**SUMMARY:** The Food and Drug Administration (FDA) is announcing a
public meeting to discuss various topics concerning our regulations on

electronic records and electronic signatures in part 11 (21 CFR part

11). FDA has begun to re-examine part 11 as it applies to all FDA-

regulated products. We will consider the input from the public meeting

and comments on the topics presented in this document as we evaluate

potential changes to part 11.

**DATES:** The public meeting will be held on June 11, 2004, from 8 a.m.
to

4:30 p.m. Submit written or electronic requests to speak plus a

presentation abstract by May 12, 2004. Although written or electronic

comments on the issues presented in this document will be accepted

until July 9, 2004, to have your comments considered at the meeting,

submit them by May 12, 2004.

...

**III. FDA\'s Objectives in Re-Examining Part 11**

FDA\'s re-examination of part 11 includes the following objectives:

-   To prevent unnecessary controls and costs, yet retain the objectives
    of the rule.

-   To clarify the scope of part 11 (e.g., how it relates to other FDA
    regulations).

-   To ensure that part 11 provides an adequate level of record
    security, authenticity, and integrity, and encourages innovation and
    technological advances.

-   To further these objectives, we are seeking to accomplish the
    following:

-   Identify areas where part 11 could be less prescriptive and
    detailed, and

-   Clarify the relationship between part 11 and other FDA regulations
    (predicate rules) with respect to record and recordkeeping
    requirements.

    **IV. Topics for Discussion and Comment**

FDA would like public input to assist with our re-examination of

part 11. We invite discussion on the scope of part 11, risk-based

approaches, validation, audit trails, record retention, record copying,

and legacy systems. We present the following specific issues and

questions for comment in the public meeting.

+---+--------------------------------------+----------------------------+
|   | FDA Request For Input                | Input APV focus group      |
|   |                                      | Information Technology     |
+===+======================================+============================+
|   | A. Part 11 Subpart A\--General       |                            |
|   | Provisions                           |                            |
+---+--------------------------------------+----------------------------+
| 1 | In the part 11 guidance document, we | Some clarification would   |
|   | clarified that only certain          | be helpful, but the scope  |
|   |                                      | should be described very   |
|   | records would fall within the scope  | clearly in order to avoid  |
|   | of part 11. For example, we stated   | a rediscussion as they had |
|   |                                      | been in the past years.    |
|   | that under the narrow interpretation |                            |
|   | of its scope, part 11 would apply    | The Guidance for Industry  |
|   |                                      | Part 11, Scope and         |
|   | where records are required to be     | Application, August 2003   |
|   | maintained under predicate rules or  | should be the basic        |
|   |                                      | document for               |
|   | submitted to FDA, and when persons   | implementation.            |
|   | choose to used records in electronic |                            |
|   |                                      |                            |
|   | format in place of paper format. On  |                            |
|   | the other hand, when persons use     |                            |
|   |                                      |                            |
|   | computers to generate paper          |                            |
|   | printouts of electronic records,     |                            |
|   | those                                |                            |
|   |                                      |                            |
|   | paper records meet all the           |                            |
|   | requirements of the applicable       |                            |
|   | predicate                            |                            |
|   |                                      |                            |
|   | rules, and persons rely on the paper |                            |
|   | records to perform their regulated   |                            |
|   |                                      |                            |
|   | activities, FDA would generally not  |                            |
|   | consider persons to be \`\`using     |                            |
|   |                                      |                            |
|   | electronic records in lieu of paper  |                            |
|   | records\'\' under Sec. 11.2(a) and   |                            |
|   |                                      |                            |
|   | (b). In these instances, the use of  |                            |
|   | computer systems in the generation   |                            |
|   |                                      |                            |
|   | of paper records would not trigger   |                            |
|   | part 11. We are interested in        |                            |
|   |                                      |                            |
|   | comments on FDA\'s interpretation of |                            |
|   | the narrow scope of part 11 as       |                            |
|   |                                      |                            |
|   | discussed in the part 11 guidance    |                            |
|   | and whether part 11 should be        |                            |
|   | revised                              |                            |
|   |                                      |                            |
|   | to implement the narrow              |                            |
|   | interpretation described in the      |                            |
|   | guidance.                            |                            |
+---+--------------------------------------+----------------------------+
| 2 | We are interested in comments on     | Definition of electronic   |
|   | whether revisions to                 | records in terms of        |
|   |                                      | process risk and           |
|   | definitions in part 11 would help    | regulatory requirements.   |
|   | clarify a narrow approach and        | Software should not be     |
|   |                                      | regarded as electronic     |
|   | suggestions for any such revisions.  | records.                   |
+---+--------------------------------------+----------------------------+
| 3 | In the part 11 guidance we announced | A process oriented         |
|   | that we did not intend to            | approach is needed to      |
|   |                                      | define which data, raw     |
|   | take enforcement action to enforce   | data or derived data, are  |
|   | compliance with the validation,      | data used in ERs.          |
|   |                                      |                            |
|   | audit trail, record retention, and   |                            |
|   | record copying requirements of part  |                            |
|   |                                      |                            |
|   | 11 in the manner described in the    |                            |
|   | part 11 guidance. We emphasized that |                            |
|   |                                      |                            |
|   | records must still be maintained or  |                            |
|   | submitted in accordance with the     |                            |
|   |                                      |                            |
|   | underlying predicate rules, and the  |                            |
|   | agency could take regulatory action  |                            |
|   |                                      |                            |
|   | for noncompliance with such          |                            |
|   | predicate rules. [We are interested  |                            |
|   | in]{.mark}                           |                            |
|   |                                      |                            |
|   | [comments on the need for            |                            |
|   | clarification in part 11 regarding   |                            |
|   | which]{.mark}                        |                            |
|   |                                      |                            |
|   | [records are required by predicate   |                            |
|   | rules and are therefore required     |                            |
|   | to]{.mark}                           |                            |
|   |                                      |                            |
|   | [be part 11 compliant?]{.mark}       |                            |
+---+--------------------------------------+----------------------------+

