eSource, EHR-to-EDC Transfer and Certified Copies in 2026

TL;DR

Define the source record and its location before selecting an integration or reducing manual checking. FDA's FY2025 observation data contain 52 citations under the case-history requirement, while the FY2024 trends decks report Form 483 issuance in about 23% of investigator and 25% of sponsor inspections. These counts describe inspection activity; a study's monitoring plan still needs its own risk assessment [1] [2] [3].

Three decisions follow: preserve the meaning and provenance of transferred data; retain fit-for-purpose copies and investigator access; and focus verification on critical data and processes. ICH E6(R3), EMA's computerised-systems guideline, FDA's electronic-record guidance and China's revised GCP provide the crosswalk. China's 2026 text took effect September 1 and replaced the 2020 version [4] [5] [6] [7].

Sheetz's observational analysis found a median 1.1% of eCRF data corrected through SDV. It neither compared universal 100% checking with a particular reduced plan nor measured critical-data errors separately. The implementation examples below therefore require protocol-specific justification [8].

What FDA Bioresearch Monitoring Source-Record Citations Actually Show (FY2006–FY2025)

When regulatory authorities conduct Good Clinical Practice (GCP) inspections of clinical trial sites and sponsor facilities, documentation integrity is examined at the point of origin. Across 20 fiscal years of official US FDA Bioresearch Monitoring (BIMO) inspection observations from FY2006 through FY2025—comprising 2,264 citation summary rows and 11,746 total citations across all evaluated programs—case history and source documentation deficiencies represent one of the most persistent frequently cited observation areas [1].

Identify the provisions in each frequency grouping

The FDA observation export contains summary rows keyed to regulatory citations. Its FY2006–FY2025 extraction sums to 11,746 frequencies. Matching the exact citation 312.62(b), which concerns adequate and accurate case histories, yields 1,514 frequencies overall and 271 in FY2020–FY2025. Counts use the source’s frequency field, not a tally of unique inspections or trials [1].

The chart displays the exact 312.62(b) annual frequency divided by all BIMO frequencies in the same year. A changed share can reflect a changed entity or citation mix; inspection volume and composition require separate evidence [1].

For a sponsor, the decision value is modest but useful: case-history documentation merits attention in the quality plan. The count alone has no information about an EHR connector, a source-copy process or the effectiveness of a particular monitoring approach. Those questions require the guidance and study-level evidence discussed later.

Ten-Year Longitudinal Trajectory of Case-History Citations (FY2016–FY2025)

Evaluating the year-by-year trajectory of the exact 312.62(b) series alongside investigator protocol provisions (312.60/812.100/812.110) and sponsor oversight provisions (312.50–312.56/812.40–812.46) describes recorded inspection-citation activity over the decade [1]:

Between FY2016 and FY2019, annual citations for failure to prepare or maintain adequate and accurate case histories under 312.62(b) consistently ranged between 60 and 76 citations per year (70 in FY2016, 76 in FY2017, 69 in FY2018, and 60 in FY2019) [1]. During FY2020, the exact section’s recorded frequency was 30 (13.57% of 221 total BIMO citations that year) [1].

Annual 312.62(b) frequencies recovered to 48 in FY2021 (19.28% of 249 citations), 36 in FY2022 (12.08% of 298), 49 in FY2023 (16.28% of 301), 56 in FY2024 (17.95% of 312), and 52 in FY2025 (15.57% of 334) [1]. While the FY2025 figure of 52 citations represents a numerical increase over the FY2020 trough of 30 citations, it remains below the pre-pandemic baseline observed between FY2016 and FY2019. Across FY2016–FY2025 the annual shares lie between about 12% and 20% [1].

FDA's observation datasets cover citations in its electronic databases and exclude manually prepared forms [1]. FDA describes the spreadsheets as an incomplete observation listing, distinct from final compliance determinations [9]. The frequencies describe recorded inspection observations within that coverage.

