What this is, and who it is for
The principal investigator answers for the data of their site, and says so with an electronic signature: on a form record (which then locks), and, when the version asks for it, on a whole visit and on a participant's whole casebook. A signature records who signed, what they signed (a fingerprint of the exact values), when, and what they meant by it. It is the same primitive the version sign-offs, the delegations and the database lock use.
| You need | To |
|---|---|
signature.sign (the principal investigator) | Sign a form record, a visit or a casebook |
subject.read, study read | See the signatures register |
Held by: Principal Investigator (signature.sign).
Where to find it
- On a participant's form screen: the signing bar under the form (Ready to sign? → Sign & lock).
- On a visit and on the participant's casebook, when the Live version asks for those signatures (Version settings → Signatures, off by default: Settings).
- The study's E-Signatures screen (the signatures register): Signatures — last 13 weeks, top signers, and a table with Signed, Signer, Meaning, What was signed, Status, filterable by whether the signature still stands, meaning, kind and signer, with a search by record or signer.
What you can do
Sign a form record
A form record can be signed when it is complete and not already locked; the investigator signs once the site has submitted it.
- Choose Sign & lock. The dialog Sign and lock record says You're signing {record}.
- Choose the Signature meaning: Reviewed and approved (approval), Data entry complete (authorship), Source data verified (review) or Authorized for lock (responsibility).
- Step-up re-authentication: the system e-mails a 6-digit code. Enter it (it is valid for this signature only).
- Type your name to affirm (case-insensitive; it must match the signed-in person).
- Confirm. The record is locked. The bar shows Locked, who signed and the meaning, and says: A signed value can be corrected only where someone else has raised a query on it. A correction withdraws this signature.
- The completed form the investigator is about to sign.
- Only the Principal Investigator signs.
Sign a visit or a casebook
Where the version asks for it. If something stands in the way, Sign & lock opens a dialog listing everything in the way and uses no signing code (Everything in the way is listed, and no signing code is used.), each with what to do:
- A visit (meaning responsibility) can be signed when every form the visit expects (required and in force; Binding a form to visits) has a complete record, the visit holds data, and no query on its records is unresolved.
- A participant’s casebook (meaning approval) can be signed when the participant has data, no query on any of their records (events included) is unresolved, and, if the version made visit signatures Required, every visit that holds data is signed.
A visit signature seals the visit and each form it holds (a fingerprint of the current values); a casebook signature seals the visits. A signature of a visit or casebook stands until a change to the data beneath it withdraws it. A version setting of Required blocks nothing by itself; it makes unsigned visits and casebooks appear in the database lock’s list (Close and lock a study).
When a signature is withdrawn
Changing a signed value (an authorized correction) withdraws the signature of the record, and of its visit and the participant's casebook if they were signed. The bar then shows Signature withdrawn, with who signed, the meaning, when it was withdrawn and why, and Sign again. The withdrawn signature stays in the register, struck through, with when and why; a signature is never edited or removed, only withdrawn.
Read the register
Open a signature for: Signature, Signed by, Signed at, Meaning, Identity check, the Values signed (as the record held them when it was signed) and, if withdrawn, Withdrawn and Replaced by.
Every option
Meanings
| Meaning | Shown as | Used for |
|---|---|---|
authorship | Data entry complete | A record's author attests the entry |
review | Source data verified | A reviewer attests verification |
approval | Reviewed and approved | The investigator approves a record or a casebook; the sponsor approves a version |
responsibility | Authorized for lock | The investigator takes responsibility for a visit; a lock is requested |
What is signed
The record types in the register are a form record, a visit, a casebook, a study version, a site delegation and a study-state request (lock, unlock). Each signature carries a SHA-256 fingerprint of what was signed; if the values change afterwards, the fingerprint no longer matches and the screen says This record's data has changed since it was signed (21 CFR 11.70). Do not rely on it — report it to your data manager. The discrepancy is recorded in the audit trail.
What the system records
signature.applied (signer, meaning, record, fingerprint, time), record.signed and record.locked, auth.stepup.verified for the code, signature.superseded and record.unsigned when a change withdraws one, record.integrity_failed if a fingerprint no longer matches. The register is append-only and protected by the database. See Audit events.
What you cannot do, and why
- Sign as anyone but yourself. The signer is the signed-in person; the name you type is checked against it.
- Sign without a fresh code, or reuse a code.
- Edit or delete a signature. It is only withdrawn, by a change.
- Sign an incomplete record, or one with something in the way.
- Sign if you are not the principal investigator (or hold
signature.sign).
Compliance Q&A
Yes. Each signature stores the printed name, the time and the meaning, is bound to a SHA-256 fingerprint of the signed values, can be neither edited nor deleted, and is shown with the record. The signer is the authenticated person, never a value sent by the caller.
Evidence: server/src/modules/study/signatures (immutable ledgerSHA-256 content hashsigner from the session)database triggersaudit events signature.applied
Each signature needs a one-time code sent to the signer's address, and the signer's typed name, in addition to the session already authenticated by a code.
Limits: both components are knowledge of a mailbox and of a name; there is no password, authenticator application or hardware key. If your policy needs a stronger second factor, it is not available in this release.
Evidence: client SignAndLockBar (code and typed name)server step-up verifier
Related
Correct data · Close and lock a study · Review the audit trail · Principal Investigator · Part 11 matrix