Continuous at-home vitals streaming for a decentralized clinical trial — from wearable pairing to signal-derived safety alerts and CDISC-mapped eCRF data
Before a single vital sign reaches the trial database, a remote patient monitoring (RPM) arm has to solve a logistics and regulatory problem: get a validated, interoperable device into a participant's home, get informed consent captured to Part 11 standard, and confirm the device is actually recording trustworthy data — all without a site visit.
FDA's final guidance "Digital Health Technologies for Remote Data Acquisition in Clinical Investigations" (December 2023) requires sponsors to document two separate validation steps before a device's output can support an endpoint:
Verification: does the device measure the physical signal it claims to measure, under controlled bench conditions (accuracy, precision, sampling rate)?
Analytical validation: does the algorithm that turns raw sensor signal into a clinical metric (e.g., PPG waveform → SpO2, oscillometric cuff waveform → systolic/diastolic pressure) perform correctly across the target population — including skin tone, motion artifact, and arrhythmia edge cases?
Clinical validation: does the resulting metric actually correlate with the clinical outcome or state it is meant to represent, in the population under study?
Blood pressure cuffs used in DCTs are additionally expected to meet AAMI/ESH/ISO 81060-2:2018 validation criteria (mean difference ≤5 mmHg, SD ≤8 mmHg vs. auscultatory reference). Pulse oximeters are increasingly required to demonstrate accuracy across Fitzpatrick skin-tone categories following FDA's 2024 draft guidance update, prompted by documented occult hypoxemia under-detection in darker skin tones.
BYOD (bring-your-own-device) designs reduce kitting cost but complicate verification — the same nominal sensor (e.g., a phone PPG) behaves differently across hardware generations, so most Phase II/III DCTs still favor a single provisioned, locked-configuration device per arm.
eConsent platforms (Part 11-compliant e-signature, video-witnessed where required by the reviewing IRB/EC) let a participant review, question via synchronous video with study staff, and sign the ICF from home. Comprehension checks (embedded quiz items) are standard practice and are increasingly expected by central IRBs reviewing DCT protocols.
Once consented, the device is paired over Bluetooth Low Energy (BLE) to a study-issued gateway (a cellular hotspot or a locked-down tablet). A 72-hour baseline capture window establishes each participant's own reference range — critical because RPM anomaly detection in Stage 3 is typically personalized (within-subject control limits) rather than population-normed, since resting HR, baseline SpO2 and BP vary substantially between individuals.
Dropout at this stage is the leading driver of DCT attrition: incomplete pairing, gateway connectivity failures in rural broadband deserts, and consent comprehension barriers account for the majority of early discontinuations in published DCT feasibility reports.
Once paired, the RPM kit is expected to behave like a low-maintenance, always-on instrument: it samples, buffers through connectivity gaps, timestamps to a trusted clock, and hands off standardized records to the sponsor's cloud ingestion layer without requiring the participant to do anything beyond wearing the device.
A typical RPM stack layers three standards to move a raw waveform into a queryable clinical record:
1. Device layer — ISO/IEEE 11073 Personal Health Data (PHD) profiles define standardized BLE GATT services for specific device classes (blood pressure monitor, pulse oximeter, weighing scale, glucose meter), so a conformant cuff and a conformant gateway can interoperate without vendor-specific drivers.
2. Transport layer — the gateway packages readings as HL7 FHIR R4 Observation resources (using the Vital Signs profile: LOINC-coded systolic/diastolic BP, heart rate, SpO2, body temperature) and posts them over TLS 1.2+ to the sponsor's ingestion API, typically with mutual-auth device certificates issued at kitting time.
3. Ingestion layer — a cloud pipeline (commonly built on FHIR-native data stores) timestamps against an NTP-synced trusted clock, deduplicates retried packets, and writes to a raw immutable store before any signal processing occurs — preserving source data for audit per ALCOA+ principles (Attributable, Legible, Contemporaneous, Original, Accurate, plus Complete/Consistent/Enduring/Available).
Continuous streams (single-lead ECG at 250–500 Hz, PPG at 25–100 Hz) generate far higher data volume than spot-check vitals — a single participant's ECG patch can produce >150 MB/day, so most protocols stream derived summary metrics (HR trend, arrhythmia burden, RR-interval variability) continuously while retaining raw waveform snippets only around flagged events.
