For many MedTech companies, especially those that manufacture high-risk devices, clinical trials are a crucial part of getting medical devices to market and keeping them there. In fact, clinical activities, both pre-market and post-market, were some of the top business objectives that respondents to our 2024 State of the MedTech Industry Benchmark Report told us they were focused on this year.
And while the clinical trial itself is extremely important, the way that a sponsor collects and manages the data the trial generates is often just as crucial. Because clinical data management is more than just rows and columns—it’s the overall process of collecting and managing research data to produce high-quality information and reliable results in compliance with local regulations and good clinical practice.
Without good clinical data management, the data from clinical trials may not accurately convey the outcomes of studies and/or the data may not be usable in the eyes of regulatory agencies.
In this guide, we’re going to cover the entire spectrum of clinical data management: how clinical data is collected, best practices for managing it in a compliant manner— as well as pitfalls to avoid—and the tools and resources available to help you in your clinical operations.
Let’s get started.
The simple answer is that good clinical data management is important because clinical trials involve human subjects and the devices studied may go on to be used by millions of other patients. The World Health Organization (WHO) estimates there are two million different kinds of medical devices on the market around the world, and it’s a near certainty that each and every one of us will interact with medical devices over the course of our lives.
Carefully collecting and managing data from clinical studies is part of keeping participants safe and ensuring that the study sponsor is able to draw accurate conclusions from the analysis of that data. As Article 62 of the European Union Medical Device Regulation (EU MDR) puts it:
Clinical investigations shall be designed and conducted in such a way that the rights, safety, dignity and well-being of the subjects participating in a clinical investigation are protected and prevail over all other interests and the clinical data generated are scientifically valid, reliable and robust.
From a business perspective, however, excellent clinical data management is imperative because that data is the backbone of submissions to regulatory bodies. Clinical data is the proof that a device is safe and effective for its end users, and should be allowed on the market.
Typically, the devices that pose the highest potential risk must undergo clinical trials to collect the necessary data to prove their safety and effectiveness, though lower risk devices may also require clinical studies in certain cases.
In the US, approximately 10-15% of successful 510(k) submissions for Class II devices rely on data from clinical trials, and all Class III devices require extensive clinical trials to establish the reasonable certainty of their safety and effectiveness. FDA has even released a Q&A guidance document to help medical device companies understand the use of clinical data in submissions.
In the EU, Class IIb implantables and Class III devices will also require clinical investigations as part of their premarket regulatory pathway. Lower risk devices may also need clinical studies to determine their safety and effectiveness if there is not enough existing clinical evidence to prove it.
However, premarket clinical investigations are far from the only time you’ll need to collect clinical data. As you can see from the graphic below, clinical data will need to be collected throughout the lifecycle of your device.
In the US, post-market surveillance of your device is a regulatory requirement, and FDA may also request a post-approval study of your device. In the European Union, EU MDR also has significant requirements for post-market surveillance that include the collection of clinical data, including potential Post-Market Clinical Follow-Up (PMCF) studies. You are also required to gather and evaluate all the clinical evidence for your device, which will then be published in a Clinical Evaluation Report (CER).
Keep in mind that the CER is a living document, and must be updated regularly. For Class III or Class IIb implantable devices, the CER must be updated at least once a year. For Class IIa devices, the CER must be updated at least once every two years.
Failure to do so will have consequences, as EU MDR also explicitly directs notified bodies to “pay particular attention to clinical data from post-market surveillance and PMCF activities undertaken since the previous certification or re-certification, including appropriate updates to manufacturers’ clinical evaluation reports.” (Annex VII, Section 4.11). Given the high priority that regulatory bodies place on clinical data, your ability to collect and manage data from clinical studies is paramount to getting your device on the market and keeping it there.
For medical devices, clinical data collection happens throughout the entire lifecycle of the device, from early development all the way through the post-market stage. The graphic below provides another view of the various points in time during the device lifecycle that you’ll need to collect clinical data.
What you may notice is that while this graphic includes standard pre-market clinical investigations, it also includes a number of data collection methods, like registries and PMCF surveys, that are observational rather than interventional. What this means in practice is your EDC solution will require a number of different mechanisms for collecting clinical data, including:
In clinical investigations, investigators traditionally use case report forms to collect data from participating patients, including patient characteristics and demographic data, adverse events, and the results of experimental treatments.
Paper-based CRFs have been standard practice in clinical investigation for decades, but medical device companies in recent years are increasingly choosing electronic CRFs, (eCRFs). This is due to much higher efficiency and a lower rate of errors when using eCRFs.
