Where possible, sponsors should ensure that basic user access controls (e.g.,
identification (ID) code, username and password combination, or electronic thumbprints
and other biometrics) are implemented, as appropriate, for mobile technology used by
study participants in clinical investigations.
Specifically, for mobile apps that rely on study participants’ user entry, access controls
must be in place to ensure that entries come from the study participant (see 21 CFR
11.10(d)). For wearable biosensors and other portable electronic devices intended for a
single study participant to wear or use (e.g., small physiologic sensors with no display
screen), basic user access controls may be difficult to implement. In cases where access
controls are impractical, sponsors should consider obtaining a signed declaration from the
study participant confirming that the device will only be used by the study participant.
Basic user access controls are not necessary when using ingestible sensors and
implantable electronic devices.