Triangle PEERS

Research Triangle Park

North Carolina

## April 23, 2003

Dockets Management Branch (HFA-305)

### Food and Drug Administration

5630 Fishers Lane, rm. 1061

Rockville, MD 20852

Re: Docket Nos. 03D-0060, 99D-1458, 00D-1538, 00D-1543, 00D-1542, and
00D-1539

To Whom It May Concern:

Triangle PEERS is pleased to submit comments in response to the FDA's
*Draft* Guidance for Industry on "Part 11, Electronic Records;
Electronic Signatures -- Scope and Application" issued February 2003.
Triangle PEERS is an informal association comprised of entities and
individuals in North Carolina with an interest in the implementation and
enforcement of 21 CFR Part 11.

# General Comments on *Draft* Guidance

Triangle PEERS applauds the FDA for moving towards a more practical
approach for implementation and enforcement of Part 11 that allows
industry greater flexibility while maintaining integrity of electronic
data. In particular, Triangle PEERS is pleased that the FDA has acted to
narrow the scope of Part 11 which had been broadened since 1997 through
a number of informal interpretations and previous draft Guidances.
Further, we support the Agency's decision to exercise enforcement
discretion in certain areas while it considers revising the Part 11
regulation.

We are, however, concerned that the *Draft* Guidance provides limited
explanation of this enforcement discretion. We urge the Agency to
clarify this matter in the *final* Guidance as soon as possible.

We note that the *Draft* Guidance states that it is withdrawing numerous
earlier draft Guidances, and the document includes a non-exhaustive
list. However, Triangle PEERS asks that the Agency specifically confirm
that the FDA Guidance for Industry, *Computerized Systems Used in
Clinical Trials*, April 1999, which had been heavily relied upon by the
industry, has also been withdrawn. The Introduction, Section I of that
document, specified that it "addresses requirements of the Electronic
Records/Electronic signatures rule (21 CFR part 11)." If not withdrawn,
the Agency should address direct conflicts between the two Guidance
documents. See for example, *Computerized Systems Used in Clinical
Trials,* Section III.H: "Changes to data that are stored on electronic
media will always require an audit trail, in accordance with 21 CFR
11.10(e)," which apparently contradicts Section III.C (2) of the *Draft*
Guidance.

We understand that the Preamble comments to 21 CFR Part 11 do not have
the authority of law or regulation and served as Guidance for the
Agency's thinking when issued in August 1997. Now, the *Draft* Guidance
"describe\[s\] the Agency's *current* thinking" on Part 11.
Nevertheless, to reduce possible misunderstanding by the industry,
Triangle PEERS strongly suggests that the Agency issue instructions in
the *final* FDA Guidance, *Scope and Application*, stating that in the
event of inconsistencies or conflicting language between the *final*
Guidance document and the Preamble comments to 21 CFR Part 11, then the
language of the *final* Guidance document would prevail.

# Section II. Background

Triangle PEERS notes that the withdrawal *in toto* of the previously
issued draft Guidance documents and the Compliance Policy Guide 7153.17
leaves the Industry without current guidance in certain areas. For
instance, the withdrawn *Time Stamps* draft Guidance was helpful in
terms of advising industry how to implement workable solutions to ensure
time stamp accuracy. In particular, Section 5.3, Time Zones, of that
draft Guidance set forth the Agency's revised position and specifically
superseded comment #101 of the Preamble to Part 11 with respect to the
time zone to be recorded. Comment #101 stated that, "Regarding systems
that may span different time zones, the agency advises that the signer's
local time is the one to be recorded." Allowing industry to implement
time stamps with clear documented references to the time zone used was a
helpful solution for time zone accuracy. Triangle PEERS urges FDA to
clarify its position on Preamble comment #101 in light of the withdrawn
*Time Stamp* draft Guidance.

# Section III.B. 1. Narrow Interpretation of Scope

The narrowed interpretation of the scope of Part 11 is most welcome but
some clarification is requested. Industry needs information from the FDA
regarding Part 11 applicability where ostensible predicate rules exist
but do not address or require specific records. Specifically, we ask for
guidance where predicate rules require an [activity]{.underline} but do
not mention record requirements to demonstrate fulfillment of that
activity. In such instances, is it an appropriate interpretation that
electronic records maintained to prove that the activity occurred are
not within the scope of predicate rules to trigger Part 11? For example,
21 CFR §312.50 and §312.56 require sponsors to monitor the progress of
clinical investigations, yet no records are specifically mentioned. As a
result, it would appear that monitoring visit reports retained
electronically would not be subject to predicate rules with respect to
Part 11, but would fall under the risk assessment approach enunciated in
the new *Draft* Guidance.

Another area for clarification regards hybrid systems. In almost every
case, computer systems allow printouts of records. We ask that the
Agency provide some clarification regarding when a system is considered
truly "merely incidental" to creation of the records that are then used
in paper. Several examples of what do and do not constitute "the merely
incidental use of computers" (lines 151-154) would be useful.

The *Draft* Guidance indicates the acceptability of retaining electronic
records in forms other than electronic format so long as predicate rules
are complied with and other forms of the records preserve content and
meaning. With many current laboratory instrument systems, the raw data
is recorded on a computer, and it is important to keep the original raw
data. Some have interpreted this to require retention in the original
electronic format, which is technologically burdensome over time and
apparently conflicts with the *Draft* Guidance.

