Introduction
Fit for purpose long-term archiving
When using computerised systems for clinical data, it’s a regulatory requirement that they are ‘fit for purpose’.
The regulations and guidelines apply to the whole data lifecycle. This includes during the retention period, which can be 25 years or longer under EU CTR 536/2014. During that time, Data Integrity needs to be maintained, systems need to be demonstrably fit for purpose and a risk-based approach needs to be taken. ICH E6 (R3) covers many of these points when it states:
“Computerised systems used in clinical trials should be fit for purpose (e.g., through risk-based validation, if appropriate), and factors critical to their quality should be addressed in their design or adaptation for clinical trial purposes to ensure the integrity of relevant trial data.”
“Formats become obsolete, systems fail, migrations are incomplete, suppliers change, data can’t be located, staff move on, backups fail, cyber-attacks happen.”
What does ‘fit for purpose’ mean for long-term archiving?
25 years is a long time when trying to maintain Data Integrity, for example as defined by the ALCOA+ principles. The risks to Data Integrity over this timescale are manifold. Consider all the ways in which Data Integrity could be lost, for example data becoming illegible, inaccessible, incomplete or evidence being lost that proves it was original, contemporaneous and accurate all those years ago. Formats become obsolete, systems fail, migrations are incomplete, suppliers change, data can’t be located, staff move on, backups fail, cyber-attacks happen. This is the reality of keeping data for 25 years.
Specialist techniques and systems will often be required to effectively mitigate and manage these risks, for example by applying digital preservation techniques and good practice. Such systems need to be designed from the outset to apply digital preservation and information security in a way that meets the regulations and guidelines. A typical process is shown below.
“What you shouldn’t be doing is retro-fitting requirements to existing systems that haven’t been designed with archiving and preservation in mind.”
You assess the long-term risks to data and systems, including the need to maintain data integrity and tightly control access. These needs along with the wider set of regulatory requirements and guidelines for GxP then specify what’s needed from a solution, which is typically expressed in a User Requirements Specification (URS). Rarely will these requirements be met from existing systems, with the resultant hunt for a solution, for example by going through a vendor selection process using an RFP. This in turn leads to assessment and qualification of suppliers and from there to Computerised Systems Validation (CSV) of the systems they provide.
Validation is a critical step of checking that solutions work in your environment for your business processes. When the solution is in place and in production, monitoring and oversight is then used to check that both the supplier and the system is functioning as expected and the risks identified at the start of the process are being reduced and managed. This ‘closes the loop’ and ensures that the chosen solution is demonstrably fit for purpose, that it reduces the risks as intended, and it remains in a controlled and validated state.
The process is risk-based and systems are selected based on well-defined requirements that specify that they must be fit for their intended purpose, which means long-term retention, archiving, digital preservation and access. What you shouldn’t be doing is retro-fitting requirements to existing systems that haven’t been designed with archiving and preservation in mind. What you need from a system that is fit for purpose when a study is ‘live’ is very different from what you need from a system that is fit for purpose for the following 25 years after a study is closed and needs to be archived.
There’s much more detail in the recently released Arkivum report on “Long Term Digital Preservation of GxP Data”.
“Validation is a critical step of checking that solutions work in your environment for your business processes.”
Arkivum Website | Contact Us | Privacy Policy
Arkivum Limited is registered in England and Wales, company number 7530353 Registered Office: Arkivum, 85 Great Portland Street, First Floor, London W1W 7LT. United Kingdom.