eSource in Clinical Trials: Source Data, Direct Entry and EHR to EDC

eSource in clinical trials means source data recorded electronically from the start: a value typed into the eCRF during the visit, a reading sent by a device, an answer a participant enters in an ePRO app, or data transmitted from an electronic health record (EHR). For each value, the source is the record where it first appears, and that record has to stay available to monitors and inspectors.

Your monitor opens the eCRF, sees a hemoglobin value and asks where it came from: the lab report, the hospital record or the coordinator's keyboard. The answer decides what gets verified, what an inspector can request and how many errors your dataset carries. A meta-analysis published in 2025 in the International Journal of Medical Informatics pooled studies from 1978 to 2008 and found a 6.57% error rate when data were abstracted from medical records, against 0.14% with double data entry. The source depends on the capture path, and the FDA, the EMA and ICH E6(R3) each set what you document before you connect a hospital record to your EDC.

What counts as source data when it is electronic?

Source data is the information in original records, or certified copies of them, that lets you reconstruct and evaluate a trial. The FDA guidance on electronic source data of 2013 uses this definition, and ICH E6(R3) states that source records count irrespective of the media used. A value can start its life in an eCRF, a device, an app or an EHR.

Two consequences follow for your data management plan. Each data element needs an identified originator: the investigator or delegated staff, the participant, a consulting service such as a radiologist, a device, or a system such as an EHR. And each value has to be attributable, legible, contemporaneous, original and accurate, the ALCOA criteria the FDA lists in the same guidance. ICH E6(R3) adds "complete" to that list in section 2.12.2 and asks that changes to source records stay traceable through an audit trail.

Where is the source for each way of capturing data?

The source depends on the path a value takes into the eCRF. The FDA guidance of 2013 sets the rule path by path: when a value enters the eCRF first, the eCRF is the source; when it passes through another record first, that record is the source and the site keeps it available for inspection.

The table follows section III.A.2 of the FDA guidance, one capture path per row.

The last row surprises teams. The FDA keeps the EHR as the source even when the transfer is automatic, because an EHR can apply intervening processes, such as algorithms that select which data elements to send. The pertinent data for your participants then has to be available for review during an FDA inspection. The same guidance asks the eCRF to record, for each value, who or what originated it, when it was entered and which participant it belongs to.

What do the EMA and ICH E6(R3) expect from eSource?

In Europe, the EMA guideline on computerised systems and electronic data of 2023 and ICH E6(R3), in effect in the EU since 23 July 2025, add three expectations: specify where the source data sits before the trial starts, validate every data transfer, and keep the medical record complete.

Location. The EMA guideline asks for the location of all source data to be specified before the trial starts and updated during the trial. Section 2.12.2 of ICH E6(R3) gives the investigator the same task: define what counts as a source record, the methods of data capture and their location. When data goes straight into a data acquisition tool with no prior record, the protocol identifies it as source data, under both texts. ICH E6(R3) also asks to avoid "unnecessary transcription steps between the source record and the data acquisition tool".

Transfers. Section 6.1.2 of the EMA guideline asks that every transfer needed during the trial be pre-specified, validated with challenging test sets and working at trial start. Section 4.2.5 of ICH E6(R3) accepts validated processes or reconciliation, provided the data and its metadata keep their integrity.

The medical record. Annex 6 of the EMA guideline states that trial-specific tools cannot replace the medical record, and that monitoring also considers the information it holds. Section 3.16.1 of ICH E6(R3) asks the sponsor to assess an EHR for fitness for purpose before using it in a trial, in proportion to the importance of the data it manages.

How does EHR data reach the EDC?

EHR data reaches the EDC through one of three set-ups, which the FDA guidance on EHR data of July 2018 calls noninteroperable, interoperable and fully integrated systems. The first one is manual: a coordinator reads the hospital record and types values into the eCRF. In the other two, data moves electronically.

The table sets the three set-ups side by side, with what each one leaves you to verify.

