# Electronic Case Report Form - FDA vs. MDR

Author: Sebastian Skorka
Published: 2025-09-29
Updated: 2025-09-29
Source: https://openregulatory.com/articles/electronic-case-report-form-fda-amp-mdr

---

If you're in the medical device field, you know that clinical studies are often essential to prove your device is safe and does what it claims. This is especially true under the EU's Medical Device Regulation (MDR) and when seeking clearance or approval from the FDA (like for PMAs or even some 510(k)s). While paper forms used to be the norm, today's standard for collecting clinical study data is the Electronic Case Report Form, or eCRF. Moving to digital makes things way more efficient, but it's not just about ditching paper – your electronic system has to meet some serious regulatory requirements. Let's dive into what that means.
What Exactly is an eCRF?

Think of an Electronic Case Report Form as the high-tech version of the old paper forms used in clinical trials. It’s a secure, validated computer system designed specifically to capture all the information required by the study protocol for each participant. For a medical device study, this typically includes:
• Patient demographics (age, sex, medical history)
• Details on how the device was implanted or used
• Device performance measurements (e.g., readings, scores)
• Any adverse events or device deficiencies experienced
• Information about related medical procedures
• Follow-up data and patient-reported outcomes


Why is Getting eCRFs Right So Important?

The data collected in your Electronic Case Report Form is the foundation of your clinical evidence. Regulators in Europe and the US need to be absolutely confident that this data is accurate, complete, reliable, and traceable. Here’s why a compliant eCRF setup is non-negotiable:
1. Data You Can Trust: Well-designed eCRF systems have built-in checks (like range checks or logic checks) that flag potential errors as data is being entered. This significantly boosts data quality compared to paper, where errors might only be caught much later (if at all).
2. Boosted Efficiency: Real-time data entry means monitors can review data faster, often remotely. Automated queries streamline fixing issues, and electronic systems generally speed up the whole process from data collection to analysis.
3. Meeting Regulatory Expectations: Both the EU MDR and the FDA have clear expectations for electronic data systems. Failing to meet these can lead to regulators questioning your data, potentially delaying or even derailing your device approval.


The Regulatory Lowdown: MDR vs. FDA Requirements

While both regulators want trustworthy data, their specific rules and focus areas differ slightly. {{ table|electronic-case-report-form-fda-amp-mdr-table-1 }} 
Key Features Your Compliant eCRF System Needs:

Whether building in-house (a massive undertaking!) or buying from a vendor, ensure these features are robust for the case report form:
1. Documented Validation: This isn't optional. You need a validation package (plan, test scripts, results, report) proving the system works as intended in your specific setup and meets regulatory requirements (especially Part 11 if applicable).
2. Secure, Unalterable Audit Trails: Tracks who did what, when, and why (if applicable) for every piece of data entered or changed. It should be automatic and impossible for users to disable or modify.
3. Robust Security & Access Control: Unique user IDs and passwords, role-based permissions (e.g., data entry vs. monitor vs. investigator), session timeouts, and protection against unauthorized access.
4. Data Integrity Features (ALCOA+): Beyond the basic ALCOA, think ALCOA+ (adding Complete, Consistent, Enduring, Available). Use built-in edit checks (e.g., date ranges, valid values), prompts for required fields, and clear data entry interfaces.
5. Compliant E-Signatures (If Used): If investigators or others sign electronically, the system must meet the strict Part 11 requirements (or equivalent local regulations).
6. Comprehensive SOPs: Clear, detailed procedures covering everything from user setup and training to data entry, query resolution, system maintenance, validation, security management, and data backup/archiving.
7. Documented Training: Proof that everyone using the system understands their roles, responsibilities, and how to use the system according to the SOPs and regulations.
8. Reliable Data Export & Archiving: Ability to accurately export data in usable formats (e.g., CSV, SAS) for analysis and submission. Clear procedures for long-term data archiving according to regulatory retention periods.


Putting it into Practice: Example Scenario

Let's say 'CardioInnovate Inc.' is running a clinical study in the US and EU for its new coronary stent ('FlowRight Stent'). They choose a commercial, cloud-based Electronic Case Report Form vendor.
1. Vendor Qualification: CardioInnovate audits the vendor, reviewing their validation documentation, security procedures, Part 11 / ISO 14155 compliance statements, and SOPs.
2. System Setup & Validation: They configure the eCRF based on their specific study protocol (e.g., forms for baseline characteristics, procedure details, follow-up visits, adverse event reporting). CardioInnovate performs User Acceptance Testing (UAT) to confirm the setup matches the protocol and functions correctly for their study, documenting this validation.
3. SOPs: They develop study-specific SOPs detailing how site staff will enter data, how monitors will review it, how queries will be managed, and how investigators will sign off on records (using Part 11 compliant e-signatures).
4. Training: All site coordinators, investigators, and monitors receive documented training on the eCRF system and the study-specific SOPs before the first patient is enrolled.
5. Data Entry & Monitoring: Site staff enter patient data directly into the eCRF during visits. Built-in edit checks flag potential errors (e.g., an invalid date). Monitors review data remotely, issuing electronic queries for discrepancies. Audit trails record all entries, changes, and queries.
6. Data Lock & Export: Once data cleaning is complete, authorized personnel electronically lock the database. The data is then exported in a validated manner for statistical analysis and inclusion in the FDA submission and the CER for MDR.


Choosing Your Path: Build vs. Buy

Developing a fully compliant Electronic Case Report Form system from scratch is incredibly complex and resource-intensive due to the validation burden. Most companies, especially smaller ones, opt to use established eCRF vendors who specialize in clinical trials and regulatory compliance. However, using a vendor doesn't absolve you of responsibility. You still need to qualify the vendor and validate the system for your specific intended use.

The Bottom Line

eCRFs are powerful tools for managing medical device clinical data efficiently and accurately. But "electronic" doesn't automatically mean "compliant." You need to ensure your system and processes rigorously meet the requirements of ISO 14155 and/or FDA 21 CFR Part 11 (and Part 812). Investing time in proper validation, SOPs, training, and choosing the right system is crucial for generating trustworthy clinical evidence, achieving regulatory success, and ultimately, ensuring your device is safe and effective for patients.