# 2030 Dow Center

######## By E-Mail and Overnight Courier

July 8, 2004

Division of Dockets Management (HFA-305)

Food and Drug Administration

5630 Fishers Lane, Room 1061

Rockville, MD 20852

**Re: [Comments of The Dow Chemical Company on FDA's Notice of Public
Meeting on "Electronic Records, Electronic Signatures", ]{.underline}**

**[Docket No. 2004N-0133]{.underline}**

Dear Sir or Madam:

Attached for filing in these dockets are the comments of The Dow
Chemical Company on the notice of public meeting published at 69 Fed.
Reg. 18591 (Apr. 8, 2004).

Sincerely,

Mark Duvall

Managing Counsel

The Dow Chemical Company

Telephone: (989) 638-4980

Fax: (989) 638-9636

E-mail: <mnduvall@dow.com>

Attachment

### Before the Food and Drug Administration

### Comments of

**The Dow Chemical Company**

**on**

# **FDA's Notice of Public Meeting,**

**"Electronic Records; Electronic Signatures",**

**68 Fed. Reg. 18591 (Apr. 8, 2004)**

**Docket No. 2004N-0133**

######### July 8, 2004

**TABLE OF CONTENTS**

##### Page

Introduction 1

Executive Summary 1

Discussion 3

I. Part 11 Needs Significant Revisions 3

1.  FDA Should Delete the Validation Requirements From Part 11 3

2.  FDA Should Allow Regulated Entities to Determine the Need for

Audit Trails 4

3.  Part 11 Should Permit Conversion of Electronic Records Into Other
    Media During the Record Retention Period 5

```{=html}
<!-- -->
```
a.  The Prohibition on Conversion Is Technologically Infeasible 6

b.  The Federal Government Has Been Unable to Find a Solution 7

c.  Part 11 Calls for Infeasible Actions 9

d.  Predicate Rules Allow Conversion of Electronic Records 10

```{=html}
<!-- -->
```
4.  Part 11 Should Not Apply to Legacy Systems Modified Since 1997 10

5.  FDA Should Clarify That Part 11's Recordkeeping Provisions Do

> Not Apply to API or Excipient Manufacturing 12

II\. FDA Should Reexamine Part 11 for Several Reasons 13

1.  The Part 11 Recordkeeping Provisions Are Not Voluntary, Contrary to

> How FDA Described the Rule 14
>
> 2\. The Part 11 Recordkeeping Provisions Apply to Thousands of
> Regulated

Facilities, Not to 100 Facilities as Originally Assumed 16

> 3\. The Costs of the Recordkeeping Provisions As Currently Written Are
>
> Prohibitive 17
>
> a\. FDA Estimated That Recordkeeping Compliance Costs
>
> Would Be Trivial Because It Understood That Industry Had
>
> Already Implemented the Part 11 Requirements 17
>
> b\. Industry Cost Estimates Exceed \$2 Billion, Comparable to the Cost
> of Y2K Compliance 18
>
> c\. Audit Trail Costs Are a Large Component of the Costs 20
>
> d\. The Searchability Requirement Also Adds Costs 21

4.  Summary 21

III\. FDA Should Revise Part 11 to Make It Risk-Based 22

1.  FDA Has Not Justified the Need for Stringent Anti-Fraud

> Provisions 22

2.  FDA Did Not Conduct a Risk Assessment or Cost-Benefit

> Analysis of Risk Controls 23

3.  FDA's Determination That Stringent Anti-Fraud Provisions Are
    Necessary to Ensure Reliability Conflicts With Judicial Experience
    Accepting Electronic Records as Reliable Evidence 25

IV\. FDA Should Consider How Other Federal Agencies Have Regulated

Electronic Recordkeeping 26

1.  Experience From Other Federal Agencies 26

2.  EPA -- CROMERRR 27

3.  Treasury Department -- Federal Payments and Collections 28

4.  IRS -- Electronic Recordkeeping 28

5.  Department of Labor -- ERISA Records 29

6.  Pension Benefit Guaranty Corporation 30

7.  Securities & Exchange Commission 31

8.  Nuclear Regulatory Commission 32

9.  HHS -- HIPAA Security Rule 33

10. FDA Should Consider the Option of Revoking Part 11 34

V. FDA Should Revise Part 11 Through Rulemaking 35

Conclusion 35

**[INTRODUCTION]{.underline}**

The Dow Chemical Company ("Dow") welcomes the opportunity to comment on
FDA's notice of public meeting on "Electronic Records; Electronic
Signatures" issued in April 2004.[^1] Dow is a global manufacturer of
chemicals and plastics with many facilities that are subject to FDA
recordkeeping requirements. Dow is affected by 21 CFR Part 11. Among
other things, Dow manufactures active pharmaceutical ingredients
("APIs"), conducts non-clinical studies subject to FDA's good laboratory
practice standards ("GLPs"), and sponsors clinical trials. Dow filed
extensive comments on FDA's draft Part 11 guidance in April 2003[^2] and
also submitted a statement for the Part 11 public meeting scheduled for
June 11, 2004 that was cancelled.[^3]

## EXECUTIVE SUMMARY

Dow strongly supports FDA's consideration of rulemaking to amend Part
11. That regulation has proven to be extraordinarily costly. It has
resulted in delayed investment in electronic systems that could provide
increased operational efficiency, product quality, and overall safety.
Thus, the rule has stifled innovation and efficiency by its
one-size-fits-all approach instead of a risk-based approach. Dow
encourages FDA to go beyond the enforcement positions adopted in the
September 2003 Part 11 Guidance Document[^4] and to revise the entire
rule.

In particular, Dow believes that FDA should make the following changes
to Part 11:

1.  FDA should delete the Part 11 validation requirement because it
    duplicates provisions in predicate rules. No other federal agency
    has adopted validation requirements for electronic recordkeeping and
    reporting.

2.  FDA should allow regulated entities to determine whether audit
    trails are needed, as HHS does in the HIPAA security rule. Few other
    agencies require audit controls, and those that do have very limited
    requirements.

3.  Part 11 should permit conversion of electronic records into other
    media. This would be consistent with FDA's current good
    manufacturing practice ("cGMP") regulations. It would also redress
    very serious feasibility problems.

4.  Legacy systems that have been modified since 1997 should be exempt.
    The Part 11 Guidance Document helped by effectively exempting legacy
    systems, but that exemption effectively disappears if limited to
    legacy systems which have not been modified since 1997. Given Y2K,
    [all]{.underline} legacy systems still operating have been
    significantly modified since 1997. In light of the unavailability of
    compliant systems in the years following 1997, FDA's promise of
    clarifying guidance, and the passage of time, the legacy systems
    exemption should extend to some period of time after the
    promulgation of the new rule.

5.  FDA should clarify that API and excipient manufacturing is not
    subject to Part 11's recordkeeping provisions. Those provisions
    apply to "records in electronic form that are created, modified,
    maintained, archived, retrieved, or transmitted under any records
    requirements **set forth in agency regulations.**"[^5] API and
    excipient manufacturers are not generally subject to agency
    recordkeeping regulations on cGMPs, as are manufacturers of finished
    drugs and finished devices. Instead, they are regulated by the cGMP
    provisions of the Federal Food, Drug, and Cosmetic Act ("FFDCA") and
    guidance issued thereunder.

Dow believes that FDA should reexamine Part 11 from top to bottom,
because the underlying assumptions that led to Part 11's promulgation
were incorrect. Specifically:

1.  FDA adopted Part 11 with the understanding that electronic
    recordkeeping would be voluntary. In practice, however, electronic
    recordkeeping is unavoidable and thus, in effect, Part 11 is
    mandatory. FDA decided not to conduct several analyses otherwise
    required because of the faulty assumption that regulated entities
    could choose not to keep required records electronically.

2.  FDA anticipated that Part 11 would apply to no more than 100
    entities. It now estimates that 4,500 entities are subject to
    Part 11. Even that estimate may be low. A rule appropriate for 100
    entities has proven to be inappropriate when applied to thousands of
    entities.

3.  FDA believed that the cost of Part 11 would be trivial, in that
    regulated entities already met virtually all Part 11 requirements as
    of 1997. As a result, FDA did not even conduct a cost-benefit
    analysis for the rule. Experience has shown instead that Part 11 has
    cost the pharmaceutical industry alone over \$2 billion, with more
    costs still to be incurred. This is a crushing economic burden that
    far exceeds whatever benefits arise from compliance. The cost of
    Part 11 stifles innovation and efficiency that increase safety and
    quality, thus actually hindering the intended advancement of public
    health.

Further, Dow supports revision of all of Part 11 to make it risk-based,
for these reasons:

1.  FDA explained the need for Part 11 as a defense against fraud, but
    FDA never justified that asserted need through a risk assessment.
    Instead, it adopted a one-size-fits-all rule applicable to all
    required records kept in electronic form, regardless of their
    criticality.

2.  The Government Paperwork Elimination Act and implementing OMB
    guidance direct FDA and other federal agencies to conduct risk
    assessments and cost-benefit analyses in regulating electronic
    recordkeeping. FDA has performed neither analysis for Part 11. OMB
    and Justice Department guidance indicate that such analyses often
    show that the risk of fraud in electronic recordkeeping is actually
    quite low in many cases.

3.  While FDA maintained that Part 11 compliance was crucial to
    assurance that electronic records are reliable, judicial experience
    has shown in both civil and criminal cases that electronic records
    are sufficiently reliable even without anti-fraud provisions such as
    those of Part 11.

Part 11 was an early foray by a federal agency into the regulation of
electronic recordkeeping. Since then, other federal agencies, including
those charged with responsibility for public health, have addressed
electronic recordkeeping through rules which are far less onerous. One
agency, EPA, explicitly drew on Part 11 in proposing its own rules on
electronic recordkeeping, only to abandon the effort in light of public
comment indicating that the agency had not justified either the need or
the cost of the rules. In revising Part 11, FDA should carefully
consider what provisions its sister agencies have concluded are
sufficient to assure the reliability of electronic records. FDA should
also consider revoking Part 11 entirely.

Finally, Dow supports FDA's determination to revise Part 11 through
rulemaking. Enforcement discretion to limit the scope of Part 11 is
helpful on a temporary basis, but Part 11 needs, and regulated entities
deserve, the more considered evaluation that comes with rulemaking.

**[DISCUSSION]{.underline}**

**I. [Part 11 Needs Significant Revisions.]{.underline}**

Dow welcomes FDA's consideration of rulemaking to revise Part 11. Dow
believes that FDA's review will establish that Part 11 should be revised
as explained below.

> **1. [FDA Should Delete the Validation Requirement From Part
> 11.]{.underline}**

Validation should not be kept as a Part 11 requirement. It is
duplicative of requirements in predicate rules.

Validation asks whether uncompromised records are accurate and reliable.
While that is a legitimate agency concern, predicate rules, such as
those on cGMPs, already require validation.[^6] Repeating validation
requirements in Part 11 is duplicative and unnecessary.

Moreover, the validation requirement in Part 11 goes far beyond any
validation requirements for paper records (except to the extent that
they are generated by electronic means). The purpose statement for Part
11 reads:

> The regulations in this part set forth the criteria under which the
> agency considers electronic records**,** electronic signatures, and
> handwritten signatures executed to electronic records to be
> trustworthy, reliable, and **generally equivalent to paper** records
> and handwritten signatures executed on paper.[^7]

In adopting the validation provision of Part 11, FDA explained:

> The agency intends to apply the same validation concepts and standards
> to electronic records and electronic signature systems as it does to
> paper systems.[^8]

Yet FDA regards paper records as essentially self-validating. They are
not subject to the validation requirement in Part 11 or the
computer-related provisions of the cGMP requirements. Thus, the Part 11
validation requirement runs contrary to the stated purpose of Part 11.

Significantly, as shown below, not one other agency regulation on
electronic recordkeeping addresses validation. Even EPA's now-abandoned
CROMERRR recordkeeping provisions did not address validation.[^9] FDA
should delete Part 11's validation requirements.

**2. [FDA Should Allow Regulated Entities to Determine the Need for
Audit Trails.]{.underline}**

One of the most expensive aspects of Part 11 is the requirement for
computer-generated audit trails. The reason for this is that, aside from
Part 11 compliance, the marketplace does not see sufficient value in
that electronic capability to justify the cost. Some vendors have
offered computer-generated audit trail capability, at a significant
cost, to facilitate Part 11 compliance. But those packages must be
integrated with existing systems at an even greater cost. The need to
store metadata generated by audit trails is yet another substantial
cost.

