Memo of Meeting

Date: January 17, 2002

Representing Alchemedia Technologies, Inc.:

Daniel Schreiber, Chief Executive Officer

H.E. Buddy Wilson, Sr. VP, Business Development

Dave Carlson, Director, Business Development

Representing FDA:

Charles A. Snipes, Compliance Officer, Center For Drug Evaluation and
Research

Dennis M. Dignan, Consumer Safety Officer, Center For Food Safety &
Applied Nutrition

Aydin Orstan, Consumer Safety Officer (detailed to Office of Enforcement
from CFSAN)

James McCormack, Consumer Safety Officer, Office of Enforcement

Jeff Smith, Project Officer- Regulatory Systems, Center for Biologics
Evaluation and Research

Paul J. Motise, Consumer Safety Officer, Office of Regulatory Affairs

The meeting was held at the request of the Alchemedia representatives,
to discuss their electronic records management product (Mirage) in the
context of 21 CFR Part 11. At the start of the meeting we explained that
FDA does not formally review, approve or disapprove of products or
services that enable people to comply with FDA regulations. We advised
that the meeting would be an information exchange and that our comments
should not be taken as formal FDA positions.

The Alchemedia representatives explained that their four year old
company produces an electronic document management program that is
intended, among other things, to help the FDA regulated industries meet
21 CFR Part 11 requirements. Most of the firm's customers are regulated
by FDA.

The Alchemedia representatives described the problems with electronic
records that their software is intended to address: data confidentiality
and data currency. They explained that unauthorized information
disclosures derive mainly from within an organization; the ease of
electronic record duplication and dissemination increases a firm's
vulnerability to this problem. Likewise, such dissemination and
replication of records within an organization, coupled with the ease of
electronic record modification, increases the likelihood that employees
will work with outdated copies of electronic records that are stored on
local computers. Records mutate and propagate in poorly controlled
environments.

The Alchemedia representatives commented that, according to a study by
Price Waterhouse Coopers, the above problems of data confidentiality and
currency cost the Fortune 1000 companies about \$15 million per company.

The Alchemedia representatives explained that their software product,
Mirage, is a web based client/server application. The program, by
working together with server based Livelink document server, enables
system administrators to determine who can print, forward, save, or
screen capture an electronic record. End users may display the record
locally, but further actions can be restricted. The representatives gave
us a brief demonstration of how a restricted electronic record could be
viewed, but not saved or copied to a Windows clipboard. Unauthorized
attempts at record copying, printing, saving or forwarding generate
encrypted versions of the record. The record remains encrypted in RAM
but decrypted at the video driver level. Attempts to perform a screen
capture of protected records results in a display of a pattern of Mirage
software logos. Record protection is configurable down to sub-documents,
and employs the advanced encryption standard and RSA authentication
algorithms. A computer that did not have the client code installed would
not be able to view the record from a server that did have the
application installed.

The firm's software performs in a like manner with Documentum, and
functions on any web based application in the Windows, Solaris and Sun
computing environments. The Alchemedia representatives commented that
their program does not alter the electronic records themselves nor the
records' associated digital signatures. End users see a "Mirage" of the
electronic records in native HTML or PDF format, in that they can view,
but not "touch" the records. In addition, a record may be rendered
unreadable upon a configurable expiration date.

Regarding audit trails of end user privileges, the representatives
commented that the next release of their product would include that
feature.

During the meeting we discussed the firm's validation efforts. The
representatives said they would welcome customer audits of their
software development activities. The firm will also provide software
test scripts upon request.

We commented that many of the requirements implemented in Mirage which
were being attributed to Part 11 were, in fact, necessitated out of long
standing predicate rules.

The meeting lasted about two hours.

Attached to this memo are two PDF files of material provided by the
firm; a white paper entitled "The Business Case For Deploying Mirage In
Pharmaceutical Companies", and flyer entitled "Control is an Illusion,
Mirage and Documentum Overview".

cc:

FDA Attendees

HFA-224

Part 11 Guidance Dockets

Doc ID AlchemediaMemoOfMeeting011702.doc

P. Motise 01/28/02

![](media/image1.wmf)![](media/image2.wmf)