The reduced study time associated with eCRFs likely stems from the instantaneous access sponsors have to eCRF data. With paper CRFs, the physical forms have to be shipped somewhere and reentered in an electronic system. That builds a lag into any system that uses paper—sponsors have to wait until they get the data to do anything with it.
Speed is also related to another benefit of eCRFs: improved data quality. In a modern electronic data collection (EDC) system, fields will be pre-validated, meaning sponsors can set a data range for a given input. If an investigator enters a number that is outside of the data range, the system will alert them and may prevent them from moving on. So, if a physician who has been working for the past ten hours sits down to enter patient data and mistakenly adds an extra zero to one of her entries, the electronic form will catch the mistake.
And by following a few simple best practices for eCRFs, manufacturers can maximize the benefits of electronic case report forms and simplify data collection.
Patient-reported outcomes are just what they sound like: data that the patient reports themselves (as opposed to the CRFs, which are filled out by site staff). PRO data has not always been the highest priority for manufacturers, but it is becoming increasingly important to medical device clinical trials. Regulatory strategy, reimbursement strategy, marketing, and more will all be affected to some degree by the data collected from patients.
As with CRFs, the best option for collecting PROs is now electronic. ePRO collection in clinical trials allows patients to self-report through an electronic device, such as a mobile app on a smartphone or tablet. This approach has several advantages over using paper forms:
Because of these advantages, studies have shown that ePRO response rates are significantly higher than paper forms and are also more accurate.
Post-market surveys are especially important for EU MDR’s post-market surveillance requirements, but they may also be required by FDA in the US. Post-market surveys are “observational”, meaning they use non-interventional methods to collect data. Here’s the difference:
For these observational studies, which may be following subjects over long periods of time, it’s important to have a post-market survey method that is pre-validated and compliant with Good Clinical Practice (GCP).
Finally, we have a method of data capture that is often forgotten: ad-hoc collection. As the name implies, ad hoc data collection doesn’t happen at set times—it happens when necessary or needed. This can make it difficult for manufacturers to collect this data in a GCP-compliant manner.
However, a tool like Greenlight Guru Clinical’s Cases module allows clinical staff to easily deliver data either during or after the application of a medical device in practice. This ensures that the data is fresh in a clinician’s mind and minimizes the burden of providing the data.
Clinical data collection and management may feel like a complex and difficult undertaking.
However, with the right plan, the right tools, and a close eye on compliance, there’s no reason why you can’t get the high-quality clinical data you need from your next study. Here are the best practices we recommend for clinical data management.
It’s one thing to declare yourself ready to start a study and begin collecting data. It’s another thing entirely to do it. Most clinical studies are plagued by a lack of planning or foresight that ends up delaying the study timeline, and may even affect the quality of the clinical data obtained from the study.
However, when it’s done correctly and planned ahead of time, clinical data collection and management can be done without adding burdens to existing workflows. You can download our in-depth guide to planning a clinical data management setup, but here is a brief overview of the key steps you’ll need to take:
For smaller projects, i.e., studies or projects that include 1-15 forms or questionnaires, one or two sites, and under 30 participants, we recommend that set up should start no later than a month before data collection starts. If your study is bigger than that, we advise you to consult with your data management vendor as larger studies will be highly influenced by the solution you choose.
Clinical data must be collected and managed in accordance with Good Clinical Practice (GCP) and a number of other regulations and laws within both the US and EU.
Good Clinical Practice is a set of ethical and scientific quality standards for designing, conducting, recording, and reporting trials that involve human subjects. GCP is an internationally recognized standard, and ensures that the rights, safety, and well-being of subjects are protected and that all clinical data is credible.
ISO 14155—Clinical investigation of medical devices for human subjects— Good clinical practice, most recently updated in 2020, provides the standard requirements for medical device clinical trials to comply with GCP. The entire standard is required reading if you’re undertaking a clinical investigation of a medical device, but as far as data management goes, you’ll want to pay close attention to section 7.8—Document and data control.
ISO 14155:2020 requires any electronic system be validated “in order to evaluate the authenticity, accuracy, reliability, and consistent intended performance of the data system.”
So, if you’re using an electronic data capture (EDC) system, you will need to comply with procedures outlined in section 7.8.3, which include requirements to:
And while that may seem daunting, with Greenlight Guru Clinical, you’ll have a system that comes pre-validated to all the requirements in ISO 14155:2020. That includes out-of-the-box compliance with the requirements in Section 7.8.3 and a suite of compliance document templates available to all customers.