Part 11 applies the audit trail requirement to all records required by
predicate rules, regardless of their criticality or the risk of fraud.
FDA should limit the audit trail requirement only to those situations
where the regulated entity determines that risk and cost-benefit
considerations justify such a stringent control.

Regulated entities have kept required records electronically for over 20
years without notable problems with fraud that an audit trail might
catch. Even in the intensely regulated context of GLPs, FDA does not
mandate a computer-generated, time-stamped audit trail:

> In automated data collection systems, the individual responsible for
> direct data input shall be identified at the time of data input. Any
> change in automated data entries shall be made so as not to obscure
> the original entry, shall indicate the reason for change, shall be
> dated, and the responsible individual shall be identified.[^10]

# Manual audit trails are acceptable under this provision of Part 58.

# As discussed below, most federal agencies with electronic recordkeeping requirements do not require an audit trail of any kind. One exception is a Securities & Exchange Commission ("SEC") rule for broker-dealers that was a adopted at the same time as Part 11; later SEC rules on electronic recordkeeping are much more flexible.[^11] Of note is that FDA's parent agency, the Department of Health and Human Services ("HHS"), recently allowed regulated entities to decide for themselves whether audit controls are justified. The Health Insurance Portability and Accountability Act of 1996 ("HIPAA") explicitly directed HHS to consider "the value of audit trails in computerized record systems" in drafting its HIPAA Security Rule.[^12] The Security Rule requires audit controls, but the audit controls need not be electronic. A covered entity must:

Implement hardware, software, and/or procedural mechanisms that record
and examine activity in information systems that contain or use
electronic protected health information.[^13]

The preamble explains that how covered entities are to implement this
flexible requirement depends in part on risk considerations:

We support the use of a risk assessment and risk analysis to determine
how intensive any audit control function should be.[^14]

In contrast, Part 11 does require computer-generated audit trails, and
for all required records.[^15]

FDA should follow the lead of HHS in providing important flexibility to
regulated entities with respect to audit trails. FDA should allow
regulated entities to determine through a risk assessment and
cost-benefit analysis whether audit trails of any kind, and
computer-generated audit trails in particular, are justified.

**3. [Part 11 Should Permit Conversion of Electronic Records Into Other
Media During the Record Retention Period.]{.underline}**

A major technological feasibility problem of Part 11 is the current
requirement to retain electronic records in electronic format, along
with their audit trail metadata, until the end of the record retention
period.[^16] The record retention period can last for many years, during
which time hardware and software systems become outdated. Either
antiquated systems must be maintained as operational long after their
useful lives, or electronic records must be converted to newer versions
of hardware and software, with the data loss that such conversion
inevitably entails (and which Part 11 prohibits). FDA should revise Part
11 to allow conversion of electronic records into other media (e.g.,
paper, microfiche) during the record retention period, at which point
regulated entities should be able to delete the electronic versions,
along with their audit trail metadata.

> **a. [The Prohibition on Conversion Is Technologically
> Infeasible.]{.underline}**

In many cases it may not be technically feasible to meet the Part 11
maintenance requirement. In others the cost may be economically
infeasible. Some of the reasons are explained in a *Scientific American*
article[^17] cited by the Justice Department in a guide to federal
agencies on implementing electronic processes.[^18]

The article first explains in laymen's terms that digital documents are
essentially programs in need of software to read them:

Digital information can be saved on any medium that is able to represent
the binary digits ("bits)" 0 and 1. We will call an intended, meaningful
sequence of bits, with no intervening spaces, punctuation, or
formatting, a bit stream . . . .

\[I\]nterpreting a bit stream depends on understanding its implicit
structure, which cannot be explicitly represented in the stream. A bit
stream that represents a sequence of alphabetical characters may consist
of fixed-length chunks ("bytes"), each representing a code for a single
character . . . . To extract the bytes from the bit stream, thereby
"parsing" the stream into its components, we must know the length of a
byte . . . .

Most files contain information that is meaningful solely to the software
that created them . . . . For convenience, we call such embedded
information---and all other aspects of a bit stream's representation,
including byte length, character code and structure---the encoding of a
document file. These files are essentially programs: instructions and
data that can be interpreted only by appropriate software. A file is not
a document in its own right---it merely describes a document that comes
into existence when the file is interpreted by the program that produced
it. Without this program (or equivalent software), the document is a
cryptic hostage of its own encoding . . . .

The only options are maintaining legacy systems or migrating the data.
The article identifies "serious shortcomings" with the idea of
maintaining legacy systems, related to both software and hardware:

\[To read old digital documents,\] we must save the programs that
generate our digital documents, as well as all the system software
required to run those programs. Although this task is monumental, it is
theoretically feasible.

Preserving software is not sufficient, however; hardware must also be
preserved:

How can we provide the hardware to run antiquated systems and
application software? A number of specialized museums and
"retro-computing" clubs are attempting to maintain computers in working
condition after they become obsolete. Despite a certain undeniable charm
born of its technological bravado, this method is ultimately futile. The
cost of repairing or replacing worn out components (and retaining the
expertise to do so) must inevitably outweigh the demand for any outmoded
computer.

Next, the article addresses the problems with migrating, or
"translating", data as software changes:

Is it necessary to run the specific program that created a document? In
some cases, similar software may at least partially be able to interpret
the file. Still, it is naive to think that the encoding of any
document---however natural it may seem to us---will remain readable by
future software for very long. Information technology continually
creates new schemes, which often abandon their predecessors instead of
subsuming them . . . .

Translating a document into successive short-term standards offers false
hope. Successive translation avoids the need for ultimate standards
\[which are not available now\], but each translation introduces new
losses . . . .

> Finally, translation suffers from a fatal flaw. Unlike English and
> ancient Greek, whose expressive power and semantics are roughly
> equivalent, digital documents are evolving so rapidly that shifts in
> the forms of documents must inevitably arise. New forms do not
> necessarily subsume their predecessors or provide compatibility with
> previous formats. Old documents cannot always be translated into
> unprecedented forms in meaningful ways, and translating a current file
> back into a previous form is often impossible. For example, many
> older, hierarchical databases were completely redesigned to fit the
> relational model, just as relational databases are now being
> restructured to fit emerging object-oriented models. Shifts of this
> kind make it difficult or meaningless to translate old documents into
> new standard forms.

If digital documents and their programs are to be saved, their migration
must not modify their bit streams, because programs and their files can
be corrupted by the slightest change . . . . Although bit streams can be
designed to be immune from any expected change, future migration may
introduce unexpected alterations. For example, aggressive data
compression may convert a bit stream into an approximation of itself,
precluding a precise reconstruction of the original. Similarly,
encryption makes it impossible to recover an original bit stream without
the decryption key.

The bottom line is that Part 11's archiving requirement, maintaining
digital documents without alteration, may be currently technologically
infeasible.

**b. [The Federal Government Has Been Unable to Find a
Solution.]{.underline}**

The federal government itself has been wrestling with the problem of how
to archive electronic records without data loss, and has been unable to
come up with a solution. FDA cannot reasonably expect regulated entities
to comply with the record maintenance requirement when the federal
government has been unable to do so after spending millions of dollars
trying.

A report for the National Archives and Records Administration ("NARA")
describes the current state of affairs:

**Government employees do not know how to solve the problem of
electronic records -- whether the electronic information they create
constitutes records and, if so, what to do with the records.**
Electronic files that qualify as records---particularly in the form of
e-mail, and also word processing and spreadsheet documents---are not
being kept at all as records in many cases and are frequently not being
scheduled. Employees lack guidance and knowledge concerning how to
identify electronic records and what to do with them once identified.
Technology tools for managing electronic records do not exist in most
agencies. The agency information technology environments have not been
designed to facilitate the retention and retrieval of electronic
records. Despite the growth of electronic media, agency records systems
are predominately in paper format rather than electronic. Virtually
every agency visited indicated that the official policy is that their
records will be maintained in paper format. Yet the agencies recognize
that most records are now created in an electronic environment---in
word-processing documents, spreadsheets, databases, and the like. The
predominate e-mail policy is to print out e-mails that are considered
records and to save the paper copies. The chief paradox of today's
Federal RM \[records management\] is the disconnect between paper and
electronic recordkeeping.[^19]

NARA itself has recognized the technological challenges:

Because long-term temporary and permanent electronically signed records
have greater longevity than typical software obsolescence cycles, it is
virtually certain that agencies will have to migrate those records to
newer versions of software to maintain access. The software migration
(as opposed to media migration) process may invalidate the digital
signature embedded in the record. This [may]{.underline} adversely
affect an agency's ability to recognize or enforce the legal rights
documented in those records.[^20]

The Government Accounting Office has referred to this problem:

The long-term preservation and retention of those electronic records is
also a challenge since providing continued access to archived records
over many generations of systems is difficult. The average life of a
typical software product is 2 to 5 years.[^21]

So has the Justice Department:

> Agencies should consider several factors related to the accessibility
> of electronic records. First, computer technology is rapidly changing
> and software and formatting standards may quickly become obsolete.
> Computer-stored data may become useless unless the agency can provide
> the continued capability with the older technologies or can accurately
> translate the document as more modern systems are implemented. Second,
> if in the future, an agency no longer has staff who are familiar and
> competent to work with the electronic processes necessary to read
> older data, such data could be functionally unavailable. Electronic
> files might be stored while encrypted by software or protected by
> passwords no longer available or remembered years later, unless steps
> are taken to preserve the software or passwords.[^22]

In proposing Part 11, FDA promised that "FDA will apply the principles
of the new rule to its own electronic documents."[^23] Dow is unaware
that FDA or any other federal agency has incorporated audit trails and
all the other provisions of Part 11 to its own electronic records.

In summary, the federal government itself is not archiving electronic
records electronically, nor has it solved the problem of how to do so
for extended periods without data loss. What the federal government has
been unable to achieve is unlikely to be feasible for the regulated
community.

**c. [Part 11 Calls for Infeasible Actions.]{.underline}**

Notwithstanding these feasibility concerns, the 1997 Part 11 preamble
did recognize that retention of obsolete systems may be necessary in
some circumstances:

> The agency does not expect persons to maintain obsolete and supplanted
> computer systems for the sole purpose of enabling FDA inspection.
> **However**, the agency does expect firms to maintain and have
> available for inspection documentation relevant to those systems, in
> terms of compliance with part 11, for as long as the electronic
> records are required by other relevant regulations. Persons should
> also be mindful of the need to keep appropriate computer systems that
> are capable of reading electronic records for as long as those records
> must be retained. **In some instances, this may mean retention of
> otherwise outdated and supplanted systems, especially where the old
> records cannot be converted to a form readable by the newer systems.**
> In most cases, however, FDA believes that where electronic records are
> **accurately and completely transcribed from one system to another**,
> it would not be necessary to maintain older systems.[^24]

As noted above, it is infeasible either to maintain obsolete hardware
and software solely for the purpose of Part 11 compliance, or to ensure
that records are "accurately and completely" transcribed from one
version of software to another. Thus, FDA has established an impossible
requirement to meet.

> **d. [Predicate Rules Allow Conversion of Electronic
> Records.]{.underline}**

Aside from Part 11, FDA regulations already allow required records to be
retained in any format. For example, Part 211 provides that "Records
required under this part may be retained either as original records or
as true copies".[^25] Similarly, FDA's GLPs define "raw data", which
must be retained for the retention period, to include:

####### any laboratory worksheets, records, memoranda, notes, or exact copies thereof 

> . . . . *Raw data* may include photographs, microfilm or microfiche
> copies, computer printouts . . . .[^26]

As noted below, no other federal agency requires electronic records to
be maintained in electronic form. On the contrary, many agencies
explicitly allow records to be kept in any format.

FDA should revise Part 11 to allow required records to be retained in
any format, even if at one point in their existence they are electronic.

