![](media/image1.png)

*Setting Standards for Excellence*

## Robert G. Britain

Vice President, Medical Products

703-841-3241

Fax: 703-841-3341

bob_britain@nema.org

> July 1, 2004

Division of Dockets Management

Food and Drug Administration

5630 Fishers Lane, HFA -- 305

Room 1061

Rockville, MD 20852

**RE: Docket No. 2004N -- 0133**

#  Part 11 regulations - Electronic Records and Electronic Signatures

Dear Sir/Madame:

The National Electrical Manufacturers Association (NEMA) wishes to
express its appreciation to the Food and Drug Administration for
affording us the opportunity to submit our comments on the regulation of
electronic records and electronic signatures in the Part 11 regulations,
21 CFR Part 11. We wish to commend FDA on its decision to begin a
dialogue with stakeholders on proposed changes to the Part 11
regulations

NEMA is the largest U.S. trade association representing America's
electroindustry. The Diagnostic Imaging and Therapy Systems Division of
NEMA represents manufacturers of x-ray imaging, CT, radiation therapy,
magnetic resonance, nuclear medicine imaging, diagnostic ultrasound and
medical imaging informatics equipment. NEMA is a member of the Part 11
Coalition, which is comprised of manufacturers of food, drugs and
medical device products and other interested parties, which have an
interest in Part 11 Regulations.

While we are pleased to submit our comments on proposed changes to the
Part 11 regulations, NEMA first wishes to express serious concern about
FDA's announcement that it does not intend to reschedule the meeting on
Part 11 Regulations which was to be held on June 11, 2004. Discussion of
proposed modifications to Part 11 regulations, and the importance of the
Predicate Rules in the regulation of electronic records and signatures,
are issues best addressed by establishing an ongoing dialogue between
FDA and industry. The complexity and far reaching implications of these
regulations strongly support holding a public meeting where the views of
the agency and stakeholders can be fully aired.

It is clear that the importance of FDA's initial decision to hold a
public meeting was underscored by the enormous response of
representatives from the food, drug and medical device industry to
participate in this meeting. A decision not to reschedule this meeting
would be a mistake since it would dilute the input from stakeholders on
these critical issues. We strongly urge the agency to reconsider its
decision and convene this important forum at a later date.

In the following comments, NEMA wishes to particularly focus attention
on question \# 3 of the April 8, 2004 notice, particularly Part 11
Subpart B -- Electronic Records:

"Under the current part 11, the controls that apply to electronic
records that are maintained also apply to electronic records that are
submitted to FDA. Should the requirements for electronic records
submitted to FDA be separate from electronic records maintained to
satisfy predicate rule requirements? "

This question can best be addressed by an examination of the objectives
of the Part 11 regulations as compared with the scope and objectives of
the Predicate Rules.

## Objectives of Part 11 Regulations

The original, intended, key objectives of the Part 11 regulations were
to:

-Retain and document records

-Preserve and maintain the integrity and security of records

-Enable the FDA to be able to have access to records for copying and
inspection

-Ensure authentication of electronic signatures

-Establish accountability for maintaining records

-Create a means for validation of signatures

NEMA believes that the meaning and purpose of these objectives are
embodied in the Predicate Rules and therefore the simultaneous existence
of Part 11 regulations [and]{.underline} Predicate Rules serves only to
create a duplicative and confusing regulatory scheme.

Critically, this duplication of regulations also conflicts with "least
burdensome" principles. The intent of the "least burdensome" provisions
of the Food and Drug Modernization Act (FDAMA) of 2002 stressed the need
for minimizing excessive regulations. This is not the case with regard
to the regulations governing electronic records and signatures. Instead
of being able to rely upon a clear, single regulatory pathway,
manufacturers are faced with the confusing task of sorting out the
complexity of two parallel sets of regulations in order to ensure
compliance with Part 11 requirements.

This problem is compounded by the overly prescriptive provisions of Part
11 regulations. The prescriptiveness of these regulations deprives the
manufacturers of needed flexibility in maintaining compliance with the
regulations.