If you are using EDC software in the US, you’ll also need to comply with the requirements in 21 CFR Part 11, the FDA’s regulation on electronic documentation and electronic signatures. The regulation is broken up into three sections:
A. General Provisions
B. Electronic Records
C. Electronic Signatures
The data and records generated by clinical trials, as well as any electronic signatures (such as those used for eConsent) fall under the purview of 21 CFR Part 11. The goal of the procedures and controls outlined in Subpart B are to ensure that electronic records maintain their:
The requirements for electronic signatures are found in both Subpart B and C. The electronic signatures requirements will be particularly relevant to you if you use eConsent in your clinical trials. Clinical trial managers may find gathering information digitally is safer and simpler than using physical documents—but that means the system they use to capture and store that data, will need to comply with the requirements in Part 11.
In addition to regulations and standards surrounding Good Clinical Practice, you’ll also need to be aware of and comply with data protection regulations, like the European Union General Data Protection Regulation (GDPR) and The Health Insurance Portability and Accountability Act of 1996 (HIPAA) in the US. Due to the introduction of GDPR in 2018, there are a number of different obligations that MedTech companies must fulfill when conducting clinical trials in the EU, including:
In the US, the Health Insurance Portability and Accountability Act of 1996 was passed to create national standards for the protection of sensitive patient health information from being disclosed without a patient’s consent or knowledge.
The three main HIPAA rules regarding Protected Health Information (PHI) in the US are:
In the US, sponsors of a medical device clinical trial will need to abide by all three of the HIPAA rules (Privacy, Security, Breach Notification), but the Privacy Rule has the most immediate impact on research. The Privacy Rule defines research as “a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge.”
When it comes to research, the Privacy Rule is meant to protect health information that could identify individuals while also making sure that researchers can access the data they need. You can find more information on complying with both data privacy regulations during clinical investigations in this article covering HIPAA and EU GDPR.
Given the extensive planning and the multitude of regulations and standards you’ll need to abide by, managing your clinical data may feel daunting. The truth is that the difficulty or ease of collecting and managing clinical data often comes down to the data management solution you choose.
For example, clinical data collection and management is often hampered by the use of paper forms, Excel spreadsheets and other general-purpose software that leads to data entry errors, incomplete forms, and even non-compliance with regulations.
That in turn leads to data “cleaning” on the back end that can take an enormous amount of time and resources to perform, or worse yet, throwing out the data set entirely and starting over with renewed attention to compliance. And keep in mind, the regulations and standards I just went over are not suggestions. You must follow Good Clinical Practice in your study if you want that data accepted by any regulatory body. You must stay compliant with laws around data privacy, like GDPR, if you want to be able to access and use your data once a study is over.
To generate the type of high-quality clinical data that regulatory bodies will require to approve your submission or keep your device on the market, you will need to stay compliant with the requirements of all relevant regulations and standards.
The easiest way to stay compliant is by using electronic data capture software that offers built-in compliance with the requirements of ISO 14155:2020, FDA and EU regulations and customizable compliance document templates.
Sometimes knowing what not to do is just as valuable as understanding best practices, and this is definitely true when it comes to clinical operations. Below I’ve listed some of the most common mistakes we see in clinical data management.
Collecting and maintaining clinical data on paper or Excel is perhaps the biggest mistake that MedTech companies make when they begin their clinical activities. That’s because starting with paper sets you up for failure in a number of ways.
For one thing, it’s challenging to ensure data integrity—meaning sufficiently documenting all aspects of data entry, data edits, and ensuring the data has not been modified, erased, or tampered with in any way—when you use paper records. And Excel simply is not built with the level of permissions or access management found in a pre-validated EDC solution.
Beyond data integrity, companies that use paper or spreadsheets also run into problems with project management. Clinical trials often happen at multiple sites, and without a firm plan for centralizing your data collection, it can create data fragmentation—especially if the methods for each entry location are different. This makes it extremely difficult to do things like:
Finally, paper and Excel make it difficult (if not impossible) to comply with the regulations we talked about earlier. If we look to section 7.8.3 of ISO 14155:2020, we see that if an electronic system is used as the primary location of document storage and filing, the system must be validated in order to evaluate authenticity, accuracy, reliability, and consistent intended performance of the system. That means that whatever software used for storing clinical data needs to be validated, something that is nearly impossible to do with a general purpose system like Excel.
