Electronic Systems, Electronic 
Records, and Electronic Signatures 
in Clinical Investigations 
Questions and Answers 
 
Guidance for Industry 
 
DRAFT GUIDANCE 
 
  This guidance document is being distributed for comment purposes only. 
 
Comments and suggestions regarding this draft document should be submitted within 60 days of 
publication in the Federal Register of the notice announcing the availability of the draft guidance.  
Submit electronic comments to https://www.regulations.gov.  Submit written comments to the 
Dockets Management Staff (HFA-305), Food and Drug Administration, 5630 Fishers Lane, Rm. 
1061, Rockville, MD 20852.  All comments should be identified with the docket number listed in the 
notice of availability that publishes in the Federal Register. 
 
For questions regarding this draft document, contact (CDER) Elizabeth Kunkoski, 
elizabeth.kunkoski@fda.hhs.gov or 301-796-6439; (CBER) Office of Communication, Outreach and 
Development, 800-835-4709 or 240-402-8010; (CDRH) Office of Clinical Evidence and Analysis, 
CDRHClinicalEvidence@fda.hhs.gov; (CFSAN) yuguang.wang@fda.hhs.gov or 240-402-1757; 
(CTP) ctp-bimo@fda.hhs.gov; or (CVM) Eric Nelson eric.nelson@fda.hhs.gov or 240-402-5642.  
 
U.S. Department of Health and Human Services 
Food and Drug Administration 
Center for Drug Evaluation and Research (CDER) 
Center for Biologics Evaluation and Research (CBER) 
Center for Devices and Radiological Health (CDRH) 
Center for Food Safety and Applied Nutrition (CFSAN) 
Center for Tobacco Products (CTP) 
Center for Veterinary Medicine (CVM) 
Office of Regulatory Affairs (ORA) 
Office of Clinical Policy (OCLiP) 
 
 
March 2023 
Procedural 
Revision 1
36905975dftrv1   
Electronic Systems, Electronic Records, and Electronic Signatures in Clinical 
Investigations:  Questions and Answers 
Guidance for Industry 
 
Additional copies are available from: 
Office of Communications, Division of Drug Information  
Center for Drug Evaluation and Research 
Food and Drug Administration 
10001 New Hampshire Ave., Hillandale Bldg., 4th Floor  
Silver Spring, MD 20993-0002  
Phone: 855-543-3784 or 301-796-3400; Fax: 301-431-6353 
Email: druginfo@fda.hhs.gov  
https://www.fda.gov/drugs/guidance-compliance-regulatory-information/guidances-drugs  
and/or 
Office of Communication, Outreach and Development  
Center for Biologics Evaluation and Research 
 Food and Drug Administration 
10903 New Hampshire Ave., Bldg. 71, Room 3128 
Silver Spring, MD 20993-0002 
Phone: 800-835-4709 or 240-402-8010 
Email: ocod@fda.hhs.gov 
https://www.fda.gov/vaccines-blood-biologics/guidance-compliance-regulatory-information-biologics/biologics-guidances     
and/or 
Office of Policy 
Center for Devices and Radiological Health 
Food and Drug Administration 
10903 New Hampshire Ave., Bldg. 66, Room 5431 
Silver Spring, MD 20993-0002 
Email: CDRH-Guidance@fda.hhs.gov 
https://www.fda.gov/medical-devices/device-advice-comprehensive-regulatory-assistance/guidance-documents-medical-devices-and-radiation-
emitting-products  
and/or 
Center for Food Safety and Applied Nutrition 
Food and Drug Administration 
5001 Campus Drive 
College Park, MD 20740 
Phone:240-402-1700 
https://www.fda.gov/food/guidance-regulation-food-and-dietary-supplements 
and/or 
Center for Tobacco Products 
Food and Drug Administration  
10903 New Hampshire Ave., Bldg. 75  
Silver Spring, MD 20993-0002 
Phone: 240-402-7970  
 https://www.fda.gov/tobacco-products/products-guidance-regulations/rules-regulations-and-guidance 
and/or 
Policy and Regulations Staff, HFV-6 
Center for Veterinary Medicine 
Food and Drug Administration 
7500 Standish Place, Rockville, MD 20855 
https://www.fda.gov/animal-veterinary/guidance-regulations/guidance-industry 
 
U.S. Department of Health and Human Services 
Food and Drug Administration 
Center for Drug Evaluation and Research (CDER) 
Center for Biologics Evaluation and Research (CBER) 
Center for Devices and Radiological Health (CDRH) 
Center for Food Safety and Applied Nutrition (CFSAN) 
Center for Tobacco Products (CTP) 
Center for Veterinary Medicine (CVM)  
Office of Regulatory Affairs (ORA) 
Office of Clinical Policy (OCLiP) 
 