**4. [Part 11 Should Not Apply to Legacy Systems Modified Since
1997.]{.underline}**

The 1997 preamble to Part 11 clarified that the rule does apply to
legacy systems:

\[T\]he agency is opposed to "grandfathering" existing systems because
such exemptions may perpetuate environments that provide opportunities
for record falsification and impair FDA's ability to protect and promote
public health.[^27]

Dow supports FDA's determination in the Part 11 Guidance Document that
Part 11 should not apply to legacy systems. FDA originally applied Part
11 to legacy systems in the expectation that:

because almost all of the rule's provisions reflect contemporary
security measures and controls . . . , most firms should have to make
few, if any, modifications to their systems . . . . The agency believes
that because the rule is flexible and reflects contemporary standards,
firms should have no difficulty in putting in place the needed systems
and controls.[^28]

That expectation explains why FDA made Part 11 effective only five
months after promulgation. Furthermore, FDA considered that Part 11 set
"minimal" standards and was, in any case, voluntary in nature, so that
application to legacy systems was not a significant issue:

The agency believes that the provisions of part 11 represent minimal
standards and that a general exemption for existing systems that do not
meet these provisions would be inappropriate . . . . The agency
emphasizes that these regulations do not require, but rather permit, the
use of electronic records and signatures. Firms not confident that their
electronic systems meet the minimal requirements of these regulations
are free to continue to use traditional signatures and paper documents
to meet recordkeeping requirements.[^29]

These considerations proved incorrect, and application of Part 11 to
legacy systems has proven to be tremendously difficult and costly.

Dow does not support triggering Part 11 either for new systems acquired
after the Part 11 effective date, August 20, 1997, or for legacy systems
modified after that date, as suggested in the Part 11 Guidance Document.
Most commercially available systems lacked audit trail capability and
other features required by Part 11 until recently. Even now, these
features are only being introduced sporadically; for example, Microsoft
Excel® still does not have an audit trail capability built in.

Moreover, in 1997 FDA announced that it would provide guidance that
could affect the implementation of Part 11:

However, to assist firms in meeting the provisions of this rule, FDA may
hold public meetings and publish more detailed guidance.[^30]

Yet FDA has been slow to issue guidance, and most of the guidance that
was issued has been withdrawn.[^31] Thus, many regulated entities
properly held off committing the huge resources necessary to acquire new
Part 11-compliant systems or retrofit their existing systems to meet
Part 11 until FDA clarified what it meant to be Part 11-compliant. The
Part 11 Guidance Document's radical departure from previous FDA guidance
justified that go-slow approach.

To apply Part 11 to legacy systems modified since 1997 is to remove the
legacy systems exception altogether. The effective date was some 28
months prior to January 1, 2000. Virtually every computer system then in
use world-wide was subsequently either shut down permanently or modified
to achieve Y2K compliance. Thus, ignoring even the many hardware and
software changes that have occurred since 1997, Y2K considerations alone
are enough to leave virtually no legacy systems unmodified since 1997.

FDA should make Part 11 applicable only to new systems acquired some
period of years after FDA clarifies or revises Part 11. That period of
years should be the time necessary for vendors and regulated entities to
incorporate the clarified or revised Part 11 requirements into their
systems. In the meantime, FDA should revise its enforcement discretion
on this point correspondingly.

> **5. [FDA Should Clarify That Part 11's Recordkeeping Provisions Do
> Not Apply to API or Excipient Manufacturing.]{.underline}**

Like other FDA statements, the Notice of Public Meeting suggests that
Part 11 applies to electronic records maintained by manufacturers of
APIs and excipients. While Part 11's electronic reporting provisions
apply to such manufacturers, its electronic recordkeeping provisions do
not apply to such records, because they are not required by any agency
regulations. They are required by the FFDCA, as indicated by FDA
guidance, but neither the FFDCA nor the guidance is an agency regulation
within the meaning of Part 11.

The Notice of Public Meeting stated:

> As noted in the part 11 guidance, the underlying requirements set
> forth in the Federal Food, Drug, and Cosmetic Act, the Public Health
> Service Act, and FDA regulations (other than part 11) are referred to
> as "predicate rules."[^32]

This is a misstatement of the text of Part 11's scope section:

> This part applies to records in electronic form that are created,
> modified, maintained, archived, retrieved, or transmitted, under any
> records requirements **set forth in agency regulations.** This part
> also applies to electronic records **submitted to** the agency under
> requirements of the Federal Food, Drug, and Cosmetic Act and the
> Public Health Service Act, even if such records are not specifically
> identified in agency regulations. However, this part does not apply to
> paper records that are, or have been, transmitted by electronic
> means.[^33]

The emphasized language limits the scope of Part 11 to those electronic
records required [by FDA regulations]{.underline} to be maintained, and
to electronic records [submitted to]{.underline} FDA under the FFDCA or
the PHS Act. FDA has defined the term "regulations" to mean:

> an agency rule of general or particular applicability and future
> effect issued under a law administered by the Commissioner or relating
> to administrative procedures. In accordance with § 10.90(a), each
> agency regulation will be published in the Federal Register and
> codified in the Code of Federal Regulations.[^34]

In contrast, the Notice of Public Meeting and the Part 11 Guidance
Document do not limit the scope of Part 11 in that manner. Instead, they
identify the FFDCA and the PHS Act as sources of recordkeeping
requirements subject to Part 11 independent of FDA regulations. As seen
from Part 11 itself, the FFDCA and the PHS Act trigger Part 11 only with
respect to electronic records submitted to FDA; they do not trigger Part
11 with respect to electronic records maintained by companies and not
submitted to FDA. Thus, for the electronic recordkeeping provisions of
Part 11, [all]{.underline} predicate rules must be published in the Code
of Federal Regulations.

This distinction relates directly to records maintained by manufacturers
of APIs and excipients. FDA has no regulations governing cGMPs
applicable to the manufacture of APIs and excipients. Part 211 governs
only "current good manufacturing practice for preparation of drug
products"[^35], i.e., finished dosage form pharmaceuticals.[^36] Thus,
there are no "agency regulations" to trigger Part 11 for records
maintained under cGMPs for the manufacture of APIs and excipients.[^37]

The Act itself does establish a general requirement to use cGMPs in
manufacturing APIs and excipients.[^38] FDA has issued detailed guidance
on the meaning of this statutory requirement with respect to the
manufacture of APIs.[^39] The guidance addresses electronic
recordkeeping.[^40] Nevertheless, that guidance is not an agency
regulation.[^41]

Accordingly, it is inappropriate for FDA to state that the Act and the
PHS Act count as predicate rules triggering Part 11 generally. They can
trigger Part 11 only with respect to electronic records submitted to
FDA. They cannot trigger Part 11 with respect to electronic records
maintained by API and excipient manufacturers pursuant to the Act's
requirement for cGMPs. The language in the Notice of Public Meeting and
the Part 11 Guidance Document impermissibly extends the scope of Part 11
beyond the limits established in Part 11 itself.

**II. [FDA Should Reexamine Part 11 for Several Reasons.]{.underline}**

Dow agrees with FDA's decision to reexamine Part 11. Part 11 needs to
become risk-based. Currently, it is a one-size-fits-all set of
requirements applicable to all electronic records required by predicate
rules, regardless of criticality or risk. The result is a crushing
economic burden. That burden stifles innovation, since it requires
allocation of scarce resources into controls where the risks addressed
by Part 11 are not likely to be significant, using means for which the
costs exceed the benefits by a wide margin. The result is less
investment in system upgrades that could contribute to public health.

As FDA continues its reexamination of Part 11, it should be aware of the
considerations set forth below. Those considerations argue in favor of a
thorough reevaluation of Part 11's costs and benefits, rather than
tinkering with just a few of its aspects. They show that when FDA
promulgated Part 11 back in 1997, it did so with mistaken assumptions
about the prevalence of electronic recordkeeping, the costs of
compliance, and its technological feasibility.

Accordingly, Dow strongly supports FDA's move to reexamine Part 11.
Numerous reasons support reexamination, including the following.

> **1. [The Part 11 Recordkeeping Provisions Are Not Voluntary, Contrary
> to How FDA Described the Rule.]{.underline}**

FDA promulgated Part 11 with the understanding that compliance would be
voluntary, in that regulated entities could choose whether or not to
submit documents to FDA electronically and choose whether or not to use
electronic recordkeeping in meeting FDA recordkeeping requirements. The
first understanding was correct; electronic submissions are voluntary,
as paper submissions remain a meaningful option. The second
understanding was incorrect, however. That misunderstanding has had
significant consequences. It led to the conclusion that Part 11 would
have no net costs to industry. It obviated the need for risk assessments
and cost-benefit analyses. As a consequence, Part 11 did not benefit
from such assessments and analyses, making them highly appropriate now.

Modern food, drug, and device manufacturing methods and laboratory
procedures essentially mandate the use of computers. The accuracy and
efficiency of computer equipment in manufacturing and laboratory
environments greatly exceed that of manual systems and greatly increase
the quality and safety of products produced. Accordingly, Part 11
applies to virtually all regulated entities subject to FDA recordkeeping
requirements.

The 1997 preamble to Part 11 emphasized that FDA considered Part 11 to
be voluntary:

> The use of electronic records as well as their submission to FDA is
> voluntary.[^42]
>
> The agency emphasizes that these regulations do not require, but
> rather permit, the use of electronic records and signatures. Firms not
> confident that their electronic systems meet the minimal requirements
> of these regulations are free to continue to use traditional
> signatures and paper documents to meet recordkeeping
> requirements.[^43]

This belief that Part 11 is voluntary led directly to the key conclusion
that Part 11 would impose [no]{.underline} net costs on regulated
entities, including small businesses:

The activities regulated by this rule are voluntary; no entity is
required by this rule to maintain or submit records electronically if it
does not wish to do so. Presumably, no firm (or other regulated entity)
will implement electronic recordkeeping unless the benefits to that firm
are expected to exceed any costs (including capital and maintenance
costs). **Thus, the industry will incur no net costs as a result of this
rule.**

> Based on the fact that the activities regulated by this rule are
> entirely voluntary and **will not have any net adverse effects** on
> small entities, the Commissioner of Food and Drugs certifies that
> **this rule will not have a significant economic impact** on a
> substantial number of small entities. Therefore, under the Regulatory
> Flexibility Act, no further regulatory flexibility analysis is
> required.
>
> . . . The Unfunded Mandates Reform Act requires that agencies prepare
> an assessment of anticipated costs and benefits before proposing any
> rule that may result in an annual expenditure by State, local and
> tribal governments, in the aggregate, or by the private sector, of
> \$100 million (adjusted annually for inflation) . . . . This rule does
> not impose any mandates on State, local, or tribal governments, **nor
> is it a significant regulatory action** under the Unfunded Mandates
> Reform Act.[^44]

Crucially, however, the Part 11 recordkeeping provisions are not
voluntary in any meaningful sense; rather, in effect they are mandatory.
Accordingly, decisions based on the understanding that the recordkeeping
provisions would be voluntary are flawed.

The mandatory nature of the recordkeeping provisions flows directly from
the definition of the key term, "electronic record":

> *Electronic record* means any combination of text, graphics, data,
> audio, pictorial, or other information representation in digital form
> that is created, modified, maintained, archived, retrieved or
> distributed by a computer system.[^45]

The word "or" clarifies that any of the listed actions is sufficient to
make digital information be classified as an electronic record. The
implications of this definition include the following:

-   Printing out electronic records does not affect their continued
    status as electronic records if they are not only "created" but also
    "maintained" at some point in their existence. (The only exception
    is where computers are used essentially as manual typewriters or
    pens, i.e., without electronic maintenance capability.)[^46]

-   The recordkeeping provisions are not limited to final versions of
    documents, but also apply to "data" and "other information" even if
    preliminary in nature or if never organized into a "final" form.

The bottom line is that virtually any use of a computer to maintain
records required by FDA's predicate rules is enough to trigger the Part
11 electronic records provisions.

Furthermore, it is impossible to comply with many FDA recordkeeping
requirements without the use of computers. For example, modern drug
manufacturing requires the use of computers to control processes. Batch
records may be created and maintained electronically. Even if such
records are sometimes printed out, as a practical matter drug
manufacturers often must maintain those records electronically for them
to be useful. Similarly, modern analytical instruments, used for quality
control laboratories as part of cGMPs or for nonclinical studies
conducted under GLPs, are electronic in nature. They generate large
amounts of data which, as a practical matter, often must be maintained
electronically, even if sometimes printed out. As the preamble to the
proposed rule stated back in 1994:

The agency is aware that automated systems are being used more
extensively in the various industries it regulates . . . . FDA
recognizes the importance of electronic records and their integration
into a variety of information efforts, such as manufacturing process
controls, materials resources controls, laboratory information systems,
clinical trial information systems, and electronic data interchange
activities. The agency is aware that some new technologies and
manufacturing methods require use of electronic records.[^47]

What was true a decade ago is even more true today; modern drug
manufacturing requires the use of electronic recordkeeping.

