UCLA Clinical Research Monitoring and Auditing Policy Updates

Effective January 1, 2027

The UCLA Office of Clinical Research is announcing updates to UCLA Policy 9207: UCLA Clinical Research Study Third Party Monitoring & Auditing Policy, effective January 1, 2027.

The updated policy establishes standardized requirements for third-party monitoring and auditing of clinical research studies at UCLA, including important changes to on-site monitoring procedures and access to HealthLink and Florence eBinders.

These updates apply to FDA-regulated and non-FDA-regulated clinical research studies and are intended to support efficient monitoring and auditing while maintaining participant privacy, data security, and institutional compliance.

Key Policy Updates

1. On-Site Monitoring and Auditing: New Registration, Visit Requirements, and Fees

Remote monitoring and auditing remain UCLA's preferred method of monitoring and auditing. On-site visits should be limited to circumstances where in-person access is necessary for participant safety, study integrity, regulatory requirements, or when remote monitoring and auditing is not feasible.

New registration and notification requirements:

• Initial registration: All external monitors and auditors must register with the CTSI Office of Regulatory Affairs (ORA) before conducting their first on-site monitoring or auditing visit.
• Required documentation: Initial registration requires a completed Confidentiality Statement and current Good Clinical Practice (GCP) certification. UCLA-specific GCP certification is not required.
• Notification before every visit: Monitors and auditors must notify CTSI ORA before each on-site visit.
• Advance coordination: All on-site visits must be approved and scheduled with the study team in advance. Sponsor confirmation letters must specify the records and areas requiring review, including clinical or pharmacy areas, when applicable.

New on-site monitoring and auditing provisioning fee:

Effective January 1, 2027, a $1,600 provisioning fee per monitor or auditor will apply to industry-funded studies with UCLA IRB application creation dates on or after January 1, 2027, which shall be subject to applicable indirect rates. Nonprofit-funded and currently active clinical research studies will be exempt from this fee at this time.

Study teams planning new studies should begin incorporating this fee into their study budgets now to ensure adequate funding for anticipated on-site monitoring and auditing activities. Studies initiated prior to January 1, 2027, will be grandfathered in and exempt from this fee.

Links to the Initial On-Site Registration and Subsequent On-Site Visit Notification will be available on the CTSI Office of Regulatory Affairs ResearchGo website on 1/1/2027.

2. Expectations During On-Site Monitoring and Auditing

All external monitors and auditors must comply with UCLA's on-site monitoring requirements throughout their visits.

Monitors and auditors are expected to:

• Sign the monitor/auditor visit log at each visit.
• Wear an appropriate UCLA visitor badge at all times while on-site.
• Be escorted by UCLA staff when entering or working in clinical areas.
• Access only approved study records, participants, and areas necessary for authorized monitoring activities.
• Comply with applicable UCLA Health privacy, confidentiality, and security requirements.

Study teams are responsible for coordinating appropriate monitoring space and ensuring safeguards are in place to prevent incidental exposure to PHI belonging to individuals who are not study participants.

On-site access must be appropriately coordinated and provisioned before the scheduled visit. Registration alone does not authorize access to HealthLink or Florence eBinders; these systems require separate approval and provisioning.

3. Florence eBinders: Access to Documents Containing PHI

The updated policy establishes requirements for providing external monitors and auditors access to Florence eBinders containing PHI. The rollout for access to Florence eBinders containing PHI will be communicated in the coming weeks.

Two types of Florence eBinders access are available:

• Florence eBinders with PHI: Requires an executed UCLA HealthLink Electronic Health Record and Florence eBinders (Including PHI) Access Participation Agreement, coordinated through Clinical Trials Contracts & Strategic Relations (CTC-SR).
• Florence eBinders without PHI: Does not require the PHI access agreement but remains subject to applicable access application and training requirements.

Both options may be used for remote or on-site monitoring when permitted by study-specific consent and HIPAA authorization requirements.

All monitors and auditors must complete the required application and training before access can be provisioned.

4. Access Requests and Provisioning Timelines

Study teams should plan ahead when coordinating monitoring visits requiring HealthLink or Florence eBinders access.

• Allow 7–10 business days for access provisioning following submission of a complete and accurate application and all required documentation.
• Incomplete applications will be returned and may delay access.
• Access requests must be submitted through the designated online application system rather than by email.
• Monitors and auditors will be provisioned only for studies identified in their applications.
• Applicable setup, provisioning, and on-site registration fees may apply.

Sponsors and CROs are strongly encouraged to establish the required access agreements during initial study contracting to minimize delays.

5. Access Duration and Study Team Responsibilities

As a reminder, HealthLink and Florence eBinders access is limited to the approved monitoring period and automatically terminates five days after provisioning unless a shorter period is established.

Study teams must ensure access is terminated earlier when a visit concludes ahead of schedule or access is no longer authorized or necessary.

HealthLink access must be renewed annually. Any violations of UCLA access or confidentiality requirements will result in immediate termination of access.

6. Monitoring Restrictions Based on Consent and HIPAA Authorization

For non-FDA-regulated studies, the availability of remote monitoring and access to PHI depends on the informed consent and HIPAA authorization obtained.

Studies operating under certain HIPAA authorization waivers may be restricted to on-site review, and monitors or auditors may not be eligible for HealthLink or Florence eBinders access containing PHI.

Study teams should review these requirements before scheduling monitoring visits.

What Research Teams Should Do

Research teams should review the updated policy and incorporate the requirements into their monitoring procedures beginning January 1, 2027.

In particular, teams should ensure that external monitors and auditors understand the new on-site registration and visit notification requirements, allow sufficient time for access provisioning, and comply with UCLA's on-site privacy and security expectations.

Additional Information

The updated policy, application instructions, and additional guidance will be available through the CTSI Office of Regulatory Affairs.

ResearchGo: https://www.researchgo.ucla.edu/office-regulatory-affairs

Questions: CTSIORA@mednet.ucla.edu

UCLA Office of Clinical Research
CTSI Office of Regulatory Affairs