FDA sponsor and investigator inspection trends

Beyond raw citation frequencies in the observation spreadsheets, the FDA's annual BIMO inspection metrics reports and 483 observation trends presentations provide critical context regarding how often inspections result in formal citations and which specific operational issues appear in Form 483 observations [10] [2] [3] [11].

Inspection Metrics and Form 483 Issuance Rates Across Operating Entities

FDA’s FY2024 metrics and annual observation decks describe different inspected and completed-inspection populations. The figures below retain those denominators [10] [2] [3]:

1. Clinical Investigators: In FY2024, the FDA conducted 692 inspections of clinical investigators (compared to 693 in FY2023) [2] [12]. Of these, 156 inspections resulted in the issuance of a Form FDA 483, representing an issuance rate of 22.54% (reported as 23% in the FDA trends presentation), compared to 142 inspections (20.49%, reported as 20%) in FY2023 [12]. In the final compliance classification of completed investigator inspections in FY2024 (n = 609), 484 were classified as No Action Indicated (NAI, 79.5%), 110 as Voluntary Action Indicated (VAI, 18.1%), and 15 as Official Action Indicated (OAI, 2.5%) [10] (slide 8). The leading clinical investigator observation theme in FY2024 remained protocol compliance under 21 CFR 312.60, followed immediately by inadequate or inaccurate case histories under 21 CFR 312.62(b) and 812.140(a)(3) [2].
2. Sponsors, Contract Research Organizations (CROs), and Monitors: In FY2024, the FDA inspected 125 sponsors, CROs, and monitors (compared to 122 in FY2023), issuing Form FDA 483s in 31 inspections, or 24.80% (reported as 25%), compared to 26 inspections (21.31%, reported as 21%) in FY2023 [3] [11]. Among completed sponsor/CRO inspections in FY2024 (n = 99), 83 were classified as NAI (83.8%), 15 as VAI (15.2%), and 1 as OAI (1.0%) [10] (slide 14). The primary observation themes centered on sponsor oversight and monitoring under 21 CFR 312.50, 312.56, and 812.40 [3]. Notably, within the General Sponsor Responsibilities category (21 CFR 312.50), the FDA's FY2024 trends deck lists "Inadequate validation of electronic systems used to maintain source records" as one of six specific sub-themes, tied with failure to secure compliance as the smallest sub-theme bar; inadequate monitoring is the largest [3].
3. Institutional Review Boards: In FY2024, the FDA inspected 96 IRBs (compared to 72 in FY2023), issuing Form FDA 483s in 17 inspections, or 17.71% (reported as 18%), compared to 15 inspections (20.83%, reported as 21%) in FY2023 [13]. Among completed IRB and RDRC evaluations (n=86), 78 were NAI (90.7%), 6 VAI (7.0%), and 2 OAI (2.3%) [10]. FY2023 observations are sourced to that year’s IRB deck; the final-classification figures use the FY2024 metrics report’s slide 11 [14] [10].
4. GLP nonclinical laboratories: FDA’s FY2024 deck reports 17 Form483s among 37 inspections (45.95%). Its FY2023 deck reports 10 among 28 (35.71%). These are separate annual inspected populations [15] [16].

What the observation sources can establish

The FDA's FY2024 sponsor trends deck lists inadequate validation of electronic systems used to maintain source records among the General Sponsor Responsibilities sub-themes. The investigator deck lists inadequate or inaccurate case histories among its observation themes. These are the agency's published descriptions, and they support reviewing source-record and system-validation processes [2] [3].

The numerical observation export provides frequencies and short descriptions. Individual correction decisions require the trial record, system documentation and the actual observation narrative. Warning letters are not used for a cohort analysis here because the frequency export carries no letter narrative.

A practical review can instead ask how the trial's own source is defined, how changes are explained and how the investigator can access retained records. Those questions come from the regulatory crosswalk below. The frequency data supply context, while protocol records, system documentation and actual findings supply the evidence for a study-specific correction.