March 2023 
Procedural 
Revision 1 
  Contains Nonbinding Recommendations 
Draft  Not for Implementation 
TABLE OF CONTENTS 
 
I.  INTRODUCTION............................................................................................................. 1 
II.  BACKGROUND ............................................................................................................... 2 
III.  QUESTIONS AND ANSWERS ....................................................................................... 3 
A.  Electronic Records (Q1  Q6) .......................................................................................... 4 
B.  Electronic Systems Owned or Controlled by Sponsors or Other Regulated Entities 
(Q7  Q16)  ......................................................................................................................... 7 
C.  Information Technology Service Providers and Services (Q17  Q19) ..................... 15 
D.  Digital Health Technologies (Q20  Q23) ..................................................................... 17 
E.  Electronic Signatures (Q24  Q28)  ............................................................................... 21 
GLOSSARY................................................................................................................................. 24 
APPENDIX:  RELEVANT GUIDANCE DOCUMENTS ...................................................... 29 
  Contains Nonbinding Recommendations 
Draft  Not for Implementation 
1  Electronic Systems, Electronic Records, and Electronic Signatures 
2  in Clinical Investigations 
3  Questions and Answers 
4  Guidance for Industry1 
5   
6   
7  This draft guidance, when finalized, will represent the current thinking of the Food and Drug 
8  Administration (FDA or Agency) on this topic.  It does not establish any rights for any person and is not 
9  binding on FDA or the public.  You can use an alternative approach if it satisfies the requirements of the 
10  applicable statutes and regulations.  To discuss an alternative approach, contact the FDA staff responsible 
11  for this guidance as listed on the title page.   
12   
13   
14   
15   
16  I.  INTRODUCTION  
17   
18  This document provides guidance to sponsors, clinical investigators, institutional review boards 
19  (IRBs), contract research organizations (CROs),2 and other interested parties on the use of 
20  electronic systems,3 electronic records, and electronic signatures in clinical investigations4 of 
21  medical products,5 foods, tobacco products,6 and new animal drugs.7  The guidance provides 
22  recommendations regarding the requirements, including the requirements under 21 CFR part 11 
23  (part 11), under which FDA considers electronic systems, electronic records, and electronic 
 
1 This guidance has been prepared by the Office of Medical Policy in the Center for Drug Evaluation and Research 
(CDER) in coordination with the Center for Biologics Evaluation and Research (CBER), the Center for Devices and 
Radiological Health (CDRH), the Center for Food Safety and Applied Nutrition (CFSAN), the Center for Tobacco 
Products (CTP), the Center for Veterinary Medicine (CVM), the Office of Regulatory Affairs (ORA), and the Office 
of Clinical Policy (OCLiP) at the Food and Drug Administration. 
2 In some clinical investigations, a sponsor may transfer responsibility for any or all of its obligations under 21 CFR 
part 312 to a CRO (21 CFR 312.52).  The requirements and recommendations that apply to sponsors throughout this 
guidance would also apply to CROs to the extent they have accepted responsibility for the sponsors obligations.    
3 Words and phrases in bold italics are defined in the Glossary. 
4 For FDAs regulatory definitions of clinical investigation or investigation, see, e.g., 21 CFR 50.3(c), 56.102(c), 
312.3(b), and 812.3(h).  In this guidance, the terms clinical trial, trial, clinical study, study, clinical investigation, 
and investigation are interchangeable.  
5 In this guidance, the term medical products refers to human drugs and medical devices, including those that are 
licensed as biological products. 
6 Part 11 requirements only apply to records required under predicate rules; therefore, part 11 requirements do not 
apply to a request to use an investigational tobacco product at this time.  However, we encourage sponsors, clinical 
investigators, and other interested parties to review this guidance for recommendations related to the use of 
electronic systems, electronic records, and electronic signatures in clinical investigations.  
7 See 21 CFR 11.1(b).  
1  Contains Nonbinding Recommendations 
Draft  Not for Implementation 
24  signatures to be trustworthy, reliable, and generally equivalent to paper records and handwritten 
25  signatures executed on paper. 
26   
27  This guidance revises the draft guidance for industry Use of Electronic Records and Electronic 
28  Signatures in Clinical Investigations Under 21 CFR Part 11  Questions and Answers (June 
29  2017).8  This guidance expands upon recommendations in the guidance for industry Part 11, 
30  Electronic Records; Electronic Signatures  Scope and Application (August 2003) (2003 part 
31  11 guidance) that pertain to clinical investigations conducted under 21 CFR parts 312 and 812.  
32  When finalized, this guidance will supersede the guidance for industry Computerized Systems 
33  Used in Clinical Investigations (May 2007).  Other related guidances are included in the 
34  Appendix.  
35   
36  In general, FDAs guidance documents do not establish legally enforceable 
37  responsibilities.  Instead, guidances describe the Agencys current thinking on a topic and should 
38  be viewed only as recommendations, unless specific regulatory or statutory requirements are 
39  cited. The use of the word should in Agency guidances means that something is suggested or 
40  recommended, but not required. 
41   
42   
43  II.  BACKGROUND 
44   
45  In March 1997, FDA published a final rule to establish criteria that generally must be met when a 
46  record required by a predicate rule9 is created, modified, maintained, archived, retrieved, or 
47  transmitted in electronic form in place of a paper record and when electronic signatures are used 
48  in place of traditional handwritten signatures.10  FDA considers electronic records to be 
49  equivalent to paper records and considers electronic signatures to be equivalent to traditional 
50  handwritten signatures when they meet the requirements under part 11,11 subject to program-
51  specific rules for electronic records and signatures.12  
52   
53  In August 2003, FDA issued the 2003 part 11 guidance.  The 2003 part 11 guidance provided 
54  recommendations that were narrowly tailored to reflect the technological environment that 
55  prevailed at that time.  FDA continues to apply a narrow and practical interpretation of the part 
56  11 regulations as described in the 2003 part 11 guidance.  FDA reminds sponsors and other 
 