In considering its own proposed version of Part 11 in 2002, EPA
specifically solicited comments on current electronic recordkeeping
practices.[^48] In response, many regulated entities reported that
electronic recordkeeping is pervasive and they have no alternative but
to use computers to meet EPA recordkeeping requirements. Small
facilities as well as larger ones reported that they are dependent on
computers to comply with EPA requirements to keep records. The same
would be true with respect to regulated entities meeting FDA
recordkeeping requirements. When required by FDA predicate rules, such
digital data are, by definition, electronic records triggering the full
panoply of Part 11's recordkeeping requirements.

As a consequence, the "choice" to keep records electronically is
illusory. There is no choice. Regulated facilities cannot go back to
using only fountain pens, pencils, adding machines, and manual
typewriters. They must use computers to operate in today's advanced
technological environment. In doing so, they are subject to Part 11's
recordkeeping provisions. Those provisions cannot be classified as
anything other than mandatory.

Accordingly, FDA should have conducted the kinds of analyses appropriate
for mandatory regulations. It did not do so, and the current problems
with Part 11 are a direct result. FDA should conduct those analyses now
as a part of its reexamination of Part 11.

> **2. [The Part 11 Recordkeeping Provisions Apply to Thousands of
> Regulated Facilities, Not to 100 Facilities as Originally
> Assumed.]{.underline}**

The 1997 preamble to Part 11 estimated that a total of 100 recordkeepers
would be subject to the recordkeeping provisions for closed or open
systems.[^49] FDA has since raised that estimate by a factor of 45 to
4,500 recordkeepers.[^50] Even this number is likely to underestimate
the number of regulated facilities by a considerable factor.

A regulation that affects 4,500 or more entities is much different from
one that affects only 100. FDA should reexamine Part 11 in light of its
extensive reach, which was not considered previously.

> **3. [The Costs of the Recordkeeping Provisions As Currently Written
> Are Prohibitive.]{.underline}**

The Part 11 recordkeeping provisions are extraordinarily expensive. They
are on the order of Y2K compliance costs. This large investment in Part
11 compliance necessarily restricts the resources available for
innovation in drug and device development. In addition, the burdensome
cost for Part 11 compliance has deterred regulated entities from
investing in new equipment and systems that would be more accurate and
reliable, and thus increase the quality and safety of FDA-regulated
products. For example, some regulated entities have avoided use of
available LIMS systems for tracking laboratory data specifically because
of the costs of validating the LIMS systems and adding an audit trail
capability.

In order to avoid stifling innovation, FDA should reexamine the costs
and benefits of Part 11, and consider risk management alternatives.

> **a. [FDA Estimated That Recordkeeping Compliance Costs Would Be
> Trivial Because It Understood That Industry Had Already Implemented
> the Part 11 Requirements.]{.underline}**

The 1997 preamble to Part 11 did not estimate the costs of compliance.
It did, however, make several statements suggesting that the costs would
be trivial. It based that judgment on the understanding, incorrect
though it was, that few changes would be needed because regulated
entities had already implemented most or all of the requirements:

Furthermore, because **almost all of the rule's provisions reflect
contemporary security measures and controls** that respondents to the
ANPRM identified, **most firms should have to make few, if any,
modifications** to their systems . . . .

> The agency believes that because the rule is flexible and **reflects
> contemporary standards**, firms should have **no difficulty in putting
> in place the needed systems and controls**.[^51]

Presumably, no firm (or other regulated entity) will implement
electronic recordkeeping unless the benefits to that firm are expected
to exceed any costs (including capital and maintenance costs). Thus,
**the industry will incur no net** **costs** as a result of this
rule.[^52]

FDA continues to misjudge the costs of Part 11 compliance. Its most
recent Paperwork Reduction Act burden estimate for Part 11 asserts that
compliance requires just 20 hours per recordkeeper per year, for a total
of 270,000 hours.[^53] This estimate is seriously deficient, however. It
maintains that Part 11 compliance includes no capital costs or operating
or maintenance costs, which is certainly inaccurate. Moreover, the scope
of work covered by the estimate misses most activities subject to Part
11:

The burden created by the information collection provision of this
regulation is a one-time burden associated with the creation of standard
operating procedures, validation, and certification.[^54]

Part 11 involves far more than one-time creation of SOPs, validation,
and certification. Thus, FDA has not estimated the actual cost of Part
11 compliance.

> **b. [Industry Cost Estimates for Part 11 Compliance Exceed
> ]{.underline}**
>
> **[\$2 Billion, Comparable to the Cost of Y2K
> Compliance.]{.underline}**

Industry estimates of Part 11 compliance costs exceed \$2 billion. In
2002 the Pharmaceutical Research and Manufacturers Association ("PhRMA")
surveyed its membership about the cost to fully remediate all applicable
systems to come into Part 11 compliance, and its member companies
reported an aggregate figure of more than \$2.1 billion.[^55]

Another survey found costs totaling in excess of \$100 million per
company:

> Depending on the extent of legacy systems deployed, the impact of Part
> 11 could be **greater than the Y2k remediation effort**. Part 11
> establishes new requirements for legacy systems that were not
> explicitly defined as essential for regulatory compliance.
>
> In a recent survey conducted by Accenture concerning leading
> companies' approaches to Part 11 compliance, respondents place the
> total cost to become compliant with 21 CFR Part 11 at **about \$100+
> million**, with additional time and money slated for maintenance.[^56]

Earlier, PhRMA had reported to FDA:

> Although the Agency concluded that the Regulation will not have
> significant economic impact, PhRMA companies are estimating the
> financial impact to be **significantly higher than the cost of
> resolving any Y2K problems** . . . . In one case, **it cost \$600,000
> to bring a chromatography system into compliance**. There are hundreds
> of such systems that are bound by the Regulation. One large company
> has estimated that **archiving a complex electronic system would cost
> them in excess of ten million dollars** over the retention period. The
> cost to fully comply with the Regulation is expected to **exceed \$150
> million** for a large pharmaceutical company.[^57]
>
> Experience gained by both FDA and the pharmaceutical industry . . .
> since the introduction of 21 CFR Part 11 in 1997 has shown that the
> cost and complexity of achieving compliance is significantly greater
> than was originally anticipated. The cost to a major pharmaceutical
> company is now understood to be in excess of \$100M \[million\]. A
> number of key factors have contributed to this, including:

1.  Companies have large numbers of systems covered by the rule. In the
    case of pharmaceutical companies, this can comprise several hundred
    systems.

2.  The guidance provided by FDA has been ambiguous, leading to a
    variable approach to inspections and feedback.

3.  Systems are strongly interconnected so that changes made to a given
    system have broad implications requiring extensive testing and
    validation.

4.  Commercial software packages used in the industry often lack the
    functionality required by the regulation and it takes significant
    time for vendors to incorporate the required functionality into
    their products.

5.  Some of the technologies required are new and immature and it can
    take several years for these to be incorporated into major
    commercial products.

6.  The rapid pace of change of technology makes it difficult to provide
    secure long term archiving of data in electronic form.[^58]

A group of affected pharmaceutical companies similarly told FDA:

> \[T\]he extensive experience that has now been gained from attempting
> to implement \[Part 11\] within the regulated industries has
> highlighted a number of difficulties giving rise to significant costs
> and risks that may outweigh the benefits . . . . **Companies are
> investing millions of dollars in "good faith efforts" to comply with
> the Regulation**.[^59]

One pharmaceutical company estimated its total Part 11 compliance costs
as exceeding \$214 million.[^60] Another gave an estimate of \$150
million in initial expenses and annual maintenance costs of \$30
million.[^61]

Why are the recordkeeping provisions so costly? Because they establish
requirements not previously defined as required for regulatory
compliance. As a result, current (legacy) systems, and most systems now
under development, lack the functionality that Part 11 requires.
Regulated facilities have to purchase, validate, implement, and train on
retrofitting solutions not designed for their systems, or purchase new
systems, at a cost on a scale of the Y2K effort. That has been
industry's experience with implementing Part 11:

> Compliance with the Regulation requires upgrading or replacing most
> current systems and, potentially, the introduction of new, and
> relatively unproved, technologies. Experience in the industry shows
> that change programs on this scale carry a significant degree of risk
> and expense . . . . Few companies would attempt to complete changes on
> this scale in less than 10-15 years. Attempting to accelerate this
> process would significantly increase the cost and level of risk.[^62]
>
> **c. [Audit Trail Costs Are a Large Component of the
> Costs.]{.underline}**

The audit trail requirement is particularly expensive. Part 11 requires,
among other things:

> Use of secure, computer-generated, time-stamped audit trails to
> independently record the date and time of operator entries and actions
> that create, modify, or delete electronic records.[^63]

Almost no software used in legacy systems generates such audit trails.
Accordingly, almost all software now used in connection with FDA
recordkeeping requirements needs to be either replaced with software
that does have an audit trail capability or supplemented with software
which adds system-wide audit trail capability. The software licensing
fees alone are extremely expensive. Even more expensive is the cost of
integrating and validating such new software in the myriads of
applications now in use.

An example is Microsoft Excel®. Excel is probably the leading software
for presenting and processing data. Microsoft Corporation has not built
into the software an audit trail capability, nor has it indicated any
interest in doing so in the future. Accordingly, either every regulated
facility that uses Excel in meeting FDA recordkeeping requirements would
have to stop using Excel, and buy, validate, train on, and then use
alternative software, or it would have to buy, validate, train on, and
then use additional software that purports to add an audit trail
capability for Excel.

Dow is aware of a single vendor that claims to have developed software
(for stand-alone computers only, not for networked implementations) that
will add an audit trail capability for Excel in order to help achieve
compliance with 21 CFR Part 11.[^64] Every user would have to test the
software extensively to ensure that it works in its applications. The
user would have to train its personnel on how to use the software. The
user would have to pay the vendor for the use of the software. When
multiplied by approximately 4,500 users subject to FDA recordkeeping
requirements, these costs are very significant. Notably, however, they
would only address Excel. The hundreds of other kinds of software used
in complying with FDA recordkeeping requirements need their own
solutions. For most of them, there is no website advertising a fix for a
fee.

A related cost is that of memory storage. Most software is written to
minimize the amount of memory used by the application. The metadata
collected by an audit trail multiplies the system memory requirements,
and cost, by a substantial factor.

> **d. [The Searchability Requirement Also Adds Costs.]{.underline}**

Another significant cost element of the Part 11 recordkeeping provisions
is the requirement that electronic records be searchable. Paper records
are not searchable and yet are legitimate records. FDA has by
interpretation found a searchability requirement in Part 11's
requirement that covered entities be able to generate electronic copies
of records "suitable for inspection, review, and copying by the
agency",[^65] as shown by the following FDA statements:

> We \[FDA\] commented that to be suitable for our use electronic copies
> need to be in a format that permits us to process (e.g., search and
> sort) information. Thus, a PDF file of a table or spreadsheet would
> not meet this need, although a word searchable text file may meet this
> requirement.[^66]
>
> During the course of the meeting we \[FDA\] commented that PDF file
> formats that did not permit the processing of record information would
> be problematic. We noted that for records containing only text, there
> should be no problem with a PDF file that permitted word searches;
> however, we remarked that information in the files that could not be
> processed, such as images of spreadsheets and tables would be
> problematic from a part 11 perspective. Part 11 requires that persons
> be able to generate electronic copies of electronic records that are
> suitable for FDA review.[^67]

Moreover, a major principle in part 11 is that for FDA to be able to
protect and promote public health it must function on the same
technological plane as the regulated industry. We couldn\'t do that if
firms were allowed to destroy their electronic records and present to
FDA investigators only paper archives because investigators would not be
able to apply information technology based tools such as search and sort
techniques when reviewing those records.[^68]

This requirement goes far beyond the need for electronic records to be
equivalent to paper records.

As indicated by the first two quotations above, a searchability
requirement limits the technological options available to regulated
entities. This necessarily means that some archiving options, such as
non-searchable PDF files, are not for Part 11 compliance, even though
they would be electronic records. Limiting available technological
options raises costs to regulated entities.

> **4. [Summary]{.underline}**

FDA has several reasons to reexamine Part 11. They include at least the
following:

-   In adopting Part 11, FDA believed the rule to be voluntary. It made
    a number of important decisions, and did not perform otherwise
    mandatory analyses, based on that belief. In practice, the
    recordkeeping provisions are mandatory, since modern manufacturing
    and laboratory techniques cannot escape the application of Part 11.

