European Medicines Agency Issues Updated Good Clinical Practice Q&A

On February 17, 2021 the European Medicines Agency (EMA) published an updated version of its good clinical practice questions and answers (GCP Q&A).  The updated section relates to access to patient medical records by GCP inspectors from European Economic Area (EEA) Member States.  It stresses the importance of sponsors conducting studies in countries outside the EEA obtaining the prior explicit consent of a clinical trial participant for the review of their medical records by EEA GCP inspectors.

GCP requires, inter alia, that sponsors of clinical trials carefully collect and report data in an ethical, accurate and complete manner.  When collecting and reporting such data, the sponsor should take into account ethical considerations and all applicable laws and regulations, including data protection legislation. The sponsor is furthermore required to verify and control the accuracy and completeness of the data collected by itself or its third-party vendors. GCP inspectors may wish to check that the sponsor has fulfilled this oversight role as well as confirm the accuracy of the information recorded in the clinical trial participants’ medical files. For outsourced activities, the sponsor must therefore ensure agreement from relevant third parties to ensure that regulatory authorities have direct access to all trial related sites, source data/documents, and reports for the purpose of an inspection.

According to the GCP Q&A:

• • Sites in the EEA – it is not strictly necessary to obtain the explicit consent of the clinical trial participant as GCP inspectors have legal authority to access the medical records and other personal data. From a data protection perspective, the sharing of this personal data with the GCP inspectors would therefore be made in reliance on a legal obligation to which the sponsor is subject (i.e., Article 6(1)(c) of the GDPR). Likewise, the GCP Q&A confirms that the inspectors would rely on the public interest legal ground under the GDPR (i.e., Article 6(1)(e)). However, sponsors would still be required to inform the clinical trial participant of this access, i.e., in the informed consent form (ICF), to meet their transparency obligations under the GDPR; and
  • Sites outside the EEA – sponsors must obtain the explicit consent of the clinical trial participant in the ICF. The consent obtained must grant GCP inspectors access to the medical records and other personal data of the clinical trial participant. Further, should sponsors choose to include more generic wording in the ICF such as, “regulatory authorities from foreign countries”, then they must confirm in advance with the principal investigator for the clinical trial that such wording would not prevent GCP inspectors from accessing the data – including, from a data protection perspective.

Sponsors who cannot provide full access to patients’ medical records during GCP inspections could be found in non-compliance with GCP requirements. Sponsors are therefore advised to consider necessary amendments to their ICF template to include prior notification to clinical trial participants about GCP inspectors’ potential access to their medical files.

This post is as of the posting date stated above. Sidley Austin LLP assumes no duty to update this post or post about any subsequent developments having a bearing on this post.