![](media/image1.jpeg){width="4.190972222222222in"
height="1.1868055555555554in"}

**Response to:**

**Guidance for Industry 21 CFR Part 11; Electronic Records; Electronic
Signatures**

**Maintenance of Electronic Records**

**Reference Docket Number: 00D-1539**

**Prepared By:**

PharmaSys, Inc

216 Towne Village Drive

Cary, North Carolina 27513

# 1.0 Introduction

PharmaSys, Inc is a full service contract validation firm specializing
in FDA regulated industries (Drugs, Biotech, Medical Devices and
Clinical Trials). We understand cGMP\'s, GLP\'s and GCP\'s and can
provide audits, validation and compliance support for information,
manufacturing and laboratory systems.

PharmaSys, Inc is dedicated to providing the pharmaceutical industry
with validation and compliance services of unsurpassed commitment and
value. This commitment is reinforced by keeping employees updated on
draft guidance and initiatives, as well as newly released final
regulations.

# Scope

The scope of this document is limited to the comments and suggestions
that were obtained from PharmaSys employee's review of the Draft
Guidance for Industry 21 CFR Part 11; Electronic Records; Electronic
Records Maintenance of Electronic Records.

# Responses

# Maintenance of Records

> The overriding cGMP requirement and philosophy to maintain records, be
> they paper or electronic, is that the information contained in those
> records continues to be accurately documented as it was originally
> recorded, over the retention period of those records.
>
> There is no cGMP requirement of the form, of those records except in
> specific cases where paper records are require for FDA submissions.
>
> Although the scope of the guidance document focuses on the maintenance
> aspects of electronic records, there should be some discussion on the
> conversion of paper records to electronic records and conversion of
> electronic records to paper, with respect to maintenance (retention)
> of these records.
>
> It may be desirable for an organization to terminate electronic
> storage of records when confronted with the complications of migration
> or system obsolescence. A conversion of the electronic records to
> paper record storage may be the only viable solution.

# Process Information

> The term, "process information", is used in several instances without
> definition. Systems that acquire data, perform calculations, and make
> quantitative decisions, are substantially different in their processes
> than systems that just record and regurgitate information.
> Amalgamating them into one collective basket will overburden the
> industry with inappropriate practices. A spectrum of "processes"
> should be explored.

# Belief

> The term belief or believe is used several times in the document.
> Although it may be the writer's stylistic choice, it does not add to
> the value of the information. It has the potential of being
> misconstrued as being what the agency desires. If desires are what the
> agency intends to project, then it would be better in writing form and
> more useful to the audience, to be explicit in those expectations.
>
> If there is no implied expectation, then those phrases can be reworded
> to eliminate the ambiguity of the agency\'s intent, while still
> presenting useful information.

# Specific Sections

**[Section]{.underline} [Question / Comment]{.underline}**

**5.1**    Should a change control procedure be added?

**5.2** Should storage and security of media that record data be
mentioned here?

**5.3** There is no substantive need to periodically access a
representative number of electronic records. If a volatile storage media
is used, than a periodic refresh of that media is dictated by known
storage limitations.

With the low cost and high capacity of non-volatile storage, it's
somewhat inane for one to consider the use of volatile media for long
term storage.

**5.3 ¶ 2** By the time you have difficulty reading from volatile media,
it's already too late in terms of reliability.

**5.3 ¶ 3** The distinction of "most important" electronic records is a
gaping hole for controversy. All cGMP records should be secure; i.e.
backed up, safe from destruction, prior to the conclusion of the
retention period.

**5.4** "You should monitor the conditions under which the electronic
records are stored"

> If the answer is not obvious to the PharmaSys staff (and easily agreed
> to) then we might ask for this clarification --
>
> Is it suggested that the records be maintained for the environmental
> monitoring of the conditions the electronic records are stored in?  Do
> the conditions need to be validated?

**5.4**   Should the storage conditions not only be monitored, but
verified/validated?

6.  This paragraph implies that a copy process, that employs a copy
    verification mechanism, does not require validation!