8 When final, this guidance will represent FDAs current thinking on this topic.  For the most recent version of a 
guidance, check the FDA guidance web page at https://www.fda.gov/regulatory-information/search-fda-guidance-
documents.   
9 The underlying requirements set forth in the Federal Food, Drug, and Cosmetic Act (FD&C Act), the Public Health 
Service Act (PHS Act), and FDA regulations (other than part 11) are referred to in this guidance as predicate rules.  
See 21 CFR 11.1. 
10 See  11.1 and 62 FR 13430 (March 20, 1997). 
11 See  11.1(a). 
12 Note that the 2003 part 11 guidance was prepared and issued by CFSAN, CVM, ORA, CDER, CDRH, and 
CBER.  CTP continues to consider the relevance of the recommendations and policies in the 2003 part 11 guidance 
to tobacco product submissions. 
2  Contains Nonbinding Recommendations 
Draft  Not for Implementation 
57  regulated entities, however, that electronic records must still be maintained or submitted in 
58  accordance with the underlying predicate rules, and the Agency can take regulatory action for 
59  noncompliance with such predicate rules.  
60   
61  FDA recognizes that since 2003, advances in technology have expanded the uses and capabilities 
62  of electronic systems in clinical investigations.  In addition, electronic systems and technologies 
63  are used and managed in novel ways, services are shared or contracted between organizations, 
64  and the electronic data flow between systems is more efficient and more prevalent.  The 
65  capabilities of electronic systems have improved, and features such as automated date and time 
66  stamps, audit trails, and the ability to generate complete and accurate copies and to archive 
67  records are standard components of many electronic systems.  Understanding the evolving uses 
68  of electronic records, electronic systems, and electronic signatures in clinical investigations is 
69  important for FDA in its assessment of the authenticity, integrity, and reliability of data 
70  submitted in support of marketing applications or submissions. 
71   
72  Accordingly, this guidance provides additional recommendations regarding the risk-based 
73  approach to validation described in the 2003 part 11 guidance to continue to ensure the 
74  authenticity, integrity, and confidentiality of electronic data and records for clinical 
75  investigations during their creation, modification, maintenance, archival, retrieval, and 
76  transmission.13   
77   
78  This guidance also addresses the applicability of part 11 requirements for electronic systems and 
79  information technology (IT) services used to create, modify, maintain, archive, retrieve, or 
80  transmit an electronic record as well as for the use of digital health technology (DHT) to 
81  remotely acquire data in a clinical investigation.  
82   
83   
84  III.  QUESTIONS AND ANSWERS 
85   
86  Good clinical practice (GCP) is an international ethical and scientific standard for designing, 
87  conducting, recording, and reporting clinical investigations that involve the participation of 
88  human or animal subjects.14  Compliance with FDAs GCP regulations provides public 
89  assurance that the rights, safety, and welfare of subjects are protected and that the clinical 
90  investigation data are credible.15,16  The appropriate use of electronic records is an important 
91  component of GCP, and part 11 regulations help ensure that the electronic records and data for a 
92  clinical investigation are trustworthy and reliable.   
93   
 