-   FDA expected that a mere 100 facilities would choose to comply with
    the electronic recordkeeping provisions. In fact, thousands of
    facilities are affected, as FDA now acknowledges.

-   The costs of compliance with Part 11 are not trivial, as originally
    estimated by FDA. The reason is that regulated entities for the most
    part had not already implemented Part 11 requirements, contrary to
    FDA's understanding in promulgating Part 11. The Part 11
    requirements are extremely costly, totaling over \$2 billion, on the
    order of the cost of Y2K compliance. These costs have the
    consequence of stifling innovation and diverting resources that
    could be used for upgrading quality and safety into far less
    beneficial anti-fraud controls.

In light of FDA's misunderstanding of the mandatory nature of the rule
and its very high cost, FDA should reexamine Part 11 at this time.

**III. [FDA Should Revise Part 11 to Make It Risk-Based]{.underline}**

Dow supports FDA's plan to make Part 11 risk-based, for the reasons
stated in the Part 11 Guidance Document. In addition, other
considerations justify a risk basis for electronic recordkeeping
requirements. Currently, the Part 11 requirements are one-size-fits-all,
mandating the highest level of security for all required records,
regardless of their nature. This is inappropriate in light of current
governmental mandates for risk-based approaches for electronic
recordkeeping. The lack of a risk basis adds greatly to the cost of Part
11, since a risk approach would result in a substantial cutting back on
Part 11 requirements in several areas.

**1. [FDA Has Not Justified the Need for Stringent Anti-Fraud
Provisions.]{.underline}**

FDA explained the need for most of the burdensome provisions of Part 11
as a defense against fraud:

FDA must retain the ability to audit records **to detect unauthorized
modifications**, simple errors, and **to deter falsification**. Whereas
there are many scientific techniques to show changes in paper records
(e.g., analysis of the paper, signs of erasures, and handwriting
analysis), these methods do not apply to electronic records. For
electronic records and submissions to have the same integrity as paper
records, they must be developed, maintained, and used under
circumstances that **make it difficult for them to be inappropriately
modified**. Without these assurances, FDA's objective of enabling
electronic records and signatures to have standing equal to paper
records and handwritten signatures, and to satisfy the requirements of
existing statutes and regulations, cannot be met.[^69]

But FDA has failed to justify why such stringent anti-fraud provisions
as appear in the recordkeeping provisions are needed. There is nothing
in the administrative record to support FDA's implicit claim that fraud
in electronic recordkeeping is a significant problem throughout FDA
programs or that the anti-fraud requirements of Part 11 are appropriate.

Moreover, the Part 11 anti-fraud provisions merely supplement existing
anti-fraud legal requirements. The federal criminal code already
prohibits making a false statement to the government or keeping
fraudulent records required by the government.[^70] The FFDCA contains
specific prohibitions on making false statements or keeping false
records.[^71]

**2. [FDA Did Not Conduct a Risk Assessment or Cost-Benefit Analysis of
Risk Management Controls.]{.underline}**

FDA apparently assumed that the Part 11 anti-fraud controls were
necessary to achieve the objectives stated above. It did not conduct a
detailed assessment of the need for all those controls, or of the costs
and benefits of imposing those controls. FDA now has an opportunity to
do so. Before deciding how to change Part 11, FDA should conduct such
assessments.

Such assessments are now mandatory for all federal agencies regulating
electronic recordkeeping. FDA promulgated Part 11 in 1997. Since then,
Congress has adopted a statute mandating that government agencies accept
electronic recordkeeping. This is the Government Paperwork Elimination
Act ("GPEA").[^72] Section 1704 of the GPEA directs OMB to

Ensure that, \[by October 2003\], Executive agencies provide---

(1) for the option of the electronic maintenance, submission, or
    disclosure of information, when practicable as a substitute for
    paper; and

(2) For the use and acceptance of electronic signatures, when
    practicable.

As part of its fulfillment of this responsibility, OMB directed all
federal agencies in implementing the GPEA to conduct a risk assessment
for fraud in electronic recordkeeping, and a separate cost-benefit
analysis of provisions aimed at curbing such fraud:

Accordingly, agencies should develop and implement plans, supported by
an assessment of whether to use and accept documents in electronic form
and to engage in electronic transactions. The assessment should weigh
costs and benefits and involve an appropriate risk analysis, recognizing
that low-risk information processes may need only minimal consideration,
while high-risk processes may need extensive analysis.[^73]

Similarly, the Justice Department has advised federal agencies
considering electronic reporting and recordkeeping to:

1.  Conduct an analysis of the nature of a transaction or process to
    determine the level of protection needed and the level of risk that
    can be tolerated . . . .

2.  Consider potential costs and benefits, quantifiable and
    unquantifiable, direct and indirect, in performing a cost/benefit
    analysis.[^74]

The reason for these required analyses was to cause agencies to refrain
from overreacting to the prospect of fraud in electronic records:

> Setting up a very secure, but expensive, automated system may in fact
> buy only a marginal benefit of deterrence or risk reduction over other
> alternatives and may not be worth the extra cost. For example, **past
> experience with fraud risks, and a careful analysis of those risks,
> shows that exposure is often low.** If this is the case a less
> expensive system that substantially deters fraud is warranted, and not
> an absolutely secure system. Overall, security determination should
> conform with the Computer Security Act: the level of security should
> be commensurate with the level of sensitivity of the transaction.[^75]

FDA has not yet conducted these required analyses for Part 11.[^76]

FDA decided against adjusting most of its Part 11 requirements to the
degree of criticality of the records involved.[^77] While a few
requirements do vary,[^78] for most of the requirements, including those
with the greatest cost (such as the audit trail requirement), all
FDA-mandated records, regardless of their nature, are treated as though
they have the highest level of sensitivity. The OMB guidance cautions
against this "one-size-fits-all" approach:

> Agencies should also keep in mind that GPEA specifically states that
> electronic records and their related electronic signatures are not to
> be denied legal effect, validity, or enforceability merely because
> they are in electronic form. **We are not, therefore, prescribing "one
> size fits all" requirements applicable to transactions regardless of
> sensitivity.**[^79]

In particular, the OMB guidance advises that the risk of fraud is lowest
where there is an ongoing relationship, as with FDA and regulated
entities:

> Risks tend to be relatively low in cases where there is an ongoing
> relationship between the parties. Generally speaking . . . ,
> **transactions between a regulatory agency and a publicly traded
> corporation or other known entity regulated by that agency can often
> bear a relatively low risk of repudiation or fraud**, particularly
> where the regulatory agency has an ongoing relationship with, and
> enforcement authority over, the entity.[^80]

FDA keeps careful track of its regulated entities, routinely inspects
them, and deals with them on an ongoing basis. Accordingly, the risk of
fraud is probably quite low, at least for most kinds of records. A
detailed assessment would help clarify this.

**3. [FDA's Determination That Stringent Anti-Fraud Provisions Are
Necessary to Ensure Reliability Conflicts With Judicial Experience
Accepting Electronic Records as Reliable Evidence.]{.underline}**

The preamble describes the anti-fraud provisions as crucial to
establishing that electronic records are reliable:

This rule includes several conditions that an electronic record or
signature **must** meet in order to be acceptable as an alternative to a
paper record or handwritten signature.[^81]

This position is inconsistent with the many civil and criminal cases in
which electronic records have been admitted into evidence as reliable
records without meeting those conditions.

Electronic records (or printouts thereof) have been held admissible as
reliable evidence for decades in both civil and criminal cases. Indeed,
the Federal Rules of Evidence specifically facilitate the admission of
electronic records. Rule 1001(4) provides that in the case of electronic
records the requirement for an original record may be met by a printout.
Rule 803(6), the "business records" exception to the hearsay rule,
covers a "data compilation, in any form" (i.e., including electronic
records). Any residual evidentiary concerns about electronic records are
reduced by the GPEA, which provides that:

Electronic records . . . maintained in accordance with procedures
developed under this title . . . shall not be denied legal effect,
validity, or enforceability because such records are in electronic
form.[^82]

As an enforcement agency, FDA is doing a great disservice to other
enforcement agencies in taking this position. These other agencies must
persuade judges and juries that electronic records lacking the Part 11
anti-fraud provisions are reliable. If those provisions are crucial to
establish reliability of electronic records kept for FDA purposes, it is
unclear why they are not similarly crucial for all evidentiary purposes,
both civil and criminal. Since the courts have found that they are not
crucial to proving reliability, FDA's proposition that they are crucial
is flawed.

**IV. [FDA Should Consider How Other Federal Agencies Have Regulated
Electronic Recordkeeping.]{.underline}**

> **1. [Experience From Other Federal Agencies.]{.underline}**

FDA has recognized the importance of consulting with other federal
agencies on electronic recordkeeping:

> The agency is also aware that other Federal agencies share the same
> concerns and are addressing the same issues as FDA; the agency has
> held informal discussions with other Federal agencies and participated
> in several interagency groups on electronic records/electronic
> signatures and information technology issues. FDA looks forward to
> exchanging information and experience with other agencies for mutual
> benefit and to promote a consistent Federal policy on electronic
> records and signatures.[^83]

In light of the passage of time and the GPEA, FDA should follow the
examples of its sister agencies in considering risk and tailoring
requirements for electronic records and submissions to those risks.

Significantly, several of the agency rules discussed below reference
either the GPEA or the Electronic Signatures in Global and National
Commerce ("E-SIGN") Act.[^84] While the E-SIGN Act does not address
governmental recordkeeping requirements,[^85] it does embrace minimal
electronic record provisions that are substantially equivalent to those
imposed on paper records, and that do not impose unreasonable costs on
the acceptance of electronic records or signatures.[^86]

Only one agency, EPA, has followed FDA's example of stringent anti-fraud
provisions for electronic recordkeeping, and EPA has now decided against
following through with that approach, at least for now.

Most agencies have found no need to address electronic recordkeeping at
all, presumably on the basis that their recordkeeping requirements
already allow it. NRC made that determination explicitly. Other agencies
have established general criteria for reliability and legibility,
without finding a need, as FDA did with Part 11, for detailed
requirements. For example, none has a validation requirement. Most do
not require audit trails, and only an SEC rule contemporaneous with Part
11 requires computer-generated audit trails.

FDA's parent agency, HHS, has rules which direct covered entities to
conduct risk assessments and cost-benefit analyses in deciding whether
or to what extent they must implement electronic recordkeeping
safeguards.

This variety of approaches, even in the public health context, shows
that Part 11's particular provisions are not crucial to the reliability
and acceptability of electronic records. FDA should consider this wide
range of regulatory approaches to a common issue as it reexamines Part
11.

> **2. [EPA - CROMERRR]{.underline}**

Initially, FDA should recognize that only one federal agency, EPA, has
followed the example of Part 11. In 2001 EPA proposed a Cross-Media
Electronic Reporting and Recordkeeping Rule ("CROMERRR") explicitly
based on Part 11.[^87] In doing so, it was unique among federal
agencies, as none of the others has done so, despite the GPEA directive
that all federal agencies accept electronic records and submissions by
October 2003.

In the face of devastating public comments, based in part on industry's
experience with Part 11, EPA has decided to halt work for now on the
electronic recordkeeping provisions of CROMERRR:

> As proposed, the Cross-Media Electronic Reporting (ER) and
> Recordkeeping Rule (CROMERRR) was intended to provide a uniform legal
> framework for paperless electronic reporting and recordkeeping,
> including electronic signature/ certification, across EPA's
> environmental compliance programs. Based on public comment, however,
> EPA now plans to focus on finalizing the electronic reporting
> components of proposed CROMERRR, and to defer further action on the
> electronic recordkeeping components until a later time.[^88]
>
> Finally, comments on the CROMERRR also indicated a substantial
> reworking of the cost and benefit analyses with respect to the
> electronic record-keeping components of the proposal. Given EPA's
> current focus on electronic reporting, EPA will defer additional
> economic analysis in this area until we resume work on electronic
> recordkeeping.[^89]

CROMERRR illustrates how a very stringent, one-size-fits-all, anti-fraud
approach to regulation of electronic recordkeeping is not good public
policy.

In contrast, many of EPA's recordkeeping regulations have explicitly
allowed electronic recordkeeping for years, with no particular
requirements.[^90] EPA's experience under those regulations has
apparently been positive, as EPA did not propose to address electronic
recordkeeping since adopting those provisions until prompted to do so by
the GPEA.