## Scope of the Predicate Rules --comparison with Part 11 Regulations

A review of the Predicate Rules demonstrates that these rules encompass
the objectives of the Part 11 regulations. This is evidenced by an
examination of the Quality System Regulation

(QSR) 21 CFR 820 et seq., Medical Device Reporting Regulation (MDR) 21
CFR 803 et seq., Corrections and Removals Regulation (C & R), 21 CFR 806
et seq. and Good Laboratory Practice Regulation (GLP) 21 CFR 58 et seq.
(See Appendix A attached hereto).

[It is crucial to recognize that the Predicate Rules embody the same
intent as the Part 11 regulations, but do so in a far less prescriptive
fashion.]{.underline}

For example, 21 CFR 11.10(a) states that controls for closed systems
shall include " Validation of systems to ensure accuracy, reliability,
consistent intended performance, and the ability to discern invalid or
altered records." Validation of systems is provided for in the QSR
Regulation, 21 CFR 820.70(i), and through provisions for document
controls, 21 CFR 820.40.

In 21 CFR 11.10(b), the regulation requires that controls be established
to ensure the ability to generate accurate and complete copies of
records in human readable or electronic form suitable for inspection and
review. The QSR regulation, 21 CFR 820.40(a) and 21 CFR 820.180 provides
that documents shall be available at all locations for which they are
designated or otherwise necessary, and all records shall be maintained
so as to be accessible to FDA personnel designated to perform
inspections. Similarly, comparing the MDR regulations with Part 11
regulations, the MDR regulation requires the maintenance of records and
required reports and electronic reporting to FDA in its provisions,
namely 21 CFR 803.1, 803.10, and 803.14. Analogous provisions for the
control of records to ensure access to FDA for inspection and review
exist in the C& R regulation, specifically, 21 CFR 806.10 and 806.30,
and in the GLP regulations, 21 CFR 58.15.

In the Part 11 regulations, 21 CFR 11.10 (c ) requires that records be
protected to enable their accurate and ready retrieval. Record
preservation is an integral part of the Predicate Rules as well, as
specified by the QSR in 21 CFR 820.20 and 21 CFR 820.180, in the MDR
regulations, 21 CFR 803.1, in the C & R regulations, 21 CFR 806.1 and in
the GLP regulations, 21 CFR 58.33 58.81, 58.190 and 58.195.

An important provision of the Part 11 regulations is the limitation of
access to records to authorized individuals, 21 CFR 11.10(d). The
limitation of access to records is incorporated in the QSR regulation 21
CFR 820.40 and 21 CFR 820.20, the document controls and management
responsibility provisions, respectively. 21 CFR 820.40 document controls
also addresses the use of computer-generated audit trails, as provided
in the Part 11 Regulations, 21 CFR 11.10(e). Quality audit requirements
for manufacturers are set forth in 21 CFR 820.22.

The Part 11 regulations are concerned also with operational system
checks, 21 CFR 11.10(f) and device checks, 21 CFR 11.10(g). The QSR
regulation addresses these areas in 21 CFR 820.70, Product/Process
control. By virtue of 21 CFR 820.20, management has responsibility for
ensuring that quality policy is understood, implemented and maintained
at all levels, and that an adequate organizational structure and
adequate resources are provided. Management responsibility also extends
to encompass the use of authority checks to ensure that only authorized
individuals can use the system, electronically sign a record, access the
operation or exercise other controls, as set forth in parallel in 21 CFR
11.10(g).

The duty of manufacturers to ensure that sufficient properly trained and
experienced personnel to carry out the requirements of the QSR is set
forth in 21 CFR 820.25. This encompasses the requirements in 21 CFR
11.10(i).

The Part 11 regulations in 21 CFR 11.10(j) require that policies be
established and adhered to that hold individuals accountable and
responsible for actions initiated under their electronic signatures. A
corresponding duty is imposed on management under the QSR, specifically
21 CFR 820.20.