13 For more information, see the 2003 part 11 guidance.  See also footnote 9. 
14 See the International Council for Harmonisation (ICH) guidance for industry E6(R2) Good Clinical Practice: 
Integrated Addendum to ICH E6(R1) (March 2018). 
15 See, e.g., 21 CFR parts 11, 16, 50, 54, 56, 58, 312, 314, 320, 511, 514, 601, 812, and 814.   
16 See the ICH guidance for industry E6(R2) Good Clinical Practice: Integrated Addendum to ICH E6(R1). 
3  Contains Nonbinding Recommendations 
Draft  Not for Implementation 
94  A.  Electronic Records 
95   
96  Electronic records used in clinical investigations that fall under the scope of part 11 requirements 
97  include: 
98   
99    Records needed for FDA to reconstruct a clinical investigation that are maintained and 
100  archived under predicate rules in electronic format in place of paper format or where the 
101  electronic record is relied on to perform regulated activities17  
102   
103    Records submitted to FDA in electronic format under predicate rules, even if such 
104  records are not specifically identified in FDA regulations18 
105   
106  Q1.  Are electronic records from real-world data sources submitted to FDA as part of a 
107  marketing application or under other predicate rules subject to part 11 
108  requirements? 
109   
110  Yes.  21 CFR part 11 requirements apply to electronic records from real-world data (RWD) 
111  sources that were created, modified, maintained, archived, retrieved, or transmitted under any 
112  records requirements set forth in FDA regulations or submitted to the Agency under 
113  requirements of the Federal Food, Drug, and Cosmetic Act (FD&C Act) or the Public Health 
114  Service Act (PHS Act), even if such records are not specifically identified in FDA regulations.19  
115  FDA acknowledges that there may be instances when electronic records from RWD sources 
116  were not originally created in part 11-compliant systems with the intention of being submitted to 
117  FDA as part of a marketing application, but such records can be used for that purpose.  Sponsors 
118  that intend to rely on such data in support of a marketing application should ensure the quality 
119  and integrity of such electronic records.20  
120   
 
17 See  11.1(b).  For examples of relevant predicate rules, see 21 CFR 312.57, 312.58, and 312.62 (for drug and 
biological product investigational new drug applications (INDs)) and 21 CFR 812.28 and 812.140 (for 
investigational device exemptions (IDEs)). 
18 See  11.1(b).  
19 See  11.1(b), 314.50, and 601.2. 
20 As stated in the guidance for industry Use of Electronic Health Records Data in Clinical Investigations (July 
2018) (2018 guidance), FDA does not intend to assess compliance of an electronic health record (EHR) system 
with part 11 regulations because, in general, they are under the control of organizations not regulated by FDA (e.g., 
health care providers, health care organizations, and health care institutions).  These electronic systems provide 
electronic records (e.g., hospital admission records, pharmacy records, laboratory records, imaging records) during 
the course of patients care that may be useful in clinical investigations.  As noted above, FDAs acceptance of data 
in support of a marketing application or submission depends on FDAs ability to verify the quality and integrity of 
the data during FDA inspections (see 21 CFR parts 312 and 812).  Note that the 2018 guidance was prepared and 
issued by CBER, CDER, and CDRH.  CTP continues to consider the relevance of the recommendations and policies 
of the 2018 guidance to tobacco product submissions. 
4  Contains Nonbinding Recommendations 
Draft  Not for Implementation 
121  Q2.   If a sponsor is conducting a clinical investigation with a non-U.S. (foreign) site, are 
122  the electronic records submitted to FDA as part of a marketing application or under 
123  other predicate rules subject to part 11 requirements? 
124   
125  If a sponsor is conducting a clinical investigation with a non-U.S. site, part 11 requirements 
126  generally apply to records in electronic form that are required under predicate rules,21 including 
127  electronic records submitted to FDA in support of a marketing application or other submission. 
128   
129  For any data submitted in support of a marketing application or other submission, FDA 
130  recommends that sponsors ensure electronic records used in clinical investigations are credible 
131  and accurate.  For example, the quality of data collected at foreign sites during clinical 
132  investigations that are not conducted under an IND,22  IDE,23 or investigational new animal drug 
133  file (INAD)24 or that are submitted to FDA in support of a marketing application or submission 
134  should be equivalent to the quality of data collected under an IND, IDE, or INAD.25  Namely, for 
135  sponsors to rely on such data in support of a human drug marketing application or submission, 
136  sponsors must ensure electronic records used in the clinical investigation are credible and 
137  accurate.26  
138   
139  Q3.   Should sponsors, clinical investigators, and other regulated entities maintain and 
140  retain a certified copy of clinical investigation electronic records? 
141     
142  If a sponsor, clinical investigator, or other regulated entity intends to maintain and retain a copy 
143  of an electronic record required for the clinical investigation in place of an original paper or 
144  original electronic record, the copy maintained and retained should be a certified copy.  A 
145  certified copy is a copy (irrespective of the type of media used) of the original record that has 
146  been verified (i.e., by a dated signature or by generation through a validated process) to have the 
147  same information, including data that describe the context, content, and structure, as the 
148  original.27  For example, for conversion between paper and electronic records, sponsors should 
149  rely on validated processes (e.g., scanning or printing) to generate certified paper or electronic 
150  copies.  The copy generated by the validated process that is maintained and retained in place of 
 
