Remote monitoring has proven to be a useful and cost-effective tool during the COVID-19 pandemic and it will likely continue to be used by Sponsors and CROs for monitoring clinical studies. However, it is not always easy to obtain remote access to a clinical site’s electronic health records. Hospitals are subject to various state and federal privacy laws, such as the Health Insurance Portability and Accountability Act of 1996 (HIPAA) as amended by the Health Information Technology for Economic and Clinical Health (HITECH) Act, which impose privacy and security obligations on health information.

Access to clinical site electronic health records

Clinical Trial Agreements, which set out the relationship between the Sponsor and the clinical trial site, address a Sponsor’s ability to monitor and audit the study site, but typically do not include language specifically authorizing remote monitoring by the Sponsor or the CRO. In fact, remote monitoring is often an afterthought, and Sponsors are then expected to enter into separate agreements in order to access a clinical site’s electronic health records remotely (“Remote Access Agreements”).

The issue Sponsors often face is that these Remote Access Agreements were created for hospital employees or external health care providers who access information primarily for treatment and care purposes. Thus, the agreements often contain provisions that are not applicable to, or appropriate for, the clinical trial/research space. For example, often the Remote Access Agreements allow access to patient information solely for treatment purposes and may not allow, or worse may expressly prohibit, access in connection with research activities.

Sponsors will want to carefully review Remote Access Agreements prior to signing, and may wish to work with the site, where possible, to address any concerns. For example, Sponsors will want to ensure that the Remote Access Agreement expressly allows for access to the records and information for purposes of remote monitoring and source document verification. In addition, Remote Access Agreements are typically written broadly enough that they could apply to information that Sponsors obtain through the course of the study (as opposed to merely information accessed during remote monitoring).

This broad applicability (which is likely unintentional) is problematic when coupled with limitations in these agreements on the use and disclosure of patient information that is inconsistent with Sponsors’ use of study data for research activities and Sponsors' obligations (e.g., reporting adverse events to the FDA). Finally, Remote Access Agreements also may incorrectly imply that Sponsor is subject to HIPAA; may broadly terminate a Sponsor’s access to the site’s electronic health records (remotely and in-person); may impose potentially onerous requirements on Sponsor including to have detailed policies and procedures, conduct specific training, including on HIPAA, investigate and report security incidents involving the site’s systems, and notify the site about any inaccuracies in the patient records/information; and provide broad indemnification. Thus, these Remote Access Agreements require careful review.

Proposed language for U.S. Clinical Trial Agreements

In addition to carefully reviewing the terms of the Remote Access Agreements, we encourage Sponsors to directly address remote monitoring in the Clinical Trial Agreement or in the informed consent form/HIPAA Authorization executed by the study subjects. In the Clinical Trial Agreement this could be done by simply adding a reference to remote monitoring:

“In addition to the audit and monitoring rights set forth herein, Institution grants Sponsor and its designees the right to perform remote monitoring and to have access to electronic health records for that purpose.”

Or the language could be incorporated into more standard audit language:

“During the term of this Agreement and for two (2) years thereafter, Sponsor and its designees shall have the right upon reasonable advance notice, and at mutually agreed upon dates and times during regular business hours, to: (i) examine the facilities used in the performance of the Study; (ii) monitor the conduct of the Study both in-person and remotely (including allowing Sponsor and its designees access to electronic health records for that purpose); and (iii) review, copy, and audit all Study Data, Study Documentation, and Hospital Source Records related to the Study.”

Similarly, language could be added to the informed consent form and HIPAA authorization specifically allowing Sponsor and its designees remote access to the Study subjects’ electronic health records.

Usually, the inclusion of any remote monitoring language in the Clinical Trial Agreement will cause the Site to include limitations that remote monitoring is subject to Institution policy which often includes some form of Remote Access Agreement. While it would be convenient to negotiate these agreements in parallel, in reality, the Sponsor’s goal is to get the Clinical Trial Agreement in place and the study started and often Remote Access Agreements are not considered until after the Clinical Trial Agreement is executed and the study is underway.

It is unlikely that U.S. clinical trial sites will agree to allow the provisions of the Clinical Trial Agreement or HIPAA authorization to supersede Institution policies with respect to remote access to its electronic health records or the need for a Remote Access Agreement, so Sponsors should carefully review Site policies and any Remote Access Agreement required by the Site to ensure that they do not limit or supersede Sponsor’s monitoring and audit rights in the Clinical Trial Agreement.

Authored by Elizabeth McGuire and Melissa Levine.