Background:
Clinical trials at the University of Kentucky, per contractual relationship and terms, may be monitored periodically by the sponsor or specified third party (“research monitor”).  The research monitor reviews study regulatory documents, source documents, and site study data to ensure the investigator is abiding by the study protocol requirements and adhering to good clinical practice (GCP) and regulatory requirements.  Source documents include, but are not limited to, original or certified copies of clinical patient charts, pharmacy dispensing records, and imaging.  At UK HealthCare (UKHC), patient clinical records are currently housed in electronic health records (EHR), specifically Epic.

Source documentation can be housed in electronic systems such as REDCap (if 21 CFR Part 11 Compliance is not required). 

Purpose:
This webpage outlines the UKHC institutional expectations for ensuring standardized procedures by which clinical research study teams request EHR and REDCap access for research monitors, expectations for communication, and review and audit processes related to this access.

EHR Oversight:
UKHC Office of Corporate Compliance Privacy Team may generate an audit report of the research monitor access in Epic upon request of the study team or as a matter of a routine audit.  If a research monitor is found to violate appropriate access of permitted patient records, the Privacy Team will take any further action necessary per audit findings, including but not limited to revocation of research monitor access.

Process:

• Epic Access Instructions 

  To request access for your monitor, reference the Request for Individual User Access Instructions instructions 

  To request an EpicCare Link Account, see Requesting an EpicCare Link Account for Study Monitors 

• OneDrive Instructions for Items not in Epic >>
  For additional reference, the list of documents converted into UKHC’s instance of Epic launched June 5, 2021.  If research monitor access is needed for items not in Epic, the study team may utilize the following methods to assist with remote monitor access to review applicable patient medical records or source documentation on a case-by-case basis via one of the following approved methods:
• Zoom meeting - either UKHC HIPAA compliant platform or UK campus platform
  • Must create unique meeting ID for each session
  • Must utilize unique password for each session
• Secure email - #Secure or #Encrypt MUST be typed at the beginning of the subject line
• Microsoft Teams - a private site must be created with guest access for the research monitor. At the time of creation of the site you should receive a prompt for private or public. Be sure to select private. 
• REDCap – For information regarding REDCAp >>> 
  • In order for research monitors to have view access to a study in REDCap, the following is required: 
    • The IRB approved Informed Consent Form/HIPAA Authorization must allow for research monitor review of the data.
  • If monitor is internal to UK they will need the following:  
    • To request A REDCap account select “Request a REDCap Account” on the website. 
    • The monitor will need to be given user rights to the study. The user rights should be limited to just the amount of information needed to monitor the study. (i.e. if PHI is not needed then PHI rights should not be granted). 
• If monitor is external to UK they will need the following: 
  • If they do not have a LinkBlue ID, they can sign up for one by clicking here. For access reason, please select CCTS membership. Their request will be processed within 4 working days. They will receive an email to activate their account at the email address provided in the request. Please check junk mail. Once activated, a CCTS membership request can be made.
  • If externally sponsored, the Clinical Trial Agreement (CTA) must allow the monitors access to the data.
  • If externally sponsored and if no CTA is in place, the research monitor must have a Business Associate Agreement (BAA) in place for the study. 
• To request a REDCap account:
  1. The research monitor must have a UK LinkBlue ID.
     See Research Study Team Handbook >>>
  2. Go to REDCap >>>
  3. Select “Request a REDCap Account” >>>
     
     Note:  The monitor will need to be given user rights to the study. The user rights should be limited to just the amount of information needed to monitor the study. (i.e., if protected health information (PHI) is not needed then PHI rights should not be granted). 
      
• Confidentiality Agreement for Non-industry Monitors »
  Industry sponsored studies cover confidentiality in the clinical trial agreement. However, studies that are not industry sponsored do not address this. Therefore, monitors of these studies must sign a confidentiality statement. Please have them sign this form and maintain a copy of the signed form with your regulatory documentation.

If you have any questions regarding monitoring access for Epic please put in a ServiceUKnow ticket.