Clause 6 of ISO 14155:2020 covers clinical investigation conduct, and the good clinical practices outlined there are intended to ensure that the investigation maintains strict accountability and tight controls over documentation and recording. That means privacy must always be maintained and data should be protected against unauthorized access—two requirements that neither paper records nor Excel spreadsheets can guarantee.
Device manufacturers understandably tend to focus their attention on their device when they are performing clinical activities. They’re trying to understand how the device is performing, and it’s exciting to see it finally put to use helping patients.
However, it’s important not to lose sight of the central element of every clinical study: the patient.
Data from case report forms is still incredibly useful, but it’s important that you consider the patient’s point of view, as well, and collect it via patient reported outcomes. Aside from keeping the patient at the center of your study, PROs are a great source of data on your device and regulatory bodies and competent authorities place an emphasis on this data.
The need for PRO data is better known today, but there are still too many study sponsors who forget to include it. The data is typically not difficult to collect (if you’re using the right tool), and it’s an important part of the clinical data you need to collect to ensure the safety and effectiveness of your device.
Additionally, mixing clinical data collection tools (using paper CRFs, but ePROs and recording it all in Excel) is another method I would urge you to avoid. The problems are the same as doing it all on paper or Excel, but with even more room for error.
One study found that when manually entering data into complex spreadsheets, the probability of human error was 100%. In a situation where the integrity of your data can be the difference between regulatory approval and denial, there is simply too much on the line to be manually entering data from different sources. Also, combining data collection tools often leads to compatibility issues.
Clinical data collection tools may have different file formats, data structures, or APIs that make them incompatible with each other. For example, one tool may collect data in a specific format that cannot be easily integrated with another tool.
Mixing informed consent and data consent
As we discussed briefly earlier in the guide, if you are pursuing clinical trials in the EU, you’ll need to obtain both informed consent (for participation in the study) and data consent (for sharing data with third parties, in accordance with GDPR).
These two types of consents often get mixed up or, just as bad, get combined into a single consent form. We see this happen a lot during investigator-initiated studies, where the investigators don’t have legal resources on hand to help them navigate the different types of consent. This can lead to extreme cases where a study went on for years, and at the end of it, the manufacturer of the device had no legal access to the data that was generated from the study.
Simply put: you need to obtain both informed consent and data consent, but you need to do so separately. You cannot use the same form for both.
It’s also important to understand that not all EDC software is built for MedTech companies. Many, including some you may be familiar with, were built for pharmaceutical trials, and there are significant differences between medical device studies and pharma studies.
From a functional standpoint, devices can only be studied by observing them in use. As a result, device studies are often small and require unique methodologies for clinical data collection from a variety of different individuals, such as healthcare providers, physicians, investigators, and patients.
Additionally, clinical data collection in device studies and clinical operations for devices is conducted around the whole life cycle of a device, from early-stage to later-stage for market approval, and post-market surveillance.
At the end of the day, the most effective solution is the one that is built with your specific problem in mind. An electronic data capture system like Greenlight Guru Clinical, created specifically for MedTech companies and their unique needs, is what medical device companies should really be using for the most efficient and effective data capture and management.
Given the complexity and unique nature of medical device clinical trials, many MedTech companies will choose to work with a contract research organization (CRO). In fact, in Greenlight Guru’s 2024 State of the MedTech Industry Report, 70% of respondents told us they were going to outsource at least some of their clinical activities to a contract research organization (CRO) or consultant this year.
Some CROs are full-service, meaning they help with every stage of clinical operations, from site selection and participant recruitment trial monitoring and data management, while other CROs and consultants may focus on specific elements of the process like medical writing. Essentially, CROs can help your company with a wide range of services, throughout all stages of your clinical activities. It just depends on your needs.
The choice of a CRO will revolve around your company’s capacity and experience with clinical operations, but there are some things to consider if you’re thinking about using a CRO or consultant. Here are a few steps you can take to help determine what you’ll need from a CRO:
Define your requirements (consider the SMART approach). In other words, your requirements should be Specific, Measurable, Attainable, Relevant, and Time-bound. This will help ensure that when you present your needs to a specific partner, they’ll quote you for what you need and nothing more or less.
Map which requirements can be handled in-house. Many internal clinical teams are fairly lean, and you’ll need to take a hard look at internal resources available to you. Consider whether you want to bring on more staff internally, or if you’d rather outsource more of the work.