In our view, any seeming inconsistency between 21 CFR §58.190 of the
Good Laboratory Practice (GLP) regulations and the *Draft* Guidance can
be reconciled as follows. In 21 CFR §58.190(a), it states: \"All raw
data, documentation, protocols, final reports and specimens generated as
a result of a nonclinical study shall be retained.\" If FDA interprets
the word \"generated\" as referred to in lines 151-154 of the *Draft*
Guidance to include the printing out of a paper record, then the paper
record could be considered the \"original raw data\" that has been
\"generated.\" In that case, only the paper record would need to be
retained. Per this subsection, we ask for confirmation that if data and
information are gathered *via* electronic laboratory equipment and a
paper record is generated from that equipment, then the paper record may
be treated as the original raw data (source document) so that only the
paper record needs to be retained.

# 

# Section III.B. 2. Definition of Part 11 Records

In this section of the *Draft* Guidance, a firm can determine in advance
whether its official record is paper or electronic, although it retains
both formats. In order to be consistent with the *Draft* Guidance,
Triangle PEERS recommends that the FDA Inspector review the records in
the format designated by the company as the "official record."

Triangle PEERS draws Agency attention to the lines 184 through 190 in
the *Draft* Guidance. In particular, lines 187-190 indicate "a record
that is not itself submitted, but is used in generating a submission, is
not a Part 11 record unless it is otherwise required to be maintained by
a predicate rule and it is maintained in electronic format." What does
the Agency intend by the phrase "used in generating a submission"? Does
this specifically refer to a document submission system that collects
and/or collates data, which is subsequently submitted to the Agency by
the same system? Or does this mean [any]{.underline} system that
collects data (not required by predicate rule) but which is used to
calculate parameters required by predicate rules, and then those
parameters are part of the data included in the Agency submission?

# Section III.C.1. Validation

Triangle PEERS notes that the *Draft* Guidance allows considerable
leeway in determining the necessity for validation. Some of the language
in section III is vague and can appear to contradict the expressed
intent. For example, lines 36-37 state, "We will not normally take
regulatory action to enforce compliance with the validation . . .
requirements of Part 11 as explained in this guidance." Lines 203-210,
however, discuss validating a system even if there is no predicate rule
requirement for validation. Accordingly, the details in section III are
inconsistent and could create industry disparity in determining
appropriate validation activities.

Consequently, this inconsistency could foster varying enforcement
discretion among FDA Inspectors with respect to Part 11 and validation.
For instance, one company could be cited by the Agency because that
company claims a system is critical and then does a poor job of
validation and implementation (i.e., system not under control). In
contrast, another company may escape Agency citation by developing
justification that the same system used in the same manner is not
critical, and therefore, Part 11 and validation do not apply.
Accordingly, Triangle PEERS urges Agency consistency in the issuance of
citations and recommends citations include sufficiently detailed
explanations to enable the industry to understand FDA's expectations for
validation and Part 11 compliance.

Further, the reference in the *Draft* Guidance to NIST Special
Publication SP800-30: *Risk Management Guide for Information Technology
Systems* is somewhat helpful, but that publication is intended to
address risk to systems, not to patient safety and product quality. This
NIST publication also outlines a cumbersome and voluminous risk
assessment process. Triangle PEERS requests that the Agency provide more
practical guidance regarding the Agency's expectation regarding the
content and scope of the risk assessment documentation process.

# Section III.C.2. Audit Trail

This section on audit trail options provides more flexible alternatives
while allowing organizations to address the overall concerns for
sequencing events and providing attributability.

**[Section III.C.3. Legacy Systems]{.underline}**

We ask that the *Draft* Guidance use consistent language to reflect when
the Agency intends to exercise enforcement discretion with regard to
legacy systems. Section I. Introduction, lines 41- 44, indicate that the
Agency "will not normally take regulatory action to enforce Part 11 with
regard to systems that were operational before August 20, 1997, the
effective date of Part 11. . . " This language allows for broader
inclusion of legacy systems for potential enforcement discretion than is
expressed in Section III.C.3. Lines 236-237, however, clearly limit the
enforcement discretion to "legacy systems that **otherwise met predicate
rule requirements** prior to August 20, 1997, the effective date of Part
11." (emphasis added). Triangle PEERS recommends that the Agency amend
lines 41-44 and 236-237 as appropriate for consistency of
interpretation.

Triangle PEERS strongly urges a clear explanation regarding how the
Agency will treat legacy systems that have been enhanced or changed
since August 20, 1997, the effective date of Part 11. Common sense
coupled with technological innovation suggests that very few legacy
systems would be operational today that had not undergone some change or
enhancement in the past six years. The extent and allowability of change
or enhancement of legacy systems need to be clarified in order to
provide uniform industry understanding of the scope of the enforcement
discretion for legacy systems. We suggest that legacy systems that have
been enhanced or changed since 1997, yet have been maintained in a state
of control or validation, should retain the legacy system status.

# Section III.C.4. Copies of Records

Triangle PEERS appreciates the Agency's guidance on copies of records.

# Section III.C.5. Record Retention

# Triangle PEERS commends the Agency for providing alternative mechanisms to address what is required by the Agency for long-term record retention. 

However, footnote 6 referenced in this section provides examples of
hybrid situations, which include "paper records and electronic
signatures." Triangle PEERS questions whether a valid electronic
signature would be linked to an underlying paper record. Accordingly, we
recommend that footnote 6 be modified to read as follows: "Examples of
hybrid situations include combinations of paper records and electronic
records, or handwritten signatures executed to electronic records."

\* \* \*

In conclusion, Triangle PEERS considers the *Draft* Guidance a workable
approach to Part 11. However, we request clarification in several areas
and urge consistent enforcement.

Triangle PEERS appreciates the opportunity to submit comments to FDA's
*Draft* Guidance for Industry on "Part 11, Electronic Records;
Electronic Signatures -- Scope and Application".

Sincerely,

Lowrie M. Beacham

Co-Chair

Triangle PEERS

Research Triangle Park

North Carolina