Four-Regime Regulatory Crosswalk: ICH E6(R3), EMA, FDA, and China GCP (2026 Revision)

The comparison below separates ICH recommendations, EMA and FDA guidance, and China’s current GCP provisions. Their status and jurisdictional applicability differ; the source-specific wording controls the actual obligation or recommendation.

Synthesis of Binding Clauses and Regulatory Guidelines

The crosswalk summarizes expectations. ICH and the cited FDA/EMA guidance use recommendations; applicable laws and national implementation need their own assessment. The China column uses the current 2026 text. Its English phrasing is an explanatory translation.

Key Divergences Across Regulatory Jurisdictions

While the frameworks align on broad principles—such as ALCOA standards, interface validation, and role-based access control—practitioners must manage three critical operational divergences between US, European, and Chinese expectations:

1. Destruction of Original Paper Records Following Certified Copy Creation:
   • FDA Q3 permits disposal after creation of a certified copy, with other applicable requirements considered separately [6]. The copying process and resulting record still need to meet the certified-copy definition.
   • EMA 6.4 recommends certification for a copy that irreversibly replaces a source document; 6.5 calls for special consideration when copies replace originals. Annex 6 A6.9/A6.10 refers to national requirements and cautions against premature destruction. China GCP 29(2) concerns relevant medical records in trials involving patients; 29(3) sets minimum essential-record retention periods. Other applicable retention rules require separate assessment [5] [7].
2. Static vs. Dynamic Formats for Archiving and Audit Trails:
   • EMA addresses whether the copied record preserves necessary information and functionality. In Section 6.5 and Section 6.12, EMA describes static formats of dynamic data as inadequate certified copies [5]. If an original record is dynamic—such as an interactive electronic worksheet with revision history, a continuous Holter ECG waveform (an editorial example), or an EDC audit trail—EMA expects a dynamic electronic format capable of filtering and inspection [5].
   • In contrast, the US FDA adopts a more accommodating approach in Question 12 of its October 2024 Guidance: FDA recommends a searchable, sortable audit trail and discusses a static copy when retaining a searchable electronic format is impractical [6].
3. Medical Record Integration for Direct Data Capture (DDC):
   • When clinical trial data are captured directly into a sponsor-provided EDC or eCOA tablet at the bedside (DDC), EMA 6.1.3 calls for a documented procedure to transfer/transcribe treatment-related information to the participant's medical record, supporting continuity of care [5]. China's 2026 GCP reinforces this principle in Article 29(2) by requiring relevant medical records in patient trials to be entered in the outpatient or inpatient record system [7]. For a multi-regional protocol, include this medical-record procedure in the source plan alongside the applicable local requirements.

Technical Architecture for Clinical Data Acquisition: Direct Capture, EHR Transfer, and Certified Copies

To establish compliant data acquisition workflows, clinical data management and operations teams must select the appropriate capture architecture for each protocol data element. Designing an effective architecture requires understanding the structural diversity of clinical trial execution sites.

Site dispersion is context, not an integration outcome

The retained AACT snapshot includes 596,685 registered studies: 393,714 list one facility; 142,928 list multiple facilities, including 30,974 with 21 or more; 60,043 have none listed. These are registered-study facility counts, covering heterogeneous study types and incomplete records [20].

The site list helps identify where a trial may need local source-location decisions. It gives no EHR vendor count, connector success rate, share of structured fields or academic/commercial designation. An integration plan therefore needs a site assessment rather than a registry-derived architecture rule. The following three patterns are editorial ways to organize that assessment, and may coexist within a study.

Data Acquisition Pattern 1: Interoperable EHR-to-EDC Data Transfer

Structured clinical data may be candidates for transfer using HL7 FHIR R4. The FHIR-to-CDISC mapping guide supplies descriptive mappings, whose fit to actual source interfaces and study requirements still needs verification [18] [21] [22].