Part 11 regulations in 21 CFR 11.10(k) also require use of appropriate
controls over systems documentation including adequate controls over
distribution and access to and use of documentation for system operation
and maintenance and putting in place revision and change control
procedures to maintain an audit trail. Here again, these areas in the
Part 11 regulations are covered in the QSR by 21 CFR 820.40. Similar
controls exist in the MDR regulation, 21 CFR 803.10, 803.14 and 803.17
and 803.18. These areas are also addressed in the GLP regulation by 21
CFR 58.33, 58.35, 58.190 and 58.195.

In addition to satisfying the objectives of the Part 11 regulations,
reliance on Predicate Rules conveys a number of other advantages.
Predicate Rules are accepted by FDA and industry and are comprehensive
in scope, having become an integral part of the established product
approval, corrections and problem reporting processes. They are also a
part of long-established medical device GMP practice. We believe the
comprehensiveness of the Predicate Rules adequately protect the public
health without resorting to the prescriptiveness of the Part 11
regulations.

The current Part 11 Final Guidance emphasizes the role of risk
assessment for Part 11 controls dealing with validation, audit trails
and record retention. In the Final Guidance it is stated that "We
\[FDA\] recommend that you base your approach on a justified and
documented risk assessment and a determination of the potential of the
system to affect product quality and safety, and record integrity."

NEMA wishes to commend FDA for taking this positive step with relation
to Part 11 controls. We agree that a risk-based system is the logical
and appropriate approach for the adoption of Part 11 controls. There are
a number of risk-based approaches and tools, which can be employed to
ensure product quality and safety, and to protect the integrity of
records. Use of a risk-based approach should be defined and documented.
However, it should not be too prescriptive or limited only to some areas
of Part 11 controls. Manufacturers should be permitted to apply their
own risk-based approach to any area pertaining to electronic records.

In conclusion, NEMA believes that based upon the comparison set forth
above, the Part 11 regulations are duplicative of the Predicate Rules,
and are burdensome and too prescriptive. We would propose that in order
to eliminate duplication and confusion, that FDA withdraw the Part 11
regulations in favor of the Predicate Rules. As an alternative, Part 11
regulations should be converted to a less prescriptive, risk-based
guidance document. This will allow manufacturers greater flexibility in
complying with the Part 11 regulations while at the same time adequately
protecting the public health.

NEMA appreciates the opportunity of presenting these views. NEMA's goal
is to work collaboratively with FDA to achieve a practical regulatory
pathway, which will satisfy the objectives of both FDA and industry.

If you have any further questions, please feel free to contact me. I can
be reached at (703) 841 -- 3241.

We look forward to further dialogue with you on these issues of great
importance to FDA and industry.

Sincerely,

![](media/image2.bmp)