21 See, e.g.,  11.1(b), 314.50, 514.1, 601.2, and 814.20.  But see 21 CFR 11.1(f) through (p). 
22 For more information about foreign clinical studies supporting drug applications that are not conducted under an 
IND, see  312.120.  Marketing approval of a new drug based solely on foreign clinical data is governed by 
 314.106.   
23 For more information about foreign clinical data supporting IDE or device marketing applications or submissions, 
see  812.28 as well as the guidance for industry and FDA staff Acceptance of Clinical Data to Support Medical 
Device Applications and Submissions:  Frequently Asked Questions (February 2018).  
24 For more information about foreign clinical studies supporting new animal drug applications or submissions, see 
the guidance for industry Use of Data from Foreign Investigational Studies to Support Effectiveness of New Animal 
Drugs (October 2021). 
25 See  312.120 (for further information on the requirements for foreign clinical studies not conducted under an 
IND to support an IND or application for marketing approval). 
26 See, e.g.,  312.120.  
27 See the ICH guidance for industry E6(R2) Good Clinical Practice: Integrated Addendum to ICH E6(R1). 
5  Contains Nonbinding Recommendations 
Draft  Not for Implementation 
151  the original record should include the date and time when it was created.  Sponsors, clinical 
152  investigators, and other regulated entities should have written standard operating procedures 
153  (SOPs) to ensure consistency in the certification process.  
154   
155  When providing certified electronic or paper copies of electronic records, the associated 
156  metadata should be included, such as units of the data (e.g., mg); a date and time stamp for when 
157  the data were acquired; and the individual responsible for creating the copy, size of file, and 
158  number of files.  Additional metadata are important for establishing authenticity or integrity for 
159  certain record types, such as digital photographs and audiovisual files.  
160   
161  Q4.   Is FDA recommending that electronic records from medical service providers not 
162  involved in the clinical investigation be certified?   
163   
164  No.  FDAs recommendation to maintain and retain certified copies of electronic records does 
165  not extend to electronic copies of records from medical service providers such as hospitals, 
166  laboratories, or health care practitioners not involved in the clinical investigation (e.g., copies of 
167  paper health records or EHRs containing a potential participants medical history to a clinical 
168  investigator used either to determine eligibility for the clinical investigation or to report 
169  treatment for an adverse event).  The clinical investigator should retain documentation that 
170  indicates the source of the records (e.g., cover sheet sent by the hospital). 
171   
172  Q5.  How should sponsors, clinical investigators, and other regulated entities retain 
173  electronic records from a clinical investigation? 
174   
175  There are various ways to retain electronic records, including in durable electronic storage 
176  devices and using cloud computing services.28  Sponsors, clinical investigators, and other 
177  regulated entities must ensure the authenticity, integrity, and confidentiality of the data from the 
178  point of creation and also ensure that the meaning of the record is preserved.29  The relationship 
179  between records, source data, and all associated metadata should be preserved in a secure and 
180  traceable manner.  
181   
182  FDAs expectation is that sponsors, clinical investigators, and other regulated entities will ensure 
183  that records are maintained throughout the records retention period per applicable regulations30 
184  and, as applicable, made available to FDA during an inspection.31  When electronic formats are 
185  the only formats used to create, preserve, and archive electronic records, sufficient backup and 
186  recovery procedures should be in place to protect against data loss.  For example, records should 
187  be backed up regularly to prevent loss.  Backup records should be stored in a secure electronic 
188  location independent from the original records as specified in an SOP.  Backup and recovery logs 
189  should be maintained to facilitate an assessment of the nature and scope of data loss resulting 
190  from a system failure.  
 
