you got a password?

A sponsor recently presented some site audit findings at an investigator meeting and I think two of them are definitely worth repeating:

1) The site has a number of personnel that were granted IVRS/EDC access, but never changed the initial passwords or accessed the system at least once.  So what's the big deal?  Well when user accounts are generated an initial password is created, which is sent either by email or fax and must be changed (by the person whose account it is) to something unique.  The sponsor is likely arguing that if an account is never fully activated or deactivated after the initial access information is sent, then that log on information could easily be abused by someone who is not supposed to have permission to access study specific files or databases.  The take home messages here are that if you have multiple users for a number of EDC/IVRS accounts, make sure that those individuals log in at least once when access is granted and if someone leaves the site (or study), contact the system administrator to have their account deactivated.
   Seems easy enough, but I imagine there are lots of situations where this situation exists at research sites.

2) Eligibility reviews.  The same sponsor noted that they are looking out for an assessment of continuing study eligibility by a qualified investigator at every visit up to (and including) randomization.  This includes washout visits, run-in visits, and screening visits.  Such a request is there to demonstrate that the site is continually monitoring subjects for eligibility and that inappropriately qualified personnel are not making decisions concerning subject eligibility.  While it may seem like more of a hassle than its worth, the eligibility assessment prior to baseline can be as simple as a statement signed by an investigator that a subject "meets all study criteria at this time."  Once that's done, you're in the clear (but of course, make sure the investigator is actually assessing eligibility...no blind signatures, please!)