• Target Clinical Data Scope: Routine clinical laboratory panels (serum chemistry, hematology mapped to LOINC), baseline vital signs (blood pressure, heart rate, temperature), concomitant medication records (mapped to RxNorm or WHODrug), and pre-existing medical conditions (mapped to ICD-10 or SNOMED CT) [18] [21] [22].
• Regulatory expectations (summary): Under FDA EHR Guidance (2018) and October 2024 Electronic Systems Q&A (Q1, Q7–Q9), FDA distinguishes healthcare-provider EHRs from the clinical-investigation systems it assesses under Part 11 [6] [18]. However, software interfaces, middleware, and extraction scripts used to pull data from the EHR into the trial EDC system are assessed for appropriate risk-based validation under 21 CFR 11.10(a) and 312.50 [6] [18] [23] [24]. Similarly, EMA Guideline Section 6.1.2 and Annex 2 recommend documented interface validation, verification of mapping transformations, and pre-specification of extraction parameters [5].
• Editorial Implementation Suggestions:
  • Authorization-policy example: In a study using eConsent, an implemented retrieval policy might use the verified consent state and timestamp as inputs alongside the requested scope, role and purpose. SMART scopes delegate permissions within the underlying authorization policy; they are not the complete consent policy. Historical observation dates and present authority to retrieve those records are separate questions. Test both permitted and denied retrievals before relying on the configured control [25].
  • Data Originator Flagging: The receiving EDC system should automatically flag imported fields with metadata identifying the EHR system, FHIR Resource ID, and extraction timestamp (e.g., Originator: Epic_FHIR_Observation_49201 | Imported: 2026-11-09T08:30:00Z), supporting FDA Q20 data-originator recommendations [6].
  • Investigator Verification Queue: Imported EHR data points should enter an unconfirmed review queue within the EDC, with the investigator/delegate review and completion procedure specified by the study; this queue design is an editorial option [6].

Data Acquisition Pattern 2: Direct Data Capture (DDC) in Data Acquisition Tools

Protocol-specific assessments can instead be captured directly in a data acquisition tool when that method and source location are defined for the study [6] [4] [5].

• Target Clinical Data Scope: Formal protocol efficacy rating scales (e.g., RECIST tumor measurements, UPDRS scores, PASI evaluations), pharmacokinetic and pharmacodynamic (PK/PD) timed blood-draw chains, investigational product kit dispensing and accountability records, and electronic Clinical Outcome Assessments (eCOA) or patient diaries [4] [5].
• Regulatory expectations (summary): The E6(R3) Glossary “Source Records” and 4.2.1(b), alongside FDA’s 2013 eSource guidance, support directly captured data as source records; 3.16.1(d),(i),(k),(l),(m) address related data-acquisition and investigator-access controls [4] [19]. EMA Guideline Section 6.1.3 recognizes DDC, provided entries are contemporaneous and that treatment-related information is transcribed into the patient's medical record [5]. Investigator control and independent access follow the arrangement described in crosswalk row 2 [4] [5]. China’s Article 48(2) separately restricts sponsor alterations to investigator-, staff- or participant-entered data, as described in the crosswalk [7].
• Editorial Implementation Suggestions:
  • Contemporaneous Point-of-Care Entry: Site staff should perform DDC entries in the clinic room during the visit. If entry occurs days later, system audit trail timestamps will reveal the lag, exposing the site to inspector inquiries regarding unrecorded intermediate paper notes.
  • Predefined Source Location Listing: A site-specific source-location list is one editorial way to document sources and capture methods before the trial, consistent with the expectation under ICH E6(R3) Section 2.12.2 and EMA Section 6.1 [4] [5].
  • Independent site archiving: Test the copy, investigator-review and access-revocation arrangement in crosswalk row 2. Document the responsible person and the retained version [4] [5].

Data Acquisition Pattern 3: External Unstructured Documents and Certified Copies

External medical documentation originates outside the trial site's immediate systems [6] [5].

