SOP: Device Provisioning and De-Provisioning for Decentralized Trial Participants

This is a ready-to-use SOP for the device lifecycle behind ePRO, eCOA, eConsent, and sensor data collection in a decentralized or hybrid trial. Replace every <<FILL: ...>> placeholder, set your document numbers and dates, and route it through your normal document control, review, and approval. A worked filled specimen follows. Verify each cited regulation against the current source before you rely on it. This is general educational reference content, not legal or regulatory advice.

Document control header

1. Purpose

This procedure defines how <<FILL: COMPANY NAME>> provisions and de-provisions devices used for decentralized trial data collection, sponsor-supplied hardware and bring-your-own-device (BYOD) application access alike, so that every device is traceably paired to one participant at a time, attribution and data integrity are preserved across the device’s lifecycle, and no participant’s data or credentials survive on a device reissued to someone else.

2. Scope

This procedure applies to any device used to run eConsent, ePRO/eCOA, or connected-sensor applications in a decentralized or hybrid trial activity, whether sponsor-supplied or participant-owned. It covers initial provisioning, in-study device exchange, and end-of-study, withdrawal, or site-closure de-provisioning. It does not replace the system validation that qualifies the application itself (see <<FILL: cross-reference to the eConsent/ePRO validation protocols>>), nor the general IT asset management procedure for non-study sponsor hardware.

3. Responsibilities

4. Definitions

• Provisioning: the controlled process of configuring a device (or authorizing a BYOD application instance) and binding it to one named participant before use.
• De-provisioning: the controlled process of removing a device or BYOD application from active use and, for sponsor-supplied hardware, confirming it has been returned to a clean state before reissue.
• Device pairing record: the record mapping a specific device or application instance to a specific participant, with provisioning and de-provisioning dates.
• Wipe: a verified reset of a sponsor-supplied device to a clean configuration state, removing all prior participant data, credentials, and cached content, distinct from merely initiating a reset.

5. Procedure

5.1 Provisioning a sponsor-supplied device

1. Confirm the device is loaded with the correct, locked study build (no app-store access, no notifications unrelated to the study that could interrupt a diary or consent window).
2. Confirm the language and site configuration match the participant’s consented site and language.
3. Verify connectivity before shipment or in-person handoff.
4. Record the device serial number against the participant ID in the device pairing record (section 8).
5. Document the shipment or handoff, including a signature or carrier tracking reference.
6. Deliver device-use training to the participant and document that training occurred.

5.2 Provisioning BYOD access

1. Confirm the participant’s own device meets the supported configuration matrix defined in the system’s validation (operating system, version, screen size).
2. Install or authorize the application per the vendor’s instructions; where the device sits outside the tested matrix, provision a sponsor-supplied device instead rather than making an untested exception.
3. Where risk warrants, perform a first-use rendering spot-check against the validated reference.
4. Bind the application account to the participant ID and record the device model and operating system version in the pairing record.

5.3 In-study device exchange

1. Before deactivating a device being replaced (loss, damage, or upgrade), confirm all pending entries have synced and reconciled.
2. Issue the replacement device or re-authorize the BYOD application and re-pair it to the same participant ID.
3. Log the retired device or access instance against the participant’s record rather than opening a blank new record, so the audit history carries across the exchange.

5.4 De-provisioning at end of study, withdrawal, or site closure

1. Confirm all pending entries are synced and reconciled before deactivation.
2. Revoke application access and any associated data plan or credential.
3. For sponsor-supplied hardware: perform the validated wipe procedure and verify completion, not merely initiation, before the device re-enters inventory for reissue.
4. For BYOD: confirm no sponsor data remains cached outside the application’s own sandbox, and confirm the participant received instructions on removing the application.
5. Update the device pairing record with the deactivation or return date and, for sponsor hardware, the verified-wipe confirmation.

6. Acceptance criteria

• Every device or BYOD access instance has a complete pairing record from provisioning through de-provisioning, with no gap.
• No sponsor-supplied device is reissued without a verified wipe on file.
• No data is lost across an in-study device exchange; the audit history carries across the exchange rather than resetting.
• De-provisioning triggered by withdrawal or study end is completed within <<FILL: number>> business days of the triggering event.

7. Records generated

Retain per the records retention schedule, not less than <<FILL: retention period>>.

8. References

21 CFR Part 11, 11.10(g) and 11.300, authority checks and access controls. ALCOA+ attribution and consistency principles as applied to device-to-participant pairing. ICH E6(R3) Annex 2, sponsor and investigator oversight of activities and tools used outside the traditional site setting.

Confirm the current version and clause numbers of each reference before issue.

9. Revision history

10. Approvals

Filled specimen

The following shows the pairing record across one device’s lifecycle for an example ePRO study. Illustrative only.

Device SPT-00412 was later reissued to a different participant in a second study only after the wipe was independently verified, not merely logged as “reset sent,” which is the step that actually prevents a residual-data finding.

Common inspection findings this SOP prevents

• A sponsor-supplied device reissued to a new participant with no evidence the prior participant’s data and credentials were removed.
• A device exchange that lost or orphaned pending entries because nothing confirmed sync before deactivation.
• BYOD access left active weeks after a participant withdrew, because no de-provisioning trigger was defined for BYOD the way it was for sponsor hardware.
• A pairing record with gaps between provisioning and de-provisioning, making the device’s full history unreconstructable.

How to adapt this SOP

1. Set your document number, owner, and effective date in the header.
2. Point section 5.2’s device matrix reference to your actual validated BYOD configuration list.
3. Set the de-provisioning timeline in section 6 to match your program’s withdrawal-handling procedure.
4. Confirm every regulation in section 8 against the current published version before issue.