28 See also section III.C for considerations when using IT service providers who provide cloud computing services.   
29 See  11.30. 
30 See  56.115(b), 312.57, 312.62, 511.1(b)(7)(ii), 511.1(b)(8)(i), and 812.140(d). 
31 See  56.115(b), 312.58, 312.68, 511.1(b)(8)(i), and 812.145. 
6  Contains Nonbinding Recommendations 
Draft  Not for Implementation 
191   
192  As part of an inspection, sponsors, clinical investigators, and other regulated entities may be 
193  requested to provide all records and data needed to reconstruct a clinical investigation, including 
194  associated metadata and audit trails.32  FDA may request copies of these records and data in a 
195  human-readable form.  Screenshots or paper printouts of electronic records should include 
196  metadata and audit trail information recorded in the electronic system.  When systems are 
197  decommissioned and cannot be recommissioned, sponsors should ensure that files containing the 
198  metadata are retained before decommissioning and can be linked to each corresponding data 
199  element.  
200   
201  Q6.   Are electronic communication methods (e.g., email systems or text messages) for 
202  transmitting electronic records addressed by 21 CFR part 11? 
203   
2 04  Part 11 regulations do not address electronic communication methods used in the transmission of 
205  electronic records.  When electronic records required by a predicate rule are transmitted via an 
206  electronic communication method, the regulated entity should ensure secure end-to-end transfer 
207  of that record.  Audit trails in the sponsors electronic system should capture the date and time 
208  that electronic records are transferred and the originator of those records.      
209   
210  B.  Electronic Systems Owned or Controlled by Sponsors or Other Regulated 
211  Entities 
212   
213  This section describes recommendations for electronic systems that are owned or controlled by 
214  sponsors or other regulated entities and are used by such regulated entities to produce required 
215  records in clinical investigations. 
216   
217  Examples of these electronic systems can include:  
218   
219    Electronic case report forms (eCRFs) and electronic data capture (EDC) systems, 
220  including EDC systems that capture source data directly into eCRFs  
221   
222    Electronic trial master files (eTMFs)  
223   
224    Electronic clinical data management systems (eCDMS)  
225   
226    Electronic clinical trial management systems (eCTMS)  
227   
228    Electronic quality management systems  
229   
230    Interactive response technology (IRT) systems 
231   
232    Interactive voice response system (IVRS) 
-
233   
234    Interactive web response system (IWRS) 
-
 
32 See  312.58, 312.68, 511.1(b)(8)(i), 812.140, and 812.145. 
7  Contains Nonbinding Recommendations 
Draft  Not for Implementation 
235   
236    Electronic IRB management systems  
237   
238    Electronic informed consent (eIC) systems  
239   
240    Centralized, web-based portals that display, maintain, and archive essential data (i.e., 
241  electronic patient-reported outcomes (ePROs), electronic clinical outcome assessments 
242  (eCOAs), DHT-collected patient data (see section III.D), or eIC documents and records)  
243   
244    Adverse event reporting (AER) and processing systems  
245   
246  Q7.  What should be considered when using a risk-based approach for validation of 
247  electronic systems used in clinical investigations?  
248   
249  The 2003 part 11 guidance, which states that FDA intends to exercise enforcement discretion 
250  regarding specific part 11 requirements for validation of computerized systems ( 11.10(a) and 
251  corresponding requirements in 11.30), recommends that industry base its approach to such 
252  validation on a justified and documented risk assessment and a determination of the potential of 
253  the system to affect product quality and safety as well as record integrity.33  Accordingly, we 
254  recommend that sponsors and other regulated entities use a risk-based approach34 for validating 
255  electronic systems owned or managed by sponsors and other regulated entities. 
256   
257  For purposes of this guidance, validation means a process of establishing and documenting that 
258  the specified requirements of an electronic system can be consistently fulfilled from design until 
259  decommissioning of the system or transitioning to a new system.35  Validation ensures that the 
260  electronic system is correctly performing its intended function.   
261   
262  Considerations when applying a risk-based approach for validation of electronic systems include 
263  the following: 
264   
265    The purpose and significance of the record and the criticality of the data (e.g., how the 
266  record and data will be used to support the regulatory decision and/or ensure participant 
267  safety).   
268   
269    The intended use of the electronic system (e.g., used to process records36 that are 
270  essential to the clinical investigation).  Validation is critical for electronic systems that 
 