> **3. [Treasury Department -- Federal Payments and
> Collections]{.underline}**

In contrast to EPA and FDA, other federal agencies implementing the GPEA
have chosen to adjust the degree of anti-fraud protections to the risk
of fraud and the consequences of fraud. For example, in 2001 the
Treasury Department adopted policies and practices pursuant to the GPEA
for the use of electronic transactions and authentication techniques in
federal payments and collections.[^91] It uses a risk-based approach:

> All payment, collection, and collateral transactions must be properly
> authenticated, in a manner commensurate with the risks of the
> transaction.[^92]

Transactions with negligible risk may occur without any electronic
authentication technique. Those with low risk must use a single factor
authentication, such as a personal identification number. Those with
moderate or high risk would require more in the way of authentication,
such as cryptography.

**4. [IRS -- Electronic Recordkeeping]{.underline}**

Just days after FDA published Part 11 in 1997, the Internal Revenue
Service issued a revenue procedure providing guidance to taxpayers on
maintaining tax records electronically.[^93] That IRS guidance requires
"reasonable" controls, i.e., controls whose stringency varies with the
criticality of the records, the likelihood of fraud, and the
cost-effectiveness of the controls. For example, it provides in part:

An electronic storage system must include:

(a) reasonable controls to ensure the integrity, accuracy, and
    reliability of the electronic storage system;

(b) reasonable controls to prevent and detect the unauthorized creation
    of, addition to, alteration of, deletion of, or deterioration of
    electronically stored books and records;

(c) an inspection and quality assurance program evidenced by regular
    evaluations of the electronic storage system including periodic
    checks of electrically stored books and records;

(d) a retrieval system that includes an indexing system . . . ; and

(e) the ability to reproduce legible and readable hardcopies . . . of
    electronically stored books and records.

A related revenue procedure requires an audit trail, but only between
the retained records and the taxpayer's books, and between the retained
records and the tax return.[^94]

If such flexible and general requirements are sufficient for the IRS,
with its concern with fraud, they should also be sufficient for FDA.

**5. [Department of Labor -- ERISA Records]{.underline}**

In 2002, the Pension and Welfare Benefits Administration within the U.S.
Department of Labor issued final rules relating to the use of electronic
communication and recordkeeping technologies by employee pension and
welfare benefit plans.[^95] These rules are based on the IRS revenue
procedures, but are said to be consistent with the goals of the E-SIGN
Act.[^96] They, too, require only "reasonable" controls. They provide in
part:

The record maintenance and retention requirements of sections 107 and
209 of ERISA are satisfied when using electronic media if:

(1) The electronic recordkeeping system has reasonable controls to
    ensure the integrity, accuracy, authenticity and reliability of the
    records kept in electronic form;

(2) The electronic records are maintained in reasonable order and in a
    safe and accessible place, and in such manner as they may be readily
    inspected or examined (for example, the recordkeeping system should
    be capable of indexing, retaining, preserving, retrieving and
    reproducing the electronic records);

(3) The electronic records are readily convertible into legible and
    readable paper copy . . . ;

(4) The electronic recordkeeping system is not subject, in whole or in
    part, to any agreement or restriction that would, directly or
    indirectly, compromise or limit a person's ability to comply with
    any reporting and disclosure requirement or any other obligation
    under Title I of ERISA; and

(5) Adequate records management practices are established and
    implemented (for example, following procedures for labeling of
    electronically maintained or retained records, providing a secure
    storage environment, creating back-up electronic copies and
    selecting an off-site storage location, observing a quality
    assurance program evidenced by regular evaluations of the electronic
    recordkeeping system including periodic checks of electronically
    maintained or retained records, and retaining paper copies of
    records that cannot be clearly, accurately or completely transferred
    to an electronic recordkeeping system).

These general requirements, different in kind from the prescriptive
requirements of Part 11, are expected to have only modest costs of
compliance, as described in the preamble to the proposed rule:

A marginal expense may be incurred by plans or sponsors that already use
electronic media for recordkeeping purposes to conform their procedures
to the minimum standards described in this proposal. The Department
believes this expense would be limited because the standards proposed
are not intended to establish detailed methods of compliance, but rather
to describe general performance objectives which are consistent with the
reasonable and prudent business practices already required of ERISA plan
fiduciaries. Under the proposal, plans and sponsors would retain the
flexibility to make any changes necessary, for example, to ensure the
integrity and safety of the records, or to improve indexing and ease of
retrieval, in the manner which is most cost effective for them.[^97]

**6. [Pension Benefit Guaranty Corporation]{.underline}**

In 2003, the Pension Benefit Guaranty Corporation ("PBGC") published
rules under the GPEA for electronic record retention which are
essentially identical to those of the Pension Welfare and Benefits
Administration quoted above.[^98] They provide in pertinent part:

> **May I use electronic media to satisfy PBGC\'s record retention
> requirements?**
>
> *General requirements.* You may use electronic media to satisfy the
> record maintenance and retention requirements of this chapter if:
>
> \(a\) The electronic recordkeeping system has reasonable controls to
> ensure the integrity, accuracy, authenticity and reliability of the
> records kept in electronic form;
>
> \(b\) The electronic records are maintained in reasonable order and in
> a safe and accessible place, and in such manner as they may be readily
> inspected or examined (for example, the recordkeeping system should be
> capable of indexing, retaining, preserving, retrieving and reproducing
> the electronic records);
>
> \(c\) The electronic records are readily convertible into legible and
> readable paper copy as may be needed to satisfy reporting and
> disclosure requirements or any other obligation under section
> 302(f)(4), section 307(e), or Title IV of ERISA;
>
> \(d\) The electronic recordkeeping system is not subject, in whole or
> in part, to any agreement or restriction that would, directly or
> indirectly, compromise or limit a person\'s ability to comply with any
> reporting and disclosure requirement or any other obligation under
> section 302(f)(4), section 307(e), or Title IV of ERISA;
>
> \(e\) Adequate records management practices are established and
> implemented (for example, following procedures for labeling of
> electronically maintained or retained records, providing a secure
> storage environment, creating back-up electronic copies and selecting
> an off-site storage location, observing a quality assurance program
> evidenced by regular evaluations of the electronic recordkeeping
> system including periodic checks of electronically maintained or
> retained records; and retaining paper copies of records that cannot be
> clearly, accurately or completely transferred to an electronic
> recordkeeping
>
> system); and
>
> \(f\) All electronic records exhibit a high degree of legibility and
> readability when displayed on a video display terminal or other method
> of electronic transmission and when reproduced in paper form. The term
> "legibility" means the observer must be able to identify all letters
> and numerals positively and quickly to the exclusion of all other
> letters or numerals. The term "readability" means that the observer
> must be able to recognize a group of letters or numerals as words or
> complete numbers.[^99]

PBGC justified these rules as follows:

> These rules provide guidance on record maintenance and retention
>
> using electronic means. These rules generally track the Department of
>
> Labor\'s final rules (67 FR 17264 (April 9, 2002)) for retaining
> records
>
> by electronic means, set out at 29 CFR 2520.107-1 . . . .
>
> The recordkeeping requirements are consistent with the goals of E-
>
> SIGN and are designed to facilitate voluntary use of electronic
> records
>
> while ensuring continued accuracy, integrity and accessibility of
>
> records required to be kept under our regulations. The requirements
> are
>
> justified by the importance of the records involved, are substantially
>
> equivalent to the requirements imposed on records that are not
>
> electronic records, will not impose unreasonable costs on the
>
> acceptance and use of electronic records, and do not require, or
> accord
>
> greater legal status or effect to, the implementation or application
> of
>
> a specific technology or technical specification for performing the
>
> functions of creating, storing, generating, receiving, communicating,
>
> or authenticating electronic records.[^100]

**7. [Securities & Exchange Commission]{.underline}**

In 1997, within days of FDA issuing Part 11, the SEC issued rules for
electronic storage of records by broker-dealers.[^101] Those rules do
require a computer-generated audit trail for records until such time as
they are made non-rewriteable and non-erasable.

In contrast, in 2001, the SEC issued rules in response to the E-SIGN Act
which require only "reasonable" security controls. One, concerning
electronic recordkeeping by Public Utility Holding Companies,[^102]
provides in part:

In the case of records on electronic storage media, the company, or
person that maintains and preserves records on its behalf, must
establish and maintain procedures:

(i) To maintain and preserve the records, so as to reasonably safeguard
    them from loss, alteration, or destruction;

(ii) To limit access to the records to properly authorized personnel,
     the directors of the company, and the Commission (including its
     examiners and other representatives); and

(iii) To reasonably ensure that any reproduction of a non-electronic
      original record on electronic media is complete and true, and
      legible when retrieved.

Two other rules, on electronic recordkeeping by investment companies and
investment advisors,[^103] are essentially identical to the provisions
quoted above. Both preambles noted factors addressing risk and the
cost-effectiveness of the provisions.

**8. [Nuclear Regulatory Commission]{.underline}**

The NRC found that it did not have to amend its regulations to meet the
GPEA requirement to accept electronic recordkeeping:

Well before the passage of the GPEA, the NRC had taken major steps to
increase the use of electronic communication. For example, many of the
agency's regulations on recordkeeping have long permitted storage in
electronic format . . .

We have not had to propose amendments to our regulations on maintenance
of records. A great many of these already explicitly permit the use of
electronic means to maintain records, and those that do not explicitly
permit electronic maintenance of records do not in any way imply that
electronic strategies for preservation are disallowed.[^104]

For example, NRC's standards for protection against radiation (certainly
analogous to FDA's regulations protecting public health) have extensive
recordkeeping requirements. The regulations provide in part that:

Each record required by this part must be legible throughout the
specified retention period . . . . . The record may be an original or a
reproduced copy or a microform provided that the copy or microform is
authenticated by authorized personnel . . . . The record may also be
stored in electronic media with the capability for producing legible,
accurate, and complete records during the required retention period . .
. . The licensee shall maintain adequate safeguards against tampering
with and loss of records.[^105]

In adopting this provision back in 1991, NRC simply stated:

The use of electronic media requires authentication and the prevention
of alteration or loss of the records. As with requirements for paper
records, the electronic media must be capable of producing a legible
copy of the record.[^106]

Thus, in a public health context analogous to that of FDA, NRC has
determined that the most basic of requirements for electronic
recordkeeping are sufficient.

**9. [HHS -- HIPAA Security Rule]{.underline}**

Of particular relevance to FDA is the rule issued by its parent agency,
the Department of Health and Human Services, earlier this year
concerning security standards for electronic protected health
information under the Health Insurance Portability and Accountability
Act of 1996 ("HIPAA").[^107] HHS considered Part 11 in drafting the
rule,[^108] but, significantly, chose to depart from the Part 11
requirements in most instances. This Security Rule incorporates risk and
cost-benefit analysis into the provisions of the rule itself, in part
through the concept of "addressable" implementation specifics:

In meeting standards that contain addressable implementation specifics,
a covered entity will ultimately do one of the following: (a) Implement
one or more of the addressable specifications; (b) implement one or more
alternative security measures; (c) implement a combination of both; or
(d) not implement either an addressable implementation specification or
an alternative security measure . . . .

The entity must decide whether a given addressable implementation
specification is a reasonable and appropriate security measure to apply
within its particular security framework. This decision will depend on a
variety of factors, such as, among others, the entity's risk analysis,
risk mitigation strategy, what security measures are already in place,
and the cost of implementation.[^109]

This does not give covered entities carte blanche to do what they want:

We disagree that covered entities are given complete discretion to
determine their security policies under this rule, resulting in effect,
in no standards. While cost is one factor a covered entity may consider
in determining whether to implement a particular implementation
specification, there is nonetheless a clear requirement that adequate
security measures be implemented, see 45 CFR 164.306(b). Cost is not
meant to free covered entities from this responsibility.[^110]

Other requirements are mandatory, i.e., not "addressable". An example of
this approach is how the Security Rule handles audit trails. HIPAA
explicitly directed HHS to consider "the value of audit trails in
computerized record systems" in drafting its Security Rule.[^111] The
Security Rule requires audit controls, but the audit controls need not
be electronic. A covered entity must:

Implement hardware, software, and/or procedural mechanisms that record
and examine activity in information systems that contain or use
electronic protected health information.[^112]

The preamble explains that how covered entities are to implement this
flexible requirement depends in part on risk considerations:

We support the use of a risk assessment and risk analysis to determine
how intensive any audit control function should be.[^113]

This requirement is considerably more flexible than Part 11's
corresponding requirement:

Use of secure, computer-generated, time-stamped audit trails to
independently record the date and time of operator entries and actions
that create, modify, or delete electronic records. Record changes shall
not obscure previously recorded information. Such audit trail
documentation shall be retained for a period at least as long as that
required for the subject electronic records and shall be available for
agency review and copying.[^114]

**10. [FDA Should Consider the Option of Revoking Part
11.]{.underline}**

As it considers how to revise Part 11, FDA should consider the option of
revoking Part 11 entirely and not having regulations that address
electronic recordkeeping specifically. Certainly, most federal agencies
lack such regulations and they seem to regulate affected entities
efficiently. Presumably, their recordkeeping regulations either
explicitly or implicitly allow records to be kept in any medium,
including electronically, so that they need take no action under the
GPEA. As noted above, both NRC and EPA have such regulations, and both
regulate in the arena of public health without significant problems
about fraud in electronic recordkeeping.