Home broadband and rural cellular coverage are not guaranteed, so devices and gateways buffer locally (typically 24–48 hours of raw samples on-device, longer on the gateway) and resynchronize automatically on reconnect, tagging each record with both a device-generated timestamp and a server-received timestamp so gaps and backfills are auditable rather than silently interpolated.
Data completeness — the fraction of protocol-scheduled measurement windows with a valid recorded value — is tracked as a first-class operational metric (rather than only at database lock) precisely because sparse or systematically missing data from a subgroup of participants (e.g., those with poor connectivity) can introduce informative missingness bias into safety and efficacy analyses. TransCelerate's eSource and RBM initiatives recommend dashboards that flag any participant falling below a completeness threshold (commonly 80%) for proactive outreach well before the missingness compromises the analysis population.
Raw vitals streams are noisy: motion artifact, poor sensor contact, and normal physiological variability all masquerade as clinically meaningful change. The signal-processing layer has to separate that noise from genuine deterioration signals reliably enough to trigger a human review — without flooding site staff with false alarms.
Before any threshold is applied, incoming samples pass through artifact rejection: accelerometer-derived motion flags suppress PPG-based SpO2/HR readings during movement (a major source of spurious desaturation alarms), and oscillometric BP readings failing cuff-fit or motion QC are discarded rather than scored.
Surviving samples are scored two ways in parallel:
Statistical process control (SPC): an Exponentially Weighted Moving Average (EWMA) with smoothing constant λ≈0.2 is computed per participant per vital sign, using the Stage-1 baseline window to set initial control limits (typically ±3 within-subject SDs, following Western Electric run-rule conventions adapted from manufacturing SPC). This personalizes sensitivity to each participant's own physiology rather than a fixed population cutoff.
Composite early-warning score: many cardiovascular and post-surgical DCTs adapt the NHS NEWS2 framework (respiration rate, SpO2, temperature, systolic BP, heart rate, consciousness) into a remote-monitoring composite, weighting the vitals actually captured by the kit and re-deriving cut-points to preserve sensitivity for deterioration while controlling for the reduced parameter set available at home.
Arrhythmia-specific detection (AF burden, ectopy count) on single-lead ECG typically uses a trained deep-learning classifier rather than threshold rules — the architecture and validation approach popularized by large-scale PPG/ECG screening studies now underpins many trial-grade RPM arrhythmia modules.
Every anomaly detector trades sensitivity against alert fatigue. The landmark Apple Heart Study (Perez et al., NEJM 2019; n=419,297) is the reference case for this trade-off in consumer-adjacent RPM: only 0.52% of participants received an irregular-pulse notification over the study period, and of those who returned an ECG patch, 84% of notifications were confirmed as atrial fibrillation on the reference device (positive predictive value 0.84) — demonstrating that a well-tuned PPG-based algorithm can achieve clinically useful precision at population scale, but also that the overwhelming majority of enrolled participants generate zero alerts, meaning detector tuning matters far more than raw sampling rate.
In trial operations, published RPM programs report that 30–40% of automatically generated alerts are dismissed on human review as artifact or non-actionable — a rate operations teams manage by tiering alerts (see Stage 4) rather than by simply raising thresholds, since raising thresholds directly trades away sensitivity for genuine safety signals.
The Apple Heart Study screened 419,297 participants using a PPG-based irregular rhythm algorithm and found a notification rate of only 0.52%, with 84% positive predictive value against a confirmatory ECG patch — the largest published dataset validating consumer-grade optical sensors for a specific arrhythmia detection task, and now a standard citation in DHT analytical-validation submissions to FDA.
An automated flag is not a diagnosis. Every excursion surfaced by the signal-processing layer enters a human-in-the-loop triage workflow that tiers urgency, routes to the right role under a protocol-defined SLA, and — where an adverse event is suspected — applies standardized causality and coding frameworks before anything reaches the safety database.
Alerts are stratified by severity and routed accordingly:
Routine — vitals outside the personalized control limit but within a clinically low-risk band; queued for review at the next scheduled data review, no immediate contact required.
Urgent — sustained excursion or a moderate composite-score elevation; site coordinator is pushed an in-app notification and SMS, with acknowledgment expected within a protocol-defined window (commonly 1–4 hours).
Critical — a hard safety threshold (e.g., SpO2 <88% sustained, new sustained tachyarrhythmia, systolic BP <80 or >200 mmHg) triggers an immediate push notification and, in many protocols, an automated welfare-check phone call script to the participant in parallel with site notification — critical-alert acknowledgment SLAs of under 15 minutes are typical in cardiovascular and oncology RPM protocols.