+---+--------------------------------------+----------------------------+
|   | FDA Request For Input                | Input APV focus group      |
|   |                                      | Information Technology     |
+===+======================================+============================+
|   | B. Part 11 Subpart B\--Electronic    |                            |
|   | Records                              |                            |
+---+--------------------------------------+----------------------------+
| 1 | As mentioned previously, the part 11 | The definition of          |
|   | guidance identified four             | electronic records itself  |
|   |                                      | should be based on a risk  |
|   | areas where we do not intend to take | based approach.            |
|   | enforcement action under the         |                            |
|   |                                      |                            |
|   | circumstances described in the part  |                            |
|   | 11 guidance, including the           |                            |
|   |                                      |                            |
|   | validation, audit trail, record      |                            |
|   | retention, and record copying        |                            |
|   |                                      |                            |
|   | requirements of part 11. The part 11 |                            |
|   | guidance further recommends that     |                            |
|   |                                      |                            |
|   | decisions on whether or not to       |                            |
|   | implement part 11 requirements on    |                            |
|   |                                      |                            |
|   | validation, audit trail, record      |                            |
|   | retention, and record copying should |                            |
|   | be                                   |                            |
|   |                                      |                            |
|   | based on a justified and documented  |                            |
|   | risk assessment and a determination  |                            |
|   |                                      |                            |
|   | of the potential of the system to    |                            |
|   | affect product quality and safety,   |                            |
|   |                                      |                            |
|   | and record integrity. We are         |                            |
|   | interested in comments on whether    |                            |
|   | there                                |                            |
|   |                                      |                            |
|   | are other areas of part 11 that      |                            |
|   | should incorporate the concept of a  |                            |
|   |                                      |                            |
|   | risk-based approach, detailed in the |                            |
|   | part 11 guidance (e.g., those that   |                            |
|   |                                      |                            |
|   | require operational system and       |                            |
|   | device checks).                      |                            |
+---+--------------------------------------+----------------------------+
| 2 | Is additional clarity needed         | No.                        |
|   | regarding how predicate rule         |                            |
|   |                                      |                            |
|   | requirements related to subpart B    |                            |
|   | can be fulfilled?                    |                            |
+---+--------------------------------------+----------------------------+
| 3 | Under the current part 11, the       | 1\. yes, separating        |
|   | controls that apply to electronic    | between submission         |
|   |                                      | documents and predicate    |
|   | records that are maintained also     | rules documents could be   |
|   | apply to electronic records that are | necessary, e.g.            |
|   |                                      | requirements for new drug  |
|   | submitted to FDA. [Should the        | applications (NDA) should  |
|   | requirements for electronic          | not be used for ERs in     |
|   | records]{.mark}                      | general. Audit trails for  |
|   |                                      | the generation of          |
|   | [submitted to FDA be separate from   | submission documents       |
|   | electronic records maintained        | should not be required     |
|   | to]{.mark}                           | (draft version).           |
|   |                                      |                            |
|   | [satisfy predicate rule              | 2\. draft-versions of      |
|   | requirements?]{.mark}                | documents should not be    |
|   |                                      | treated as ERs             |
+---+--------------------------------------+----------------------------+
| 4 | The controls for electronic records  | Yes, the current           |
|   | in subpart B distinguish             | definition and             |
|   |                                      | requirements are still     |
|   | between open systems (an environment | necessary.                 |
|   | where system access is not           |                            |
|   |                                      |                            |
|   | controlled by persons who are        |                            |
|   | responsible for the content of       |                            |
|   | electronic                           |                            |
|   |                                      |                            |
|   | records that are on the system) and  |                            |
|   | closed systems (an environment       |                            |