Notably, FDA's own record retention requirements outside of Part 11
already authorize electronic recordkeeping. For example, Part 820,
quality system regulation, provides that "Those records stored in
automatic data processing systems shall be backed up."[^115] The
preamble to that rule adds that:

FDA will interpret "copying" to include the printing of computerized
records, as well as photocopying.[^116]

Similarly, Part 211, current good manufacturing practice for finished
pharmaceuticals, provides in part:

Records required under this part may be retained either as original
records or as true copies such as photocopies, microfilm, microfiche, or
other accurate reproductions of the original records.[^117]

In adopting this provision in 1978, FDA explained:

With specific regard to physical space for the storage of records, the
Commissioner advises that the regulations do not generally require
retention of original records, and that retention of suitable true
copies in other forms such as microfilm is permitted. **The Commissioner
believes that, in keeping with modern business practices, there are many
record retention systems that would fulfill the intent of the record
retention provisions.** Section 211.180(d) of the final regulations
specifically provides for this flexibility.[^118]

FDA should consider its own experience in permitting regulated entities
to keep records electronically independently of Part 11 to determine the
extent to which there is any need for Part 11 requirements.

**V. [FDA Should Revise Part 11 Through Rulemaking.]{.underline}**

While Dow supports the draft guidance re-interpreting Part 11 and
exercising enforcement discretion on key Part 11 provisions, FDA should
revise Part 11 through rulemaking. (Enforcement discretion during the
rulemaking process is appropriate.)

The text of Part 11 itself, along with its preamble, cannot be
re-interpreted to redress the fundamental problems with Part 11. The
changes needed are too profound. Accordingly, the long-term solution is
undoubtedly rulemaking.

Once FDA commits to rulemaking, it should of course address all the
required analyses, including those under the Unfunded Mandates Reform
Act, the Paperwork Reduction Act, and the Regulatory Flexibility Act.

**[CONCLUSION]{.underline}**

FDA should engage in rulemaking to redress the many problems with Part
11. In the meantime, it should exercise enforcement discretion with
respect to key provisions of Part 11.

[^1]: 68 Fed. Reg. 18591 (Apr. 8, 2004) (the "Notice of Public
    Meeting").

[^2]: See
    <http://www.fda.gov/ohrms/dockets/dockets/00d1539/00d-1539-c000039-02-vol9.pdf>.

[^3]: See
    <http://www.fda.gov/ohrms/dockets/dockets/04n0133/04n0133.htm>.

[^4]: FDA, "Guidance for Industry: Part 11, Electronic Records;
    Electronic Signatures -- Scope and Application" (Aug. 2003) ("Part
    11 Guidance Document"), available at
    <http://www.fda.gov/cder/guidance/5667fnl.pdf>. A Federal Register
    notice announcing the guidance appeared at 68 Fed. Reg. 52779 (Sept.
    5, 2003).

[^5]: 21 CFR § 11.1(b) (emphasis added).

[^6]: See, e.g., 21 CFR §§ 211.68, 820.30(g), 820.70(i).

[^7]: 21 CFR § 11.1(a) (emphasis added).

[^8]: 62 Fed. Reg. 13430, 13444 (Mar. 20, 1997).

[^9]: See proposed 40 CFR § 3.100, 66 Fed. Reg. 46162, 46190-91 (Aug.
    31, 2001).

[^10]: 21 CFR § 58.130(e). FDA originally adopted this requirement, in
    slightly different form, in 1978, well before extensive use of
    computers. See 21 CFR § 58.130(e), 43 Fed. Reg. 59986, 60018 (Dec.
    22, 1978).

[^11]: See the discussion in Section IV.7 of these comments.

[^12]: HIPAA § 262, 42 USC § 1320d-2(d)(1)(iv).

[^13]: 45 CFR § 164.312(b).

[^14]: 68 Fed. Reg. 8334, 8355 (Feb. 20, 2003).

[^15]: FDA originally proposed for Part 11 an audit trail requirement
    without specifying that it had to be computer-generated. Proposed 21
    CFR § 11.10(e), 59 Fed. Reg. 45160, 45176 (Aug. 31, 1994). According
    to the preamble to the final rule, "Several comments \[in response
    to the proposed rule\] focused on the question of whether audit
    trails should be generated manually under operator control or
    automatically without operator control." FDA concluded that the
    audit trail should be computer-generated. 62 Fed. Reg. 13430, 13447
    (Mar. 20, 1997).

[^16]: 21 CFR §§ 11.10(b), (c), and (e).

[^17]: Jeff Rothenberg, "Ensuring the Longevity of Digital Documents",
    *Scientific American*, Vol. 272, No. 1 (Jan. 1995), pp. 42-47,
    available at
    <http://www.sciamdigital.com/browse.cfm?sequencenameCHAR=item2&methodnameCHAR=resource_getitembrowse&interfacenameCHAR=browse.cfm&ISSUEID_CHAR=C4AEE5CE-6FFE-49D4-9BF2-5D5BC40A8CB&ARTICLEID_CHAR=07FBACA7-7185-43C8-B9E7-E07B5343F87&sc=I100322>.
    The author updated and expanded the article in 1999, using the same
    title, available at
    <http://www.clir.org/pubs/archives/ensuring.pdf>.

[^18]: See U.S. Department of Justice, "Legal Considerations in
    Designing and Implementing Electronic Processes: A Guide for Federal
    Agencies" (Nov. 2000), n. 10, filed in Docket No. 00D-1541,
    available at
    <http://www.fda.gov/ohrms/dockets/dockets/00d1541/rpt0003.pdf> and
    [www.cybercrime.gov/eprocess.pdf](http://www.cybercrime.gov/eprocess.pdf).

[^19]: SRA International, Inc., "Report on Current Recordkeeping
    Practices within the Federal Government, Prepared for the National
    Archives and Records Administration" (Dec. 10, 2001), available at
    [www.nara.gov/records/rmi.html](http://www.nara.gov/records/rmi.html)
    at 5-6 (emphasis in original).

[^20]: NARA, "Records Management Guidance for Agencies Implementing
    Electronic Signature Technologies" (Oct. 18, 2000), available at
    [www.nara.gov/records/policy/gpea.html](http://www.nara.gov/records/policy/gpea.html),
    § 5.5 (emphasis in original).

[^21]: Government Accounting Office, "National Archives: Preserving
    Electronic Records in an Era of Rapidly Changing Technology",
    GAO/GGD-99-94 (July 1999), available at
    [www.gao.gov/archive/1999/gg99094.pdf](http://www.gao.gov/archive/1999/gg99094.pdf).

[^22]: Department of Justice, "Legal Considerations in Designing and
    Implementing Electronic Processes: A Guide for Federal Agencies"
    (Nov. 2000), filed in Docket No. 00D-1541, available at
    <http://www.fda.gov/ohrms/dockets/dockets/00d1541/rpt0003.pdf> and
    [www.cybercrime.gov/eprocess.htm](http://www.cybercrime.gov/eprocess.htm),
    § II.A.3 (footnote omitted).

[^23]: 59 Fed. Reg. 45160, 45162 (Aug. 31, 1994).

[^24]: 62 Fed. Reg. 13430, 13439 (Mar. 20, 1997) (emphasis added).

[^25]: 21 CFR § 211.180(d).

[^26]: 21 CFR § 58.3(k).

[^27]: 62 Fed. Reg. 13430, 13436 (Mar. 20, 1997).

[^28]: 62 Fed. Reg. 13430, 13463 (Mar. 20, 1997).

[^29]: 54 Fed. Reg. 13430, 13434 (Mar. 20, 1997).

[^30]: 54 Fed. Reg. 13430, 13463 (Mar. 20, 1997).

[^31]: The first of several draft guidance documents appeared in August
    2001. In February 2003 FDA withdrew all of the previous guidance
    documents on Part 11. 68 Fed. Reg. 8775 (Feb. 25, 2003); 68Fed. Reg.
    5645 (Feb. 4, 2003). Availability of the Part 11 Guidance Document
    was announced in September 2003, more than six years after the
    effective date of Part 11.

[^32]: 69 Fed. Reg. 18591, 18592 n.1 (Apr. 8, 2004).

[^33]: 21 CFR § 11.1(b) (emphasis added).

[^34]: 21 CFR § 10.3(a) (definition of "regulations").

[^35]: 21 CFR § 211.1(a).

[^36]: 21 CFR § 210.3(b)(4).

[^37]: See 43 Fed. Reg. 45014, 45026 (Sept. 29, 1978) ("Although these
    CGMP regulations \[Part 211\] are not applied to the manufacture of
    bulk drug components, there are numerous instances where good
    manufacturing practices for bulk drug components would parallel the
    requirements set forth in Part 211. For this reason, FDA will
    utilize the standards of Part 211 as guidelines during inspections
    of manufacturers of bulk drug components under the jurisdiction of
    the act.").

[^38]: Section 501(a)(2)(B) of the FFDCA, 21 USC § 351(a)(2)(B),
    declares a drug to be adulterated if "the methods used in, or the
    facilities or controls used for its manufacture, processing,
    packing, or holding do not conform to or are not operated or
    administered in conformity with **current good manufacturing
    practice** to assure that such drug meets the requirements of this
    Act as to safety and has the identity and strength, and meets the
    quality and purity characteristics, which it purports or is
    represented to possess." (Emphasis added.) A "drug" includes
    "articles intended for use as a component of" a finished form
    pharmaceutical. Section 201(g), 21 USC § 321(g)(1).

[^39]: FDA, "Guidance for Industry: Q7A Good Manufacturing Practice
    Guidance for Active Pharmaceutical Ingredients" (Aug. 2001) ("Q7A"),
    available at
    [www.fda.gov/cder/guidance/4286fnl.pdf](http://www.fda.gov/cder/guidance/4286fnl.pdf).
    A Federal Register notice announcing availability of the guidance is
    at 66 Fed. Reg. 49028 (Sept. 25, 2001).

[^40]: See particularly Q7A § 5.4, "Computerized Systems". Nowhere in
    Q7A does FDA indicate that Part 11 applies to electronic records
    maintained by API manufacturers.

[^41]: Q7A begins, as do many FDA guidance documents, with the
    statement, "This guidance represents the Food and Drug
    Administration's (FDA's) current thinking on this topic. It does not
    create or confer any rights for or on any person and does not
    operate to bind FDA or the public. An alternative approach may be
    used if such approach satisfies the requirements of the applicable
    statutes and regulations." See also 21 CFR § 10.115, "Good Guidance
    Practices".

[^42]: 62 Fed. Reg. 13430 (Mar. 20, 1997).

[^43]: 62 Fed. Reg. 13430, 13434 (Mar. 20, 1997) (comment 9).

[^44]: 62 Fed. Reg. 13430, 13462 (Mar. 20, 1997) (emphasis added).

[^45]: 21 CFR § 11.3(b)(6).

[^46]: According to the 1997 preamble, Part 11 applies to "systems that
    create and maintain electronic records under Chapter I of Title 21,
    even though some of those electronic records may be printed on paper
    at certain times." 62 Fed. Reg. 13430, 13437 (Mar. 20, 1997)
    (comment 22).

[^47]: 59 Fed. Reg. 45160, 45161 (Aug. 31, 1994).

[^48]: 67 Fed. Reg. 278, 279 (Jan. 3, 2002).

[^49]: 62 Fed. Reg. 13430, 13461-62 (Mar. 20, 1997).