Attachment

[APPENDIX A]{.underline}

PREDICATE RULES DUPLICATED BY PART 11 REGULATIONS

[PART 11 REGULATIONS]{.underline} [21 CFR 820-QSR
REGULATIONS]{.underline} \*

21 CFR 11.10(a) 21 CFR 820.70

Validation of systems Production/Process Controls

21 CFR 11.10(b) 21 CFR 820.40

Controls for closed systems Document Controls

### Ability to generate accurate 21 CFR 820.180

and complete copies of General Requirements

### records in both human readable 

and electronic form

21 CFR 11.10 ( c) 21 CFR 820.40, 820.180

Protection of records to enable Document controls/General

retrieval Requirements

21 CFR 11.10(d) 21 CFR 820.40

Limiting access to authorized individuals Document Controls

21 CFR 820.20

> Management responsibility

21 CFR 11.10(e) 21 CFR 820.40

Use of secure computer-generated Document Controls

Time-stamped audit trails to

Record date/time of operator

Entries and actions which create, modify

Or delete electronic records

21 CFR 11.10(f) 21 CFR 820.20

Use of operational system checks Management responsibility

to enforce permitted sequencing of steps

and events, as appropriate

21 CFR 11.10(g) 21 CFR 820.20

Use of authority checks to ensure that Management responsibility

only authorized individuals can use the

the operation or computer system input or

output device, alter a record, or perform

the operation at hand

21 CFR 11.10(h) 21 CFR 820.25

Use of device (e.g. terminal) checks Personnel

to determine the validity of the source

of data input or operational instruction

[PART 11 REGULATIONS]{.underline} [21 CFR 820 -- QSR
REGULATIONS]{.underline} \*

21 CFR 11.10(i) 21 CFR 820.25

Determination that persons who develop, Personnel

maintain or use electronic record/electronic

signature systems have the education, training

and experience to perform their assigned tasks

21 CFR 11.10(j) 21 CFR 820.20

Establishment of policies that hold Management Responsibility

individuals accountable

21 CFR 11.10(k) 21 CFR 820.40

System Documentation controls Document controls

(1) Adequate controls over the distribution

> of, access to, and use of documentation
>
> for system operation and maintenance

(2) Revision and change control procedures

> To maintain an audit trail

[PART 11 REGULATIONS]{.underline} [21 CFR 803 --MDR
REGULATIONS]{.underline} \*

21 CFR 11.10(b) 21 CFR 803.1

Controls -- generate copies of Maintain Records

records for inspection

21 CFR 11.10( c) 21 CFR 803.1

Protection of records to Maintain Records

enable retrieval

21 CFR 11.10(b) 21 CFR 803.10

Controls Required Reports

21 CFR 11.10(b) 21 CFR 803.14

Controls Electronic Reporting

21 CFR 11.10(k) 21 CFR 803.17

System Documentation Controls Written MDR Procedures

21 CFR 11.10(e) 21 CFR 803.18

Audit Trails File/Distributor

Reports (MDR events)

21 CFR 11.10(k) 21 CFR 803.18

System Documentation Controls File/Distributor

Reports (MDR events)

[PART 11 REGULATIONS]{.underline} [21 CFR 806 - CORRECTION AND
REMOVALS_REGULATIONS]{.underline} \*

21 CFR 11.10(b) 21 CFR 806.1

Controls Maintain Records

21 CFR 11.10( c) 21 CFR 806.1

Protection of Records Maintain Records

21 CFR 11.10(b) 21 CFR 806.10

Controls Corrections and Removals Reports

21 CFR 11.10(b) 21 CFR 806.30

Controls FDA Access to Records

[PART 11 REGULATIONS]{.underline} [21 CFR 58 - GOOD LAB. PRACTICE
REGULATIONS]{.underline} \*

21 CFR 11.10(b) 21 CFR 58.15

Records for Inspection Inspection of Records

21 CFR 11.10(i) 21 CFR 58.29

Education/Training of Personnel Personnel -- Education and Training

21 CFR 11.10 ( c) 21 CFR 58.33

Protection of Records Study Director -

Responsibility for Documentation

21 CFR 11.10(k) 21 CFR 58.33

System Documentation Controls Study Director-

Responsibility for Documentation

21 CFR 11.10(g) 21 CFR 58.35

Authority System Checks Quality Assurance Unit

21 CFR 11.10(k) 21 CFR 58.35

System Documentation Controls Quality Assurance Unit

21 CFR 11.30 21 CFR 58.35

Controls over Open Systems Quality Assurance Unit

21 CFR 11.10( c) 21 CFR 58.81

Protection of Records Written Standard Operating

Procedures

[PART 11 REGULATIONS]{.underline} [21 CFR 58 - GOOD LAB. PRACTICE
REGULATIONS]{.underline} \*

21 CFR 11.10 ( c) 21 CFR 58.190

Protection of Records Storage and Retrieval of Records

21 CFR 11.10(k) 21 CFR 58.190

System Documentation Controls Storage and Retrieval of Records

21 CFR 11.10( c) 21 CFR 58.195

Protection of Records Retention of Records

21 CFR 11.10(k) 21 CFR 58.195

System Documentation Controls Retention of Records

\* NOTE: Intent of Predicate Rules is the same as Part 11 Regulations,
but less prescriptive.