**6.1** The guidance discusses first a \"time capsule\" approach for
maintaining data in it\'s original format w/ original system/equipment. 
This amounts to \"mothballing\" a system for as long as possible so that
original data may be retrieved for the physical lifespan of a system. 
Don\'t think this is even a good topic for discussion\...it opens some
rather big doors. 

>  
>
> First, personnel's training becomes a serious issue as the lifespan of
> the system increases.  Second, as pointed out in the document, system
> support from the vendor may be terminated for any number of reasons
> (lack of parts, trained personnel, expense, etc\...).  Third, it\'s
> extremely shortsighted.  I don\'t expect the technology industry as a
> whole to give much thought to long-term data integrity.  I think most
> companies will expect to have to migrate data to other formats over
> time as better storage/retrieval techniques become available (where
> did DOS go in just the past five years?), especially as more
> information is becomes accessible across the Web.
>
>  
>
> So, this brings me to another question\...will the tech industry, at
> least those vendors specializing in cGMP databases, be required to
> abide by an imposed industry-standard to address long-term retrieval,
> etc\...?
>
>  
>
> In short, I think we should expect data storage systems to be dynamic,
> and that companies are going to migrate data out of necessity.  The
> guidance document doesn\'t seem to push that point as boldly as I
> would expect.

**6.1** Should Time Capsule Approach involve protecting as well as
preserving?

Should there be mention of virus protection software? 

**6.2.1.4** There are no 21 CFR Part 11 requirements that indicate that
an electronic record system must be able to search, sort, or process
information through the electronic record's retention period. The intent
of Part 11 retention is to be able to retrieve a record in shape or form
that represents the original information that allowed the organization
to discern that procedures were followed, documented and met applicable
quality standards of that time.

The ability of a system to search, sort, or process information goes
beyond the necessity of cGMP record keeping and retention.

This section may be more meaningful if indexing features were delineated
from decision-making features. The ability to make decisions based upon
information in the records is imperative.

A feature employed in an earlier version of a system may not be of value
in successive versions. Preservation of features is not necessary for
decision making and may hinder technological progress.

**6.2.1.5** "\[A\] trusted third party from outside of the organization
that has some responsibility for the electronic record..." This
statement does not make sense. How can anyone outside of the
organization have any responsibility for the electronic records?

# General Questions

-   Should it be stated what authority to go to see if an electronic
    record would be acceptable for a submission?

-   Should the difference in electronic record requirements between
    \"Open Systems\" and \"Closed Systems\" be reviewed?

-   Should what is acceptable for electronics signatures if using User
    Name/Password vs. Biometrics be reviewed?

-   What about migrating existing electronic data to a new release of
    software. I think that this could be a critical area. Clients should
    have SOPs in place that would guide them in this process (i.e.
    Microsoft is releasing a new VB this new version of VB has many data
    structure changes).

-   After data migration, would it be prudent to verify the number of
    bytes transferred?

-   Section 11.10(e):    Should e-signatures be included with audit
    trails?

```{=html}
<!-- -->
```
-   When determining how many records need to be periodically checked to
    ensure continued availability / readability is the use of ANSI
    sampling procedure sufficient or should another sampling procedure
    be used?

-   If validating a software package and the audit trail reporting
    function is generated by the system administrator as a file that is
    then saved and unalterable but can be altered between the time of
    audit trail report generation and saving the file (only by the
    system administrator), is a SOP stating that a second party verifies
    (signs off on a company form) the process and that the System
    Administrator does not alter the file allowable OR is this software
    not Part 11 compliant?

-   When validating an electronic records migration, does every record
    need to be checked for all information / data, or can ANSI or
    another statistical sampling justification be used to limit the
    number of records need to be verified (as long as all verified
    records are correct and complete)?

# General Comments

-   The media that records are stored on should be evaluated for its
    longevity into the future and perhaps a plan for migration to the
    new format. Reading devices may be obsolete for the original media.

-   Software that was used to generate the records should be maintained
    with the records to insure the accessibility of such records in the
    future. Software will change and become obsolete (remember
    WordStar?). New software may not be able to decode old software from
    a different vendor.