The FDA guidance of 2018 states that the FDA does not intend to assess EHR systems against 21 CFR Part 11. It still has to verify the quality and integrity of the data during inspections, so the sponsor carries the burden. The guidance asks sponsors to list in the data management plan the EHR system used at each site, with its manufacturer, model and version. On the technical side, ICH E6(R3) imposes no data standard: HL7 FHIR is one format a hospital may support, and your EDC vendor's API has to accept the format the hospital sends.

When is an EHR-to-EDC connection worth building?

Connect an EHR to your EDC when the same structured values repeat at every visit across many participants, such as vital signs and lab results, and when each hospital's IT team agrees to open the connection. Free-text notes, one-off data and small single-site studies cost less to transcribe and verify.

Take a cardiovascular study with vital signs and potassium at eight visits for 300 participants across ten hospitals. Every visit repeats the same structured fields, the FDA guidance of 2018 encourages that exchange of structured data so values are entered once at the point of care, and each value your coordinators no longer re-key is one your monitor no longer checks against the hospital record. Now take an investigator-initiated study with 40 participants in one hospital, where the outcomes sit in free-text consultation letters. A connection there costs more to validate than the transcription it removes.

Count the hospital systems before you decide. Each site runs its own EHR, often from a different vendor, and each one is a separate mapping to build, validate and maintain through every protocol amendment. Our article on which data flows to automate first applies the same reasoning to lab results, devices and the CTMS.

[[cta]]

What should you ask an EDC vendor about eSource?

Ask five questions before you shortlist an EDC for a study that relies on eSource. The answers tell you whether the eCRF can serve as the source for direct entry, and whether values coming from an EHR or a device keep their origin in the audit trail.

• Direct entry: can site staff and participants enter data straight into the eCRF and the ePRO module, with each value tied to its originator and time stamp?
• Origin of system data: does the audit trail show the system that wrote a value through the API, a device or an EHR?
• Monitor access: can a monitor get read-only access restricted to the participants of their sites, audit trail included, as the EMA guideline and ICH E6(R3) describe?
• Transfer validation: can you run an integration against test data before go-live, and who reruns the test after an amendment?
• Investigator sign-off: can the investigator review and electronically sign the data at defined time points, as the FDA guidance of 2013 expects before data is archived or submitted?

These questions sit alongside the rest of the method in our guide on how to choose an EDC for your clinical trial, and the validation side is covered in our article on computerized system validation.

How Datacapt handles eSource and EHR data

In Datacapt, site staff enter visit data straight into the eCRF and participants answer their questionnaires in the ePRO module on the same patient record, so the eCRF is the source for those values. The audit trail records each entry and each change, and the Datacapt EDC covers review, source data verification, lock and investigator signature.

For data that starts in another system, including an EHR, the Datacapt API exchanges data with external systems in both directions. It is a RESTful, JSON-based API with OAuth 2.0 authentication, role-based access, audit logging and webhooks on study events, and a test environment lets your team validate a connection before go-live. Your data manager scopes each hospital connection with the site's IT team, field by field.

Write your source data location list before the protocol is final: for each data element, name the originator, the system that records it first and the path it takes to the EDC. With that list, your monitor knows what to verify, each site knows which records to keep, and you can see which values justify an EHR connection. Our guide on how to write a data management plan shows where the list goes.

[[faq]]

Sources

• U.S. Food and Drug Administration (FDA), Guidance for Industry: Electronic Source Data in Clinical Investigations, September 2013.
• U.S. Food and Drug Administration (FDA), Use of Electronic Health Record Data in Clinical Investigations: Guidance for Industry, July 2018.
• European Medicines Agency (EMA), GCP Inspectors Working Group, Guideline on computerised systems and electronic data in clinical trials (EMA/INS/GCP/112288/2023), 2023.
• International Council for Harmonisation (ICH), Guideline for Good Clinical Practice E6(R3), final version adopted on 6 January 2025.
• Garza M. Y. et al., Error rates of data processing methods in clinical research: a systematic review and meta-analysis of manuscripts identified through PubMed, International Journal of Medical Informatics, vol. 195, 2025.