|   |                                      |                            |
|   | where system access is               |                            |
|   |                                      |                            |
|   | controlled by persons who are        |                            |
|   | responsible for the content of       |                            |
|   | electronic                           |                            |
|   |                                      |                            |
|   | records that are on the system).     |                            |
|   | Should part 11 continue to           |                            |
|   |                                      |                            |
|   | differentiate between open systems   |                            |
|   | and closed systems?                  |                            |
+---+--------------------------------------+----------------------------+
| 5 | For individual controls in subpart   | Validation for             |
|   | B, we request comments on the        | requirements arising from  |
|   |                                      | 21 CFR Part 11 should be   |
|   | following:                           | defined as a general       |
|   |                                      | requirement with reference |
|   | 1\. The part 11 guidance identified  | to current validation      |
|   | validation as one of the four        | requirements. No           |
|   |                                      | additional requirements    |
|   | areas where we intend to exercise    | should be defined here.    |
|   | enforcement discretion in the manner |                            |
|   |                                      |                            |
|   | described in the guidance. Should we |                            |
|   | retain the validation provision      |                            |
|   |                                      |                            |
|   | under Sec. 11.10(b) required to      |                            |
|   | ensure that a system meets predicate |                            |
|   |                                      |                            |
|   | rule requirements for validation?    |                            |
+---+--------------------------------------+----------------------------+
|   | 2\. The part 11 guidance identified  | To ensure that records are |
|   | record retention and record          | suitable a validated       |
|   |                                      | process of copying and     |
|   | copying requirements as areas where  | migration should be        |
|   | we plan to exercise enforcement      | accepted to be sufficient. |
|   |                                      |                            |
|   | discretion in the manner described   |                            |
|   | in the part 11 guidance. Are there   |                            |
|   |                                      |                            |
|   | any related predicate rule           |                            |
|   | requirements that you believe are    |                            |
|   | necessary                            |                            |
|   |                                      |                            |
|   | to preserve the content and meaning  |                            |
|   | of records with respect to record    |                            |
|   |                                      |                            |
|   | copying and record retention? [What  |                            |
|   | requirements would preserve          |                            |
|   | record]{.mark}                       |                            |
|   |                                      |                            |
|   | [security and integrity and ensure   |                            |
|   | that records are suitable            |                            |
|   | for]{.mark}                          |                            |
|   |                                      |                            |
|   | [inspection, review, and copying by  |                            |
|   | the agency?]{.mark}                  |                            |
+---+--------------------------------------+----------------------------+
|   | 3\. Should audit trail requirements  | No, not in general. This   |
|   | include safeguards designed and      | should be based on a risk  |
|   |                                      | based approach.            |
|   | implemented to deter, prevent, and   |                            |
|   | document unauthorized record         |                            |
|   |                                      |                            |
|   | creation, modification, and          |                            |
|   | deletion?                            |                            |
+---+--------------------------------------+----------------------------+
|   | 4\. Section 11.10(k) requires        | Configuration management,  |
|   | appropriate controls over systems    | document management and    |
|   |                                      | version control are        |
|   | documentation. In light of how       | absolutely necessary. But  |
|   | technology has developed since part  | they are already defined   |
|   | 11                                   | in current validation      |
|   |                                      | requirements and good      |
|   | became effective, should part 11 be  | documentation practices.   |
|   | modified to incorporate concepts,    | So no further requirements |
|   |                                      | should be defined here.    |
|   | such as configuration and document   | The current formulation of |
|   | management, for all of a system\'s   | section 11.10(k) is an     |
|   |                                      | additional requirement     |
|   | software and hardware?               | which should not be part   |
|   |                                      | of 21 CFR Part 11.         |
+---+--------------------------------------+----------------------------+

