Use Secure Locations for SDV

• Conduct SDV in private areas of the site (not patient-care zones)
• Ensure no unauthorized individuals can observe or overhear data

3. Avoid Recording PHI in Monitoring Reports

• Never copy full patient names, initials, or identifiers into visit reports
• Use anonymized subject IDs (e.g., Subject 102-001) in documentation
• Summarize findings without transcribing confidential content

4. Handle Electronic Records with Security

• Do not take photos or screenshots of electronic health records (EHRs)
• Use read-only systems when possible for EDC and CTMS access
• Enable automatic session timeouts and audit trails in electronic systems

5. Implement Redaction Protocols

• Sites should redact non-essential identifiers from printed source docs
• CRAs should report any unredacted data without recording it elsewhere
• Include redaction steps in your SOP for SDV

Handling Source Documents Respectfully

SDV involves reviewing case notes, lab reports, and diagnostic tests. CRAs must:

• View only the documents specified in the monitoring plan
• Return documents promptly after review
• Not remove or scan any patient-related documents from the site

CRA Training on Confidentiality

All CRAs must receive documented training on:

• GCP confidentiality standards
• Site-specific privacy policies
• HIPAA and GDPR requirements (where applicable)

This training should be documented in the CRA’s qualification file and updated periodically, especially when SOPs are revised or data protection laws are updated.

Subject Consent and Privacy Rights

As per ICH-GCP, informed consent documents must clearly state:

• That authorized monitors may access subject data
• That such access will maintain strict confidentiality
• That data will be de-identified in any public reports

Documenting Privacy Measures in the MVR

• “SDV was performed in a private room with access restricted to authorized CRA and site coordinator.”
• “No PHI was recorded in the MVR or removed from the site.”
• “Patient IDs were anonymized in CRF and SDV logs.”

Tools to Support Privacy Compliance

• Site-controlled EHR access terminals
• Secure CTMS with audit logs for SDV tracking
• SDV checklists that exclude PHI fields

Resources such as Stability Studies often provide guidance on managing documentation without breaching subject privacy.

Common Privacy Violations to Avoid

• Writing full names or MRNs in MVRs
• Sending patient data over unsecured email or personal devices
• Leaving source docs unattended at the site
• Using personal storage (e.g., USB drives) to retain trial data

Regulatory Audits and Privacy

Agencies including Health Canada often review how SDV was conducted. Lack of privacy safeguards can result in major audit findings and delays in trial approval or data acceptance.

Conclusion

Ensuring confidentiality during SDV is not just good practice—it’s a legal and ethical necessity. CRAs, sponsors, and site staff must work together to embed privacy protection into SDV workflows, tools, and documentation. Adhering to GCP and regulatory guidance helps maintain participant trust, ensures audit readiness, and upholds the credibility of your clinical trial.