A Data Manager receives an audit finding of three different instances of simultaneous log-ins to the EDC system by the same site user. This was…

The most appropriate long-term response is a comprehensive Corrective and Preventive Action (CAPA) plan. An audit finding of shared user credentials is a serious breach of data integrity and security principles outlined in regulations like 21 CFR Part 11. The best long-term strategy addresses the root cause (user behavior/lack of understanding) and prevents recurrence. This involves retraining the specific users (corrective), re-communicating the policy and the legal implications of e-signatures to all users (preventive), and establishing routine monitoring to verify the effectiveness of the training and communication (effectiveness check). This multi-faceted approach ensures sustained compliance.

A. Acquiring technical controls is a valid preventive action, but it fails to address the fundamental root cause of user non-compliance and may not be immediately feasible or available.

C. Removing all access is a drastic, short-term containment action, not a sustainable long-term solution that addresses the underlying behavioral and procedural issues.

D. This response is overly punitive, outside the Data Manager's authority, and makes an unsubstantiated claim of a HIPAA violation. Firing staff is a site-level decision.

---

1. Society for Clinical Data Management. (2023). Good Clinical Data Management Practices (GCDMP). Section 4.6.2, "User Account Management," explicitly states, "Each user must have a unique user ID and password... User accounts must not be shared." Section 7.4, "Audit Findings," outlines the requirement for a formal response to audit findings, which includes root cause analysis and a CAPA plan to prevent recurrence.

2. U.S. Code of Federal Regulations, Title 21, Part 11.10(d) and 11.300. These sections mandate "limiting system access to authorized individuals" and implementing controls for identification codes and passwords. The controls must ensure that any use of a user's credentials is by that specific individual, making password sharing a direct violation. A proper response involves reinforcing these procedural controls through training and monitoring.

3. Prokscha, S. (2016). Practical Guide to Clinical Data Management (4th ed.). CRC Press. Chapter 19, "Audits and Inspections," describes the standard process for responding to audit findings. This includes developing a CAPA plan that identifies the root cause, implements corrective actions (e.g., retraining), and establishes preventive actions (e.g., revised procedures, broader communication, ongoing monitoring) to ensure the issue does not happen again. (https://doi.org/10.1201/9781315371998)