Disasters include large natural disasters, such as hurricanes or earthquakes, storms that create power outages, fires, and flooding. If disaster were to strike, what would that mean for the clinical trial being conducted? Would trial datasets and patient details be destroyed? Would you have to recreate forms? Could you collect trial data in a different location or via a different method? It’s essential your organization has a plan in place and all staff are aware and fully understand their responsibilities should catastrophe strike.
September is National Preparedness Month, making this a great time to evaluate and test your disaster recovery plan. One component of your plan should include the technology you use to collect data for your clinical trials.
When reviewing or creating your plan, you and your team should answer these three questions.
What is your contingency plan to continue the study in the event of a closure of site or a failure of the computerized system collecting trial data?
As a sponsor, you need to ensure a disaster plan is in place for all sites conducting the trial and that site staff are trained on their responsibilities during a disaster. Each site should create a plan that outlines steps to follow if there is an office evacuation. The plan should include instructions for:
- Emergency response roles
- Job action plans (including if work needs to be done remotely or from another location)
- Communication plan and resources
- Security/Safety issues (including cyber security and data backup)
- Evacuation plan
- Re-entry into the site
- Post-disaster recovery operations
Check out the sample disaster plan on Ready.gov to help you start creating or revising a disaster plan.
It’s also important you devise a plan for smaller events that cause loss of power and access to computer systems. How will you collect and input trial data if your systems are down for a period of time? Outlining staff procedures can help keep your trial moving smoothly, even in times of upheaval. Communicate in advance the site’s responsibilities for entering data should the EDC system go down. This could take place during a site initiation visit or during case report form training.
Is there an SOP for backup and recovery procedures to protect against data loss? How is staff trained on these procedures?
During a disaster, all your trial data could be wiped out instantly, causing you to lose months of hard work and dollars invested. What are your procedures for when a system is down? Develop a plan that outlines content backup, the backup process, the types of backup to use and your data recovery process. It’s essential that you consider an offsite location to back up data stored on local computers, as hard drives can be destroyed.
If using an EDC system, what is the vendor’s disaster recovery plan?
Vendors have a responsibility to plan for disaster recovery as well as evaluate and resolve potential risks. Don’t be afraid to ask for details about your vendor’s plan, especially if it’s a hosted system. The vendor should have established processes that prevent data loss and outline back-up protocols. If your EDC system is a hosted solution, ensure that its data center is SSAE-16 compliant. Statement on Standards for Attestation Engagements (SSAE) No. 16 is the standard that auditors use to assess and report on the internal controls relevant to the security, availability and processing integrity of a system, and the confidentiality and privacy of the information processed by the service organizations. A disaster is not the right time to find out whether or not your vendor has built a plan to ensure data is safe.
The consequences of lost data due to a disaster can significantly impact your clinical trial, possibly causing a total loss. An EDC system plays an important role in ensuring your trial data is safe during a disaster. Using a hosted system also allows for the trial to continue in the event of a total loss to a site.