• Target Clinical Data Scope: External hospital admission and discharge summaries, emergency department consultation notes, outside pathology reports, paper autopsy reports, and paper referral letters [6] [5].
• Regulatory Expectations: Decide which external records are needed, how they are obtained and how their meaning and provenance are preserved. FDA Q4 specifically stops short of recommending certification of outside-provider records. The certified-copy decision requires attention to the actual record and use [6] [4] [5].

Certified Copy Engineering: Static vs. Dynamic Electronic Records

When paper documents are scanned or electronic records are copied for trial use, the review needs to preserve the information and functionality necessary for the record's intended use [6] [5] [4]. The six-step table below is an editorial process design that clearly separates regulatory expectations from operational engineering choices.

Six-Step Certified Copy Engineering Protocol

How Much SDV to Keep: Empirical Evidence and an Editorial Risk-Based Verification Matrix

SDV checks transcribed values against source records. A quality plan also needs review for missing information, protocol deviations and participant protection. The distinction matters when reducing a repetitive transcription check: the responsible team still needs to know which risk that check addressed and which other control covers it [26] [4] [27].

What Sheetz's observational correction data show

Sheetz and colleagues analyzed 1,168 completed phase I–IV biopharmaceutical studies from 53 sponsors on the Medidata platform. Inclusion required at least 30% of data to have undergone SDV. Table 5 reports a median 1.1% of total eCRF data corrected through SDV; phase-group medians were 0.9%, 1.5%, 1.4% and 1.2% for phases I–IV [8].

The study could not separate SDV from source-data review in the contributing processes or distinguish critical from noncritical corrections. It was observational, with no randomized comparison of 100% SDV against the exact reduced matrix proposed below. The result is useful for questioning the yield of repetitive checking, while leaving the protocol-specific safety and reliability decision open. It supplies neither a universal acceptable error rate nor proof that a copied data stream should receive zero oversight [8].

Risk-based monitoring also considers central statistical signals, site processes and emerging problems. Agrafiotis and colleagues describe an integrative approach, while the regulatory quality frameworks direct attention to important data and processes. Neither the paper nor the guidance fixes one numerical sampling percentage for every trial [28] [27] [26].

A proposed verification decision matrix

ICH E6(R3) 4.2.1(a) links the extent of verification of transcribed data to criticality. The following matrix is an editorial planning aid. A monitoring plan should justify its choices using the protocol's risks, source arrangement and observed performance, then define how changes are reviewed [4].

A monitoring team can document why a particular check is being reduced, what evidence supports that decision and what signal would reopen it. For example, a mapped laboratory unit change might require interface review even if the stored number remains in a plausible range. That is a constructed process example, not a measured frequency or prescribed KRI. The incident's significance depends on the variable, timing and analytical use.

The matrix also preserves an operational distinction between verifying an available value and reviewing whether the source tells a complete clinical story. A perfectly copied laboratory result can coexist with a missing adverse event. Assessments of completeness, consent timing and protocol adherence therefore need records and expertise appropriate to those questions. Field-level transcription yield alone is a narrow measure of a broader quality process.

EClinCloud's published scope and the deployment evidence to request

EClinCloud's public product material describes native connectivity among EDC, RTSM, eCOA and CTMS, API integration, an ALCOA+ design, access control, validated database changes and OCR-assisted source capture. These are product descriptions, with detailed compliance documentation available during evaluation. They should be checked against the proposed study configuration and interfaces [29] [30].

The public Trust page lists the frameworks and standards addressed by the company's compliance material. A reference to Part 11, GCP or an information-security standard has a particular scope and evidentiary basis; a buyer should request the applicable documentation and current status rather than inferring that every protocol deployment is independently certified [31].

For this report's source-governance questions, ask for evidence about the exact source arrangement, validation scope, permissions, relevant metadata, copying/export behavior and retention access. Capabilities beyond the published pages should be confirmed in writing during evaluation.