+---+--------------------------------------+----------------------------+
|   | FDA Request For Input                | Input APV focus group      |
|   |                                      | Information Technology     |
+===+======================================+============================+
|   | C. Part 11 Subpart C\--Electronic    |                            |
|   | Signatures                           |                            |
+---+--------------------------------------+----------------------------+
| 1 | Within the context of subpart C, we  | The handling of security   |
|   | would like interested parties        | breaches is taken to be    |
|   |                                      | already included in        |
|   | to address the following: Section    | limiting system access to  |
|   | 11.10(d) requires that system access | authorized individuals.    |
|   |                                      |                            |
|   | be limited to authorized             |                            |
|   | individuals, but it does not address |                            |
|   | the                                  |                            |
|   |                                      |                            |
|   | handling of security breaches where  |                            |
|   | an unauthorized individual accesses  |                            |
|   |                                      |                            |
|   | the system. Should part 11 address   |                            |
|   | investigations and followup when     |                            |
|   |                                      |                            |
|   | these security breaches occur?       |                            |
+---+--------------------------------------+----------------------------+
|   | D. Additional Questions for Comment  |                            |
+---+--------------------------------------+----------------------------+
| 1 | What are the economic ramifications  | There will be a positive   |
|   | of modifying part 11 based           | impact, because the level  |
|   |                                      | of compliance can be set   |
|   | on the issues raised in this         | to an appropriate level    |
|   | document?                            | which balances both        |
|   |                                      | quality and economical     |
|   |                                      | issues.                    |
+---+--------------------------------------+----------------------------+
| 2 | Is there a need to clarify in part   | It should be possible to   |
|   | 11 which records are required        | define electronic records  |
|   |                                      | within a process oriented  |
|   | by predicate rules where those       | approach, see also A2 and  |
|   | records are not specifically         | A3.                        |
|   | identified                           |                            |
|   |                                      |                            |
|   | in predicate rules? If so, how could |                            |
|   | this distinction be made?            |                            |
+---+--------------------------------------+----------------------------+
| 3 | In what ways can part 11 discourage  | If there are too much      |
|   | innovation?                          | general requirements which |
|   |                                      | do not fit to the          |
|   |                                      | individual situation.      |
|   |                                      |                            |
|   |                                      | If no migration of data is |
|   |                                      | possible with deletion of  |
|   |                                      | the original data.         |
|   |                                      |                            |
|   |                                      | If draft documents are     |
|   |                                      | defined as ERs and users   |
|   |                                      | prefer to deal with paper  |
|   |                                      | records.                   |
|   |                                      |                            |
|   |                                      | a to broad definition of   |
|   |                                      | the term electronic record |
|   |                                      | (see A2, A3, B1)           |
+---+--------------------------------------+----------------------------+
| 4 | What potential changes to part 11    | 1.  As a minimal           |
|   | would encourage innovation and       |     requirement the narrow |
|   |                                      |     interpretation of the  |
|   | technical advances consistent with   |     scope of 21 CFR Part   |
|   | the agency\'s need to safeguard      |     which is used in the   |
|   |                                      |     Guidance for Industry, |
|   | public health?                       |     August 2003, should be |
|   |                                      |     used.                  |
|   |                                      |                            |
