In these scenarios the FDA stresses access to electronic systems needs to be limited to authorized users, the authors of records need to be identifiable, and audit trails need to be available in order to track changes to data.

“If the clinical investigation site is using a system that does not contain the adequate controls previously described in the bulleted items, sponsors should consider the risks of employing such systems (e.g., the potential harm to research subjects, patient privacy rights, and data integrity of the clinical investigation and its regulatory implications)” the guidance reads.
The guidance also encourages organizations that maintain EHR for clinical purposes ensure the data is in structured, not unstructured.

Currently EHR technology certified under the ONC Health IT Certification Program has to meet selected privacy and security protection requirements for an individuals' health information.
In most instances, EHR, essentially electronic versions of the charts traditionally found in hospitals or doctor's offices, are subject to the HIPAA Privacy Rule. EHR data can include information on patients like their immunization status, any medication they take, radiology images, or their weight or age.

Like all guidance issued by the FDA, this document, “Use of Electronic Health Record Data in Clinical Investigations” (.PDF) is a recommendation and isn't considered binding. It does represent the federal agency's stance on the topic however.