Sponsor, investigator, institution and service-provider responsibilities should be allocated and documented for the deployment. China's 2026 Article 51 explicitly assigns data-governance responsibilities within the parties' respective duties. E6(R3), EMA's guideline and FDA requirements likewise require the applicable responsibilities to remain clear when services are delegated. A platform purchase is one part of that arrangement [7] [4] [5] [24].

Teams can contact EClinCloud to discuss their proposed capture and integration workflows and request the supporting documentation. The study's acceptance decision should record what was evaluated, by whom and for which intended use.

Before changing a live source arrangement

A source-design change has consequences beyond the data-management build. Identify the records and participants affected, the old and new source locations, when the change becomes effective and how reviewers will interpret records spanning both arrangements. The team should decide whether procedures, training, consent/privacy information or validation evidence need updating under the applicable framework. This is a proposed change-review approach, rather than a fixed regulatory checklist [4] [5].

For an EHR transfer, the reviewer needs to understand which encounter and observation version is extracted, how corrected results are handled and where transformations occur. A mapping that looks correct in a standard can produce a different result against a site's actual interface. HL7's mapping caveats explicitly acknowledge variation in source content and study requirements; validation evidence should reflect those differences [21] [22].

For direct capture, test the export, investigator-review and access-revocation workflow described in crosswalk row 2. The implementation record can identify the retained snapshot, the investigator’s review acknowledgement and the actual access change. Retention planning should identify the responsible parties, required period and retrieval arrangements while the relevant systems remain available [5] [7].

For a copying change, test whether the copy retains the information needed for its intended review. File existence and page count alone are incomplete evidence where a record carries relevant metadata or interactive functionality. Document verification, unresolved exceptions and any continuing need for the original format. FDA Q3/Q12 and EMA's copying and decommissioning provisions address related but distinct questions; apply each to the actual record rather than applying one format slogan to every object [6] [5].

Methodology and limits

The FDA citation extraction uses annual observation spreadsheets for FY2006–FY2025. Frequencies are summed by CFR citation and fiscal year. The case-history series uses exact 312.62(b); the other two series retain their disclosed 312.60/812.100/812.110 and 312.50–312.56/812.40–812.46 groupings. These electronically recorded observations omit manually prepared forms and have FDA’s stated completeness limits. The Form483 FAQ explains that observations are not a final Agency determination; citation frequencies also differ from unique affected studies [9] [1].

Form 483 issuance denominators come from FDA's corresponding trends decks. Final NAI/VAI/OAI classifications come from the annual metrics report, whose completed-inspection population differs. The article keeps those units separate. The AACT facility series describes registered studies in the retained snapshot; it measures neither the number of EHR vendors nor integration outcomes [10] [2] [3] [13] [15] [20].

The crosswalk uses the actual ICH, EMA, FDA and China documents. A numbered locator points to the relevant provision, while the text is an explanatory summary. Guidance recommendations and editorial process designs remain distinguishable from regulations. China's current account uses Announcement 2026 No.50 and its complete revised attachment, effective September 1, 2026 [6] [4] [5] [7].

The Sheetz evidence is observational and has the restrictions stated in the evidence section. The proposed matrix provides no clinical effect estimate, claimed budget saving or universal safe checking rate. Vendor descriptions are bounded to the published material; a deployment needs its own supporting evidence and accountable acceptance [8] [29] [30].

Conclusion

A coherent source plan connects the clinical event to its record, the record to its transformations and copies, and those records to the people who need to review and retain them. Select the capture pattern for the actual variable and site, document the source before use, and preserve meaning and relevant metadata across changes.

Monitoring reductions then become explicit decisions about risk and evidence. Use the protocol's critical data and processes, verified system behavior and emerging performance to justify the checking plan. Keep the limits of observational correction yields visible. The result should be a traceable source and monitoring rationale that the responsible study team can assess and maintain.

Sources

1. U.S. Food and Drug Administration. Inspection Observations: Bioresearch Monitoring (BIMO) Form FDA 483 Dataset (FY2006–FY2025) (accessed August 2026).