33 See the 2003 part 11 guidance.  
34 This guidance does not provide comprehensive detail on how to perform a risk assessment.  There are many risk 
assessment methodologies and tools from a variety of industries that can be applied.  For more information, see the 
ICH guidance for industry Q9(R1) Quality Risk Management (June 2022).  Also, see the International Organization 
for Standardizations (ISOs) standard ISO 31010:2019 Risk management  Risk assessment techniques. 
35 See the ICH guidance for industry E6(R2) Good Clinical Practice: Integrated Addendum to ICH E6(R1). 
36 In this guidance, to process records includes actions such as creating, modifying, maintaining, archiving, 
retrieving, or transmitting. 
8  Contains Nonbinding Recommendations 
Draft  Not for Implementation 
271  are used for activities such as data integration, data analysis, adverse event recording or 
272  processing, endpoint evaluation, medical product dispensation, administration, and 
273  accountability.   
274   
275    The nature of the electronic system (e.g., commercial off-the-shelf (COTS) system, 
276  customized electronic system).  
277   
278    For COTS office utility software, such as word processing, spreadsheet, and PDF 
-
279  tools, the extent of validation should be guided by the organizations internal business 
280  practices and the intended use of the software in the clinical investigation.  Generally, 
281  validation should not be necessary for COTS office utility software used as intended 
282  by the manufacturer. 
283   
284    For new electronic systems that are custom-made or for existing systems that are 
-
285  customized (e.g., IRT system or eCRF system designed to meet the requirements of 
286  the protocol), sponsors should review the vendors SOPs, the system and software 
287  development life cycle model, validation documentation, change control procedures, 
288  and change control tracking logs.  In addition, sponsors should perform user 
289  acceptance testing (UAT) and document the criteria for and results of testing to 
290  ensure that the electronic system fulfills its intended purpose.  Alternatively, sponsors 
291  should review the vendors UAT and document that the UAT was reviewed and was 
292  found to be adequate. 
293   
294  Changes to electronic systems (including software upgrades, security and performance patches, 
295  equipment or component replacements, and new instrumentation) should be evaluated and 
296  validated depending on risk.  They should not affect the collection, storage, and retrieval of 
297  existing or new records or the traceability, authenticity, and integrity of existing data.  Changes 
298  that affect operational limits or design specifications should be validated.  Finally, all changes to 
299  the system should be documented.  It may be appropriate for FDA to request documentation of 
300  system validation during an FDA inspection. 
301   
302  Q8.  What documentation should the sponsor have in place for electronic systems that 
303  fall under the scope of part 11, and what will be FDAs focus during inspections of 
304  the sponsor? 
305   
306  For each clinical investigation protocol, the sponsor should describe the electronic systems (e.g., 
307  IRT system, EDC, eCOA) used to collect clinical investigation data as well as the electronic 
308  systems used to create, modify, maintain, archive, retrieve, or transmit pertinent electronic 
309  records.  Sponsors should create a diagram that depicts the flow of data from creation to final 
310  storage. 
311   
312  Consistent with a risk-based approach to validation (see Q7), sponsors should consider (1) the 
313  purpose and significance of the record and the criticality of the data, (2) the intended use of the 
314  electronic system, and (3) the nature of the electronic system to determine when documentation 
315  or SOPs addressing the following are appropriate: 
316   
9  Contains Nonbinding Recommendations 
Draft  Not for Implementation 
317    System setup, installation, and maintenance 
318   
319    System validation (e.g., validation plans, execution, and reports)  
320   
321    UAT performed by the sponsor or vendor  
322   
323    Change control procedures and change control  
324   
325    System account setup and management, including user access controls 
326   
327    Data backup, recovery, and contingency plans 
328   
329    Alternative data entry methods (in the case of system unavailability)   
330   
331    Information pertinent to use of the electronic system (e.g., audit trail information, 
332  interoperable data standards) 
333   
334    Support mechanisms in place, such as training (including training records) and technical 
335  support 
336   
337    Internal and external audits of electronic systems and of vendors that are performed or 
338  provided by the sponsor or independent consultants (see Q10) to ensure that the system is 
339  functioning and is being used consistently as intended  
340   
341    Roles and responsibilities of sponsors, clinical sites, and other parties with respect to the 
342  use of electronic systems in the clinical investigation 
343   
344  Documentation related to the bulleted list above should be retained as part of the clinical 
345  investigation records and be available for inspection by FDA in order to assess whether such 
346  records contain information bearing on the sponsors adequate compliance with relevant 
347  requirements.  For electronic systems that fall under the scope of part 11, FDA will generally 
348  focus on the following during a sponsor inspection: 
349   
350    Data collection, data handling, and data management plans and procedures 
351   
352    The life cycle of the electronic system, from design and implementation to 
353  decommissioning or transitioning to a new system 
354   
355    Processes and procedures that are in place to ensure that the data and records required to 
356  reconstruct the clinical investigation are not altered in value or meaning 
357   
358    Authority checks in the electronic systems to ensure only authorized individuals are given 
359  appropriate access 
360   
361    Change control procedures and any changes made to the system once in use 
10  Contains Nonbinding Recommendations 
Draft  Not for Implementation 
362   
363    Any contracts with vendors or other delegated entities that detail their functions and 
364  responsibilities 
365   
366    All corrective and preventive actions implemented across all relevant activities and 
367  systems 
368   
369  Q9.  What documentation should be available at clinical investigator sites for electronic 
370  systems that fall under the scope of part 11, and what will be FDAs focus during 
371  inspections of clinical investigator sites? 
372   
373  Sponsors should provide information to clinical investigator sites regarding electronic systems 
374  used in the clinical investigation that are owned or controlled by sponsors and vendors and that 
375  fall under the scope of part 11.  This information may include policies and procedures related to 
376  system account setup and management, access controls and user access privileges, system user 
377  manuals, and system training materials and records.  The clinical investigator should retain this 
378  information for review during an FDA inspection so that FDA can assess whether such records 
379  contain information bearing on the sponsors adequate compliance with relevant requirements.   
380   
381  Clinical investigator sites that own or control electronic systems used in the clinical investigation 
382  that fall under the scope of part 11 (e.g., site-owned EDC system, electronic clinical investigator 
383  site file) should retain the documentation related to the use of the electronic systems as described 
384  in Q8. 
385   
386  Clinical investigator sites may have their own SOPs and documentation pertinent to the use of 
387  electronic systems.  Such information may include, for example, SOPs that ensure users at the 
388  clinical investigator sites have their own accounts and appropriate access; SOPs for notifying 
389  sponsors of changes in clinical investigation personnel at the site so that access rights can be 
390  terminated; backup, recovery, and contingency plans for source documentation retained at the 
391  site; and site-generated user training.  Clinical investigator sites should retain this information for 
392  review during an FDA inspection. 
393   
394  FDA will generally focus on the following during a clinical investigator site inspection: 
395   
396    Records related to staff training on the use of electronic systems37 
397   
398    Procedures and controls in place for system access, data creation, data modification, and 
399  data maintenance38 
400   
401    Use of electronic systems at the clinical investigator site to generate, collect, transmit, 
402  and archive data39 
 