|   |                                      | 2.  More process           |
|   |                                      |     orientation            |
|   |                                      |                            |
|   |                                      | 3.  the use of a risk      |
|   |                                      |     based approacht        |
|   |                                      |                            |
|   |                                      | 4.  The definition of      |
|   |                                      |     electronic records     |
|   |                                      |     itself should be based |
|   |                                      |     on a risk based        |
|   |                                      |     approach.(B1)          |
+---+--------------------------------------+----------------------------+
| 5 | What risk-based approaches would     | First a risk based         |
|   | help to ensure that electronic       | approach of process risks  |
|   |                                      | and then an analysis of    |
|   | records have the appropriate levels  | technical risks should be  |
|   | of integrity and authenticity        | performed.                 |
|   |                                      |                            |
|   | elements and that electronic         |                            |
|   | signatures are legally binding and   |                            |
|   |                                      |                            |
|   | authentic?                           |                            |
+---+--------------------------------------+----------------------------+
| 6 | The part 11 guidance announced that  | Combining the narrow       |
|   | the agency would exercise            | interpretation of the      |
|   |                                      | scope of 21 CFR Part 11    |
|   | enforcement discretion (during our   | and the risk based         |
|   | re-examination of part 11) with      | approach can help to       |
|   |                                      | eliminate concerns         |
|   | respect to all part 11 requirements  | regarding legacy systems.  |
|   | for systems that otherwise were      |                            |
|   |                                      | In addition a process      |
|   | operational prior to August 20, 1997 | oriented approach of ERs   |
|   | (legacy systems), the effective      | could help.                |
|   |                                      |                            |
|   | date of part 11. What are            |                            |
|   | stakeholder concerns in regards to   |                            |
|   |                                      |                            |
|   | modifications made to legacy systems |                            |
|   | in use as of August 1997?            |                            |
|   |                                      |                            |
|   | Can the use of risk mitigation and   |                            |
|   | appropriate controls eliminate       |                            |
|   |                                      |                            |
|   | concerns regarding legacy systems?   |                            |
+---+--------------------------------------+----------------------------+
| 7 | Should part 11 address record        | Yes, see B 5.2             |
|   | conversion?                          |                            |
+---+--------------------------------------+----------------------------+
| 8 | Are there provisions of part 11 that | A process oriented         |
|   | should be augmented,                 | approach is needed to      |
|   |                                      | define which data are data |
|   | modified, or deleted as a result of  | used in ERs.               |
|   | new technologies that have become    |                            |
|   |                                      | In general 21 CFR Part 11  |
|   | available since part 11 was issued?  | should provide             |
|   |                                      | requirements which are     |
|   |                                      | independent from           |
|   |                                      | technologies.              |
+---+--------------------------------------+----------------------------+

  -------------- --------------------------------------------------------
  Input from :   Konstantin Clevermann, IDS Scheer AG, D-Düsseldorf\
                 Lothar Helling, Boehringer Ingelheim Pharma GmbH & Co.
                 KG, D-Ingelheim\
                 Ralf Hössel, Boehringer Ingelheim Pharma GmbH & Co. KG,
                 D-Ingelheim\
                 Dr. Christoph Hornberger, EMR Engineering GmbH,
                 D-Ingelheim\
                 Robert Jaster, Boehringer Ingelheim Pharma GmbH & Co.
                 KG, D-Biberach\
                 Dr. Eberhard Klappauf, COMLINE AG, D-Frankfurt\
                 Dr. Thomas Linz, Schering AG, D-Berlin\
                 Martin Schulz, F. Hoffmann-La Roche Ltd, CH-Basel

  -------------- --------------------------------------------------------