Each acknowledgment, timestamp, and disposition (false alarm / clinically insignificant / requires participant contact / reportable adverse event) is logged immutably, since regulators reviewing DCT inspection findings specifically look for evidence that the alert-to-action chain was followed as designed, not just that the alert fired.
When triage concludes an alert reflects a genuine adverse event rather than artifact, standard pharmacovigilance machinery takes over even though the signal originated from a sensor rather than a clinic visit:
• MedDRA coding: the clinical description (e.g., "new-onset atrial fibrillation detected on ambulatory ECG patch") is mapped to a MedDRA Preferred Term and System Organ Class for consistent aggregation across sites and, eventually, across the safety database.
• WHO-UMC causality assessment: the PI (or delegated qualified physician) assigns one of six categories — certain, probable/likely, possible, unlikely, conditional/unclassified, unassessable/unclassifiable — based on temporal relationship to study drug, dechallenge/rechallenge information, and plausible alternative explanations. Device-detected events pose a specific wrinkle: a false-positive algorithm output is not an adverse event at all, so the very first triage step is confirming the physiological event actually occurred before causality is even considered.
• ICH E2B(R3) transmission: confirmed serious adverse events are formatted as an Individual Case Safety Report (ICSR) and can flow onward to FDA FAERS or EMA EudraVigilance on the same regulatory timelines (15 days for expedited serious/unexpected events) as any clinic-detected AE — the remote origin of the data does not relax reporting obligations.
A continuous vitals stream is not, by itself, an analyzable clinical dataset. The final stage of the RPM pipeline aggregates raw and event-level data into periodic summary records, maps them into standardized submission-ready domains, reconciles them against the EDC, and feeds a central statistical monitoring program that increasingly replaces a large share of traditional on-site source data verification.
Regulatory submission datasets do not carry raw 250 Hz waveforms — they carry structured, timestamped observations mapped to the CDISC Study Data Tabulation Model (SDTM):
• VS (Vital Signs) domain: periodic summary statistics derived from the continuous stream — e.g., hourly mean/min/max heart rate and SpO2, once-daily representative blood pressure reading selected by protocol-defined rule (first stable reading in a morning window) — populate VSTESTCD-coded rows, not the raw waveform itself.
• EG (ECG Test Results) domain: arrhythmia burden metrics, QTc where derivable, and physician-overread annotations from flagged single-lead ECG episodes.
• DV (Protocol Deviations) domain: gaps in required monitoring windows, device non-compliance below the pre-specified adherence threshold, and missed triage SLAs are logged as deviations, since under ICH E6(R2)/(R3) a systematic RPM data-quality failure is itself a protocol deviation requiring root-cause and CAPA documentation.
Raw waveform data around flagged safety events is typically retained separately as auditable source in the eSource repository, cross-referenced by a persistent record ID, so any adjudicated event can be traced back to the original sensor trace years later during inspection.
ICH E6(R2) §5.18.3 (and its expansion in the finalized ICH E6(R3), formally adopted in 2025) explicitly endorses centralized statistical monitoring as an alternative — not merely a supplement — to routine 100% on-site source data verification, provided the sponsor can demonstrate the central approach detects data quality and safety issues at least as effectively.
For an RPM-heavy DCT, central monitoring dashboards continuously compute:
• Site-level and participant-level data completeness against the 80% target, flagging outliers for query before they threaten the analysis population.
• Statistical outlier detection across sites (a site with an implausibly low alert rate may indicate device mis-configuration or under-reporting, not healthier participants).
• RPM–EDC reconciliation — automated matching between the RPM cloud database and the site-facing EDC (e.g., Medidata Rave, Veeva Vault) typically auto-resolves 97–98% of records, with the remainder routed as manual data management queries.
Sponsors report on the order of a 50–60% reduction in on-site monitoring visit volume when a mature RPM and central-statistical-monitoring program is in place, redirecting CRA effort toward the sites and participants the risk model actually flags — the operational payoff that justifies the upfront cost of standing up the device, streaming, and detection pipeline described in Stages 1–4.
FDA's May 2023 draft guidance "Decentralized Clinical Trials for Drugs, Biological Products, and Devices" and EMA's December 2022 "Recommendation Paper on Decentralised Elements in Clinical Trials" both converged on the same principle later codified in ICH E6(R3): a decentralized element — including RPM — is acceptable exactly to the extent the sponsor can show it preserves data quality, participant safety oversight, and source-data traceability at parity with a site-based visit, not merely that it is more convenient.