[^50]: 68 Fed. Reg. 43531, 43532 (July 23, 2003).

[^51]: 62 Fed. Reg. 13430, 13463 (Mar. 20, 1997) (emphasis added).

[^52]: 62 Fed. Reg. 13430, 13462 (Mar. 20, 1997) (emphasis added).

[^53]: 68 Fed. Reg. 43531, 43532 (July 23, 2003). This is the same
    estimate as that provided in 2000, see 65 Fed. Reg. 18111 (Apr. 6,
    2000), which FDA estimated to cost \$9,204,975, or \$2,046 per
    regulated entity. See FDA, "Supporting Statement for Electronic
    Records; Electronic Signatures -- 21 CFR Part 11 OMB No. 0910-0303",
    Docket No. 99N-4166 (filed Jun. 19, 2000).

[^54]: 68 Fed. Reg. 43531 (July 23, 2003).

[^55]: PhRMA comments in Docket No. 00D-1539 (Dec. 4, 2002), available
    at
    [www.fda.gov/ohrms/dockets/dockets/00d1539/4.htm](http://www.fda.gov/ohrms/dockets/dockets/00d1539/4.htm).

[^56]: Accenture, "White paper: 21 CFR Part 11: Achieving business
    benefits" (2001) at 9 (emphasis added), available through
    [www.accenture.com](http://www.accenture.com/), cited in FDA,
    "General References For Guidance Documents On 21 CFR Part 11;
    Electronic Records; Electronic Signatures", filed in Docket No.
    00D-1539, available at
    [www.fda.gov/ohrms/dockets/dockets/00d1539/lst0005.htm](http://www.fda.gov/ohrms/dockets/dockets/00d1539/lst0005.htm).

[^57]: PhRMA, "21 CFR Part 11: A Partnership Approach to Achieving
    Regulatory Compliance for Electronic Records and Signatures" (Nov.
    15, 1999) at 8 (emphasis added), attached to PhRMA comments in
    Docket No. 99N-4166 (Nov. 30, 1999).

[^58]: PhRMA comments in Docket No. 00D-1541 (Oct. 29, 2001) at 2-3,
    available at
    [www.fda.gov/ohrms/dockets/dockets/00d1541/2.htm](http://www.fda.gov/ohrms/dockets/dockets/00d1541/2.htm).

[^59]: Industry Coalition on 21 CFR Part 11, "Recommendations for
    Achieving Compliance with the e-Records and e-Signatures Regulation"
    (Aug. 29, 2000) at 2-3 (emphasis added), available at
    [www.fda.gov/ohrms/dockets/dailys/00/Nov00/110600/rpt0001.pdf](http://www.fda.gov/ohrms/dockets/dailys/00/Nov00/110600/rpt0001.pdf).

[^60]: Comments of SmithKline Beecham Pharmaceuticals in Docket No.
    99N-4166 (Nov. 29, 1999) at 2.

[^61]: Comments of Eli Lilly and Company in Docket No. 99N-4166 (Nov.
    23, 1999) at 2.

[^62]: PhRMA, "21 CFR Part 11: A Partnership Approach to Achieving
    Regulatory Compliance for Electronic Records and Signatures" (Nov.
    15, 1999) at 9 (emphasis added), attached to PhRMA comments in
    Docket No. 99N-4166 (Nov. 30, 1999).

[^63]: 21 CFR § 11.10(e).

[^64]: See FDA, "Memo of Meeting" with Wimmer Systems, Inc. (Mar. 7,
    2001), filed in Docket No. 00D-1541, available at
    [www.fda.gov/ohrms/dockets/dockets/00d1541/00d1541.htm](http://www.fda.gov/ohrms/dockets/dockets/00d1541/00d1541.htm).

[^65]: 21 CFR § 11.10(b).

[^66]: FDA, "Memo of Meeting" with ProPackData Corporation (June 14,
    2001), filed in Docket No. 00D-1538, available at
    [www.fda.gov/ohrms/dockets/dockets/00d1538/mm00012.pdf](http://www.fda.gov/ohrms/dockets/dockets/00d1538/mm00012.pdf).

[^67]: FDA, "Memo of Meeting" with Prelude Computer Solutions, Inc.
    (Aug. 9, 2001), filed in Docket No. 00D-1539, available at
    [www.fda.gov/ohrms/dockets/dockets/00d1539/mm00016.pdf](http://www.fda.gov/ohrms/dockets/dockets/00d1539/mm00016.pdf).

[^68]: FDA, "Human Drug CGMP Notes", Vol. 6, No. 3 (Sept. 1998),
    available at
    [www.fda.gov/cder/hdn/cnotes98.pdf](http://www.fda.gov/cder/hdn/cnotes98.pdf).

[^69]: 62 Fed. Reg. 13430, 13464 (Mar. 20, 1997) (emphasis added).

[^70]: 18 U.S.C. § 1001.

[^71]: See, e.g., FFDCA section 303(a)(2), 21 USC § 333(a)(2). See
    generally, O'Reilly, J., [Food and Drug Administration]{.underline}
    (2^nd^ ed. 1995 and supplements), § 8.14.

[^72]: Title XVII of Division C of the Omnibus Consolidated and
    Emergency Supplemental Appropriations Act, 1999, Pub. L. No. 15-277,
    112 Stat. 2681-749 to -751.

[^73]: 65 Fed. Reg. 25508, 25512 (May 2, 2000).

[^74]: Department of Justice, "Legal Considerations in Designing and
    Implementing Electronic Processes: A Guide for Federal Agencies"
    (Nov. 2000), § III.B, filed in Docket No. 00D-1541, available at
    <http://www.fda.gov/ohrms/dockets/dockets/00d1541/rpt0003.pdf> and
    [www.cybercrime.gov/eprocess.htm](http://www.cybercrime.gov/eprocess.htm).

[^75]: 65 Fed. Reg. 22508, 25515 (May 2, 2000) (emphasis added).

[^76]: FDA has asserted with respect to the Part 11 rules that "These
    regulations comply with the Government Paperwork Elimination Act
    (GPEA) (Public Law 105-277)." 69 Fed. Reg. 3586, 3587 (Jan. 26,
    2004). But FDA did not explain how it has met OMB's direction to
    conduct a risk assessment and a cost-benefit analysis in order to
    avoid over-controlling the risks of fraud.

[^77]: "The agency decided not to make the required extent and
    stringency of controls dependent on the type of record or
    transactions . . . ." 62 Fed. Reg. 13430, 13464 (Mar. 20, 1997).

[^78]: For example, use of operational checks and device checks are
    required "as appropriate". 11 CFR §§ 11.10(f), (g).

[^79]: 65 Fed. Reg. 22508, 25510 (May 2, 2000) (emphasis added).

[^80]: 65 Fed. Reg. 22508, 25517 (May 2, 2000) (emphasis added).

[^81]: 62 Fed. Reg. 13430, 13464 (Mar. 20, 1997) (emphasis added).

[^82]: GPEA, § 1707. The "procedures developed under this title" refer
    to GPEA § 1703, "Procedures for Use and Acceptance of Electronic
    Signatures by Executive Agencies". Thus, the "procedures" are not
    aimed at limiting the ability of regulated entities to maintain
    electronic records other than with respect to electronic signatures.

[^83]: 62 Fed. Reg. 13430, 13431 (Mar. 20, 1997).

[^84]: Pub. L. 106-229 (June 30, 2000).

[^85]: E-SIGN, § 104(a).

[^86]: E-SIGN, § 104(b)(2)(C)(ii).

[^87]: 66 Fed. Reg. 46162, 46170 (Aug. 31, 2001).

[^88]: 68 Fed. Reg. 73563 (Dec. 22, 2003) (Unified Agenda, EPA entry
    3171).

[^89]: 67 Fed. Reg. 74241, 74242 (Dec. 9, 2002) (The Regulatory Plan,
    entry 148).

[^90]: See, e.g., 40 CFR § 60.58c(f); 40 CFR § 60.59a(b)(2)(i); 40 CFR §
    60.59b(k); 40 CFR § 60.2180; 40 CFR § 60.2745; 40 CFR § 62.14462; 40
    CFR § 63.103(c)(1); 40 CFR § 63.104(c)(3); 40 CFR §
    63.152(g)(1)(vi)(D); 40 CFR § 63.181(a); 40 CFR § 63.192(f)(1); 40
    CFR § 63.506(a)(1); 40 CFR § 63.642(e) 40 CFR § 63.774(b)(1)(ii); 40
    CFR § 63.850(e)(2); 40 CFR § 63.998(b)(5)(i)(F)(*4*); 40 CFR §
    63.1065; 40 CFR § 63.1109(c); 40 CFR § 63.11.92(d); 40 CFR §
    63.1255(g)(1); 40 CFR § 63.1284(b)(1)(iv); 40 CFR § 63.1335(a)(1);
    40 CFR § 63.1355(a); 40 CFR § 63.1363(g)(1); 40 CFR §
    63.1386(d)(1)(ii); 40 CFR § 63.1409(c)(3); 40 CFR § 63.1416(a)(1);
    40 CFR § 63.1439(a); 40 CFR § 63.1517(a)(2); 40 CFR § 63.5770(d); 40
    CFR § 64.9(b)(2); 40 CFR § 65.4(c)(3); 40 CFR § 65.161(e)(1)(vi)(D);
    40 CFR § 85.1806(e); 40 CFR § 85.1904(d).

[^91]: 66 Fed. Reg. 394 (Jan. 3, 2001).

[^92]: 66 Fed. Reg. 394, 396 (Jan. 3, 2001).

[^93]: Rev. Proc. 97-22 (Mar. 31, 1997).

[^94]: Rev. Proc. 98-25 (Mar. 16, 1998).

[^95]: 29 CFR § 2520.107-1, 67 Fed. Reg. 17264, 17275 (Apr. 9, 2002).
    These rules were issued under section 1510(a) of the Taxpayer Relief
    Act of 1997, Pub. L. 105-34 (Aug. 5, 1997), which requires the
    Secretary of Labor to issue guidance addressing, among other things,
    the recordkeeping requirements of ERISA as applied to the use of new
    technologies.

[^96]: 67 Fed. Reg. 17264, 17268 n.8, 17269 (Apr. 9, 2002).

[^97]: 64 Fed. Reg. 4506, 4511-12 (Jan. 28, 1999).

[^98]: 29 CFR Part 4000, Subpart E, 68 Fed. Reg. 61344, 61351-52 (Oct.
    28, 2003).

[^99]: 29 CFR § 4000.53, 68 Fed. Reg. 61344, 61352 (Oct. 28, 2003).

[^100]: 68 Fed. Reg. 61344, 61346 (Oct. 28, 2003).

[^101]: 17 CFR § 240.17a-4(f), interpreted by SEC Release 34-47806, 17
    CFR Part 241, 68 Fed. Reg. 25281 (May 12, 2003).

[^102]: 17 CFR § 257.1(e), 66 Fed. Reg. 29471, 29474 (May 31, 2001).

[^103]: 17 CFR §§ 270.31a-2(f), 275.204-2, 66 Fed. Reg. 29224, 29228
    (May 31, 2001).

[^104]: 67 Fed. Reg. 57084, 57085-86 (Sept. 6, 2002).

[^105]: 10 CFR § 20.2110.

[^106]: 56 Fed. Reg. 23360, 23384 (May 21, 1991).

[^107]: 45 CFR Parts 160, 162, and 164, 68 Fed. Reg. 8334, 8374 (Feb.
    20, 2003).

[^108]: 63 Fed. Reg. 43242, 43277-79 (Aug. 12, 1998) (Part 11 is mapped
    standard 18).

[^109]: 68 Fed. Reg. 8334, 8336 (Feb. 20, 2003).

[^110]: 68 Fed. Reg. 8334, 8343 (Feb. 20, 2003).

[^111]: HIPAA § 262, 42 USC § 1320d-2(d)(1)(iv).

[^112]: 45 CFR § 164.312(b), 68 Fed. Reg. 8334, 8378 (Feb. 20, 2003).

[^113]: 68 Fed. Reg. 8334, 8355 (Feb. 20, 2003).

[^114]: 21 CFR § 11.10(e).

[^115]: 21 CFR § 820.180.

[^116]: 61 Fed. Reg. 52602, 52637 (Oct. 7, 1996).

[^117]: 21 CFR § 211.180(d).

[^118]: 43 Fed. Reg. 45014, 45066 (Sept. 29, 1978) (comment 423)
    (emphasis added).