latest service pack

Windows XP Professional, plus the latest service pack

Note: Windows XP Home Edition is not supported.



Windows Server 2003, plus the latest service pack

Note: For Microsoft SharePoint Portal Server "v2.0" Beta 2, only Windows Server 2003 Release
Candidate 2 is supported.




                                                                                               28
VAHS           CTMS SOP     11/5/2011              29 of 32



Note: Computers that document library coordinators use must be running Windows 2000 Professional,
Server, or Advanced Server, Windows XP Professional, or Windows Server 2003. In addition to the
operating system, client computers must have the following installed:



Outlook Express 5.01 or later



Browser Requirements



Client computers must also have one of the following Web browsers installed:



Microsoft Internet Explorer 5.01 with Service Pack 2 and Q324929. Microsoft Visual Basic Scripting
support is required. This is included in the default installation of Internet Explorer 5.

Internet Explorer 5.5 with Service Pack 2 and Q324929. Microsoft Visual Basic Scripting support is
required.

Internet Explorer 6.0. Microsoft Visual Basic Scripting support is required.

Netscape Navigator 6.02 or later.




Windows SharePoint Services



Server hardware



Intel Pentium III-compatible processor

512 megabytes (MB) of RAM

550 MB of available hard disk drive space



Server software



One of the following operating systems:



                                                                                                     29
VAHS           CTMS SOP    11/5/2011             30 of 32



Windows Server 2003, Standard Edition

Windows Server 2003, Enterprise Edition

Windows Server 2003, Datacenter Edition

Windows Server 2003, Web Edition



A Web application server with the following components:

Microsoft ASP.NET

Internet Information Services (IIS) 6.0 with the following components:

Common files

Simple Mail Transfer Protocol (SMTP) service

World Wide Web service



Server databases



One of the following versions of Microsoft SQL(tm) Server:

SQL Server 2000, with the latest service pack

SQL Server 2000 Enterprise Edition, with the latest service pack

SQL Server 2000 Desktop Engine (MSDE 2000)

SQL Server 2000 Desktop Engine (Windows) (WMSDE)



Network



Multiple server configurations must be members of a Microsoft Windows NT(r) 4.0, Windows 2000, or
Windows Server 2003 domain.



Browser Client



One of the following browsers:



                                                                                                    30
VAHS          CTMS SOP     11/5/2011             31 of 32



Microsoft Internet Explorer 5.01 with Service Pack 2

Internet Explorer 5.5 with Service Pack 2

Internet Explorer 6

Netscape Navigator 6.2 or later




                                                            31
VAHS   CTMS SOP   11/5/2011   32 of 32




                                         32

				
DOCUMENT INFO
Shared By:
Categories:
Tags:
Stats:
views:9
posted:11/6/2011
language:English
pages:32