Document results and refer back to your initial requirements. Once the process is underway, it’s important to track progress and continually assess whether your initial requirements are being met. Understanding your partner’s performance will help you course correct, if necessary, and help you decide whether this partner is the best fit for future clinical activities.
For a more in-depth method of determining your requirements and preferences for a CRO, download our free CRO Requirements Cheat Sheet, which covers everything from site access to cost structure and data access.
If you’re looking at using a CRO for any part of your upcoming clinical operations, I’d highly encourage you to check out the Greenlight Guru Partner Directory, where you can find many full-service and service-specific CROs to help you carry out your medical device clinical trials.
Even after finding a CRO (should you choose to use one), you’ll still be faced with a critical choice: what tools to use to collect, manage, and analyze the clinical data from your device’s study.
Remember, while your CRO may have preferences on an EDC solution—perhaps one they’ve used before—the choice is ultimately yours. This is your study and your data, and you are the one who decides how that data will be collected and managed. As I noted earlier, I would highly recommend you do not attempt to do your clinical data collection and management on paper or a general-purpose tool like Excel. The stakes are too high and the opportunity for errors in data entry too great.
What you should really be looking for is a comprehensive EDC solution that allows you to collect and manage your clinical data all in one place. And as I mentioned earlier, the unique aspects of medical device clinical studies mean that you ideally want EDC software that’s been purpose-built for MedTech companies.
Whether you are assessing Greenlight Guru Clinical or another EDC system, there are a few steps we recommend in evaluating and choosing a vendor for your EDC software.
There’s a good chance your organization will require you to formally evaluate and get quotes from multiple vendors. As you go through this process, a vendor evaluation checklist can be an excellent tool to keep track of the different options and quickly compare them. Here are 13 key questions you should be asking every EDC vendor:
Once you’ve found a vendor that you believe is the best fit for your company, work with them to build a business case for purchasing their solution that you can present internally to your executive team.
As you start to build the case together, it’s important to include both the benefits of the EDC system you’d like to purchase, as well as the ways it will affect the costs of running clinical investigations and collecting data—in both obvious and less apparent ways. Cost-savings that might not be immediately recognized can include:
As you work with the sales team from the EDC vendor, ask if they have case studies that demonstrate cost-savings with their product. For instance, Oticon Medical—a long time Greenlight Guru Clinical customer and one of the top hearing aid manufacturers in the world—estimates they now complete their clinical studies 130-140% faster since switching to Greenlight Guru Clinical.
The Oticon team also estimated that their ROI on the purchase of Greenlight Guru Clinical was 136% after the first two years—and more than 270% after four years. Quantitative data like that, combined with the qualitative benefits of your chosen solution, will be critical to helping you build a strong business case that you can present with confidence to your executive team.
One final piece of an EDC business case that people often forget to consider is the transition plan. Also referred to as a project plan, the transition plan is the summary of how you intend to get from A to B—meaning from paper or your old EDC system to the new one. It should answer questions like:
As with every robust system, there will be an onboarding process. Learn from the sales team how long that will take, and when it is best to begin if you need to start your study in the next couple of months.
With Greenlight Guru Clinical, medical device companies can set up their study within a couple of weeks and even faster depending on size or complexity. In some cases, our Customer Success team can even help with building parts of your first study to speed this process up.
If you’re just beginning the journey of purchasing a new electronic data capture solution (or you’re stuck somewhere in the middle), I encourage you to check out our EDC buyer’s guide. It will walk you through the steps of evaluating EDC software and getting executive buy-in for your purchase—whether you decide to use Greenlight Guru Clinical or not.
I’m not exaggerating when I say that a well-planned and perfectly executed study means nothing if you can’t collect or manage the clinical data the study generates. Simply completing a study does not necessarily prove that your device is safe and effective for its end users.
Those assertions can only be proven via the data plus the integrity of the data you collect from your study. And nothing has a greater effect on your ability to gather and analyze high-quality clinical data than the tool you choose to help you accomplish that task.
When you choose to partner with Greenlight Guru Clinical, you’re not only getting the leading toolbox for MedTech clinical data collection, you’re getting dedicated customer service from MedTech professionals who understand the unique nature of medical device clinical trials.
So if you’re looking for a partner who will be with you every step of the way, then Get Your Free Demo of Greenlight Guru Clinical.→
Chris is a biomedical engineer and has been in the medical device space for about 13 years. He spent a number of years managing clinical studies for Class III devices in Pivotal studies, PMA studies, and post-market registries. He is currently working as a Solutions Engineer at Greenlight Guru where he showcases the...