2. U.S. Food and Drug Administration. FY 2024 Clinical Investigator FDA 483 Observation Trends (2025).

3. U.S. Food and Drug Administration. FY 2024 Sponsor/CRO/Monitor FDA 483 Observation Trends (2025).

4. International Council for Harmonisation. ICH Harmonised Guideline: Good Clinical Practice ICH E6(R3) Step 4 Final Guideline (Step 4 adopted January 6, 2025).

5. European Medicines Agency GCP Inspectors Working Group. Guideline on Computerised Systems and Electronic Data in Clinical Trials (EMA/INS/GCP/112288/2023) (effective September 9, 2023).

6. U.S. Food and Drug Administration. Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations: Questions and Answers — Guidance for Industry (October 2024, Revision 1).

7. China National Medical Products Administration. Good Clinical Practice for Drug Trials (Announcement 2026 No. 50, Effective 1 September 2026) (June 2026).

8. Sheetz N, Wilson B, Benedict J, et al. Evaluating Source Data Verification as a Quality Control Measure in Clinical Trials, Therapeutic Innovation & Regulatory Science, 2014; 48(6):671–680. DOI: 10.1177/2168479014554400, PMID: 30227471.

9. FDA. FDA Form483 Frequently Asked Questions.

10. U.S. Food and Drug Administration. Bioresearch Monitoring (BIMO) Fiscal Year 2024 Metrics (2025).

11. U.S. Food and Drug Administration. FY 2023 Sponsor/CRO/Monitor FDA 483 Observation Trends (2024).

12. FDA. FY2023 clinical-investigator Form483 observation trends.

13. U.S. FDA, FY2024 IRB FDA 483 Observation Trends, FY2024 figures only.

14. FDA. FY2023 IRB Form483 observation trends.

15. U.S. FDA, FY2024 GLP FDA 483 Observation Trends, FY2024 figures only.

16. FDA. FY2023 GLP Form483 observation trends.

17. FDA. E6(R3) Good Clinical Practice, final guidance, September 2025.

18. U.S. Food and Drug Administration. Use of Electronic Health Record Data in Clinical Investigations — Guidance for Industry (July 2018).

19. U.S. Food and Drug Administration. Electronic Source Data in Clinical Investigations — Guidance for Industry (September 2013).

20. ClinicalTrials.gov / Aggregate Analysis of ClinicalTrials.gov (AACT). Relational Clinical Study Database Snapshot (accessed August 2026).

21. Health Level Seven International. HL7 FHIR Release 4 (R4) Specification (accessed 2026).

22. Clinical Data Interchange Standards Consortium & HL7 Vulcan. HL7 FHIR-to-CDISC Joint Mapping Implementation Guide (accessed 2026).

23. National Archives and Records Administration (eCFR). 21 CFR Part 11: Electronic Records; Electronic Signatures (accessed 2026).

24. National Archives and Records Administration (eCFR). 21 CFR Part 312 Subpart D: Responsibilities of Sponsors and Investigators (accessed 2026).

25. HL7. SMART App Launch: scopes and launch context.

26. U.S. Food and Drug Administration. A Risk-Based Approach to Monitoring of Clinical Investigations: Questions and Answers — Guidance for Industry (April 2023).

27. International Council for Harmonisation. ICH Harmonised Guideline: General Considerations for Clinical Studies E8(R1) (October 2021).

28. Agrafiotis DK, Lobanov VS, Farnum MA, et al. Risk-based Monitoring of Clinical Trials: An Integrative Approach, Clinical Therapeutics, 2018; 40(7):1204–1212. DOI: 10.1016/j.clinthera.2018.04.020, PMID: 30100201.

29. EClinCloud. eClinical Platform: EDC, eCOA & CTMS | EClinCloud (accessed November 2026).

30. EClinCloud. Electronic Data Capture (EDC) | EClinCloud (accessed November 2026).

31. EClinCloud, Trust and compliance material, accessed November 2026.