Written and maintained by CASRAI Editorial Board
Last updated
The ALCOA+ data integrity principles form the global regulatory benchmark used by the U.S. Food and Drug Administration (FDA), the European Medicines Agency (EMA), the UK Medicines and Healthcare products Regulatory Agency (MHRA), and the World Health Organization (WHO) to evaluate whether paper and electronic records across Good Clinical Practice (GCP), Good Laboratory Practice (GLP), and Current Good Manufacturing Practice (CGMP) are trustworthy, reliable, and reconstructable during an inspection.
What Are the ALCOA+ Principles and How Are They Used in Clinical Research and Healthcare?
Originally formulated in the 1990s within FDA Office of Enforcement compliance policy as the five-letter acronym ALCOA (Attributable, Legible, Contemporaneous, Original, Accurate), the framework was expanded by the EMA, MHRA, PIC/S, and WHO into ALCOA+ through the addition of four lifecycle principles (Complete, Consistent, Enduring, Available)—and in the 2023 EMA Guideline on Computerised Systems and Electronic Data in Clinical Trials, further referenced as ALCOA++ with the tenth attribute, Traceable.
| Attribute | Regulatory Meaning | Clinical Research & eSource / EDC Implementation Requirement |
|---|---|---|
| Attributable | Every data point identifies who acquired or modified it and when | Unique user logins (21 CFR § 11.10(d)/(e)); prohibition of shared site coordinator accounts; role-bound electronic signatures |
| Legible | Human-readable and understandable throughout the entire retention period | Indelible ink on paper source with single-line strike-throughs (initialed and dated); uncorrupted character encoding and decoded audit trail views in EDC |
| Contemporaneous | Recorded at the exact moment the clinical observation or test occurs | Direct point-of-care entry into electronic medical charting or eSource tablets; server-synchronized UTC timestamps |
| Original | First capture of source data (or a verified Certified Copy preserving context and metadata) | Preserving dynamic electronic raw files (ECG waveforms, chromatography traces, EHR records) rather than static flat printouts |
| Accurate | Truthful representation of the observation, free from unrecorded edits or bias | Validated automated edit checks in EDC (such as Viedoc), calibrated laboratory instruments, and documented quality review |
| Complete (+) | All data—including repeat measurements, failed runs, and audit history—are retained | Exporting full eCRF casebooks TOGETHER with complete audit trails, query histories, and unblinded metadata at database lock |
| Consistent (+) | Chronological sequence and cross-system alignment without contradiction | Network Time Protocol (NTP) clock synchronization across EHRs, central labs, eCOA devices, and IRT randomization logs |
| Enduring (+) | Recorded on durable, controlled media that survive multi-decade archiving | Replacing fading thermal ECG/balance strips with certified archival PDFs or validated cloud repositories for 25-year EU CTR retention |
| Available (+) | Readily retrievable for inspection, audit, and reconstruction on demand | Investigator-controlled eCRF archives and Trial Master File (eTMF) access independent of sponsor control |
What Standards or Regulatory Requirements Govern ALCOA+ Principles?
Inspectors do not enforce “ALCOA+” as a standalone statute; rather, each letter maps directly to binding provisions in federal regulations and international harmonized guidelines:
- FDA 21 CFR Part 11 (Electronic Records; Electronic Signatures) & FDA 2018 CGMP Data Integrity Guidance: 21 CFR § 11.10(e) mandates secure, computer-generated, time-stamped audit trails that independently record the date and time of operator entries and actions that create, modify, or delete electronic records, without obscuring previously recorded information. FDA Warning Letters routinely cite violations of ALCOA+ when laboratories delete aborted chromatographic runs (“testing into compliance”) or share administrator passwords.
- ICH E6(R2) Section 4.9 and ICH E6(R3) Data Governance: Requires investigators and sponsors to maintain source documents and trial records that satisfy ALCOA+ criteria, ensuring that any modification to a case report form is traceable, explained, and does not obscure the original entry.
- EMA Guideline on Computerised Systems and Electronic Data in Clinical Trials (2023): Explicitly codifies ALCOA++ (adding Traceable across data transfers, ETL mappings, and CDISC SDTM transformations) and requires periodic audit trail review by sponsors based on trial criticality.
- WHO Technical Report Series (TRS 996 Annex 5 & TRS 1033 Annex 4) and MHRA GxP Data Integrity Guidance (2018): Define the global inspection standards for raw data, dynamic vs. static record formats, and Certified Copy verification procedures.
How Do ALCOA+ Principles Integrate with EHR and Health Informatics Workflows?
In modern clinical trials where hospital EHRs, wearable biosensors, and patient apps serve as electronic source data (eSource), maintaining ALCOA+ integrity across system boundaries requires specific informatics controls:
- Eliminating Uncontrolled Paper “Shadow Charts”: A frequent GCP inspection finding occurs when a clinical research coordinator writes vital signs on a sticky note or unvalidated worksheet during a patient visit and types them into the EHR or EDC days later. This violates both Contemporaneous and Original principles unless the signed paper worksheet itself is retained in the Investigator Site File as the designated source document.
- Certified Copy Validation for Thermal Printouts and Scanned EHR Records: Per ICH E6(R2) 1.63, when a paper record (such as a thermal-paper ECG strip or external hospital chart) is digitized to fulfill the Enduring requirement, the site must execute a formal Certified Copy workflow: a trained person verifies that the scan is a complete, accurate reproduction of the original with identical attributes and applies a dated signature or validated electronic seal.
- Cryptographic Audit Trails and HIPAA Security Rule Alignment: High-assurance clinical databases increasingly pair 21 CFR Part 11 relational audit tables with Merkle tree cryptographic hash chains so that any unauthorized database-level alteration of historical ePHI or trial source data is mathematically detectable under 45 CFR § 164.312(c)(1) (Integrity).
Frequently Asked Questions
What are the ALCOA+ principles and how are they used in clinical research and healthcare?
ALCOA+ is the regulatory data integrity standard requiring all GxP clinical, laboratory, and manufacturing records to be Attributable, Legible, Contemporaneous, Original, and Accurate (ALCOA), plus Complete, Consistent, Enduring, and Available (+). Sponsors, CROs, and investigative sites use ALCOA+ to design compliant EHR source workflows, EDC edit checks, and audit trail reviews.
What standards or regulatory requirements govern ALCOA+ principles?
ALCOA+ is enforced through FDA 21 CFR Part 11 (electronic records and audit trails), 21 CFR Parts 58, 211, and 312, ICH E6(R2/R3) Good Clinical Practice, the EMA 2023 Guideline on Computerised Systems and Electronic Data in Clinical Trials (which adds Traceable as ALCOA++), MHRA GxP Data Integrity Guidance, and WHO TRS 996 Annex 5.
How do ALCOA+ principles integrate with EHR and health informatics workflows?
In EHR and eSource workflows, ALCOA+ requires unique clinician logins with role-based access, NTP-synchronized timestamps across hospital and EDC servers, HL7 FHIR R4 provenance tracking when importing EHR values into eCRFs, and formal Certified Copy verification whenever paper or thermal records are scanned for long-term archiving.