37 See  11.10(i). 
38 See  11.10(d) and (k). 
39 See  11.10. 
11  Contains Nonbinding Recommendations 
Draft  Not for Implementation 
403   
404  Q10.  During an inspection, will FDA review the reports of audits performed by sponsors 
405  or other regulated entities of IT service providers electronic systems, products, and 
406  services? 
407   
408  Sponsors and other regulated entities often conduct audits to assess the IT service providers 
409  quality management plan and the content of and compliance with relevant SOPs used in the 
410  design and development of the electronic system, product, or service.  Sponsors and other 
411  regulated entities also often conduct audits of clinical investigation data in electronic systems to 
412  ensure the functionality of the system.   
413   
414  FDA will generally not review audit reports of the IT service providers electronic systems, 
415  products, and services.40  
416   
417  Q11.  What are FDAs requirements and recommendations regarding the use of security 
418  safeguards? 
419   
420  Sponsors, clinical investigators, and other regulated entities must ensure that procedures and 
421  processes are in place to safeguard the authenticity, integrity and, when appropriate,  
422  confidentiality of electronic records.41  Logical and physical access controls should be integral to 
423  electronic systems used in clinical investigations to limit system access to authorized users, 
424  particularly for systems that provide access to multiple users or systems that are accessed 
425  through networks.42  The selection and application of access controls should be based on an 
426  appropriately justified and documented risk-based approach that protects the authenticity, 
427  integrity, and confidentiality of the data or information.43  Part 11 requirements do not specify 
428  any particular methods for implementing access controls.  Access controls may include 
429  multifactor authentication, strong login credentials, and/or biometrics (e.g., facial recognition, 
430  fingerprints, voice prints, iris scans).   
431   
432  A cumulative record should be maintained of all clinical investigation personnel who are 
433  authorized to access the electronic system as well as a description of their access privileges.  
434  These records should be accessible for use by appropriate clinical investigation personnel and for 
435  inspection by FDA.  System administrators should not be involved in data collection or clinical 
436  investigation assessments.  
437   
 
40 Compliance policy guide CPG Sec. 130.300  FDA Access to Results of Quality Assurance Program Audits and 
Inspections, available at https://www.fda.gov/regulatory-information/search-fda-guidance-documents/cpg-sec-
130300-fda-access-results-quality-assurance-program-audits-and-inspections.  
41 See  11.10 and 11.30. 
42 See  11.10(d) and 11.30 (for requirements to limit system access to authorized individuals). 
43 Part 11 differentiates electronic systems as closed or open ( 11.10 and 11.30) and describes additional measures 
that may be necessary for open systems.  Because of changing technologies and the increased risk of cybersecurity 
threats, a risk-based approach to validation should be used for all electronic systems.   
12  Contains Nonbinding Recommendations 
Draft  Not for Implementation 
438  Individuals should work only under their own usernames and passwords or other access controls 
439  and should not share log-on information with others.  Steps must be taken to prevent 
440  unauthorized access to the system.44  For example, individuals should log off the system when 
441  leaving their workstations.  An automatic log off may be appropriate for idle periods.  The 
442  system should be designed to limit the number of login attempts and to record unauthorized login 
443  attempts.  Processes should be in place to detect, document, report, and remedy security protocol 
444  breaches involving attempted and confirmed unauthorized access.  
445   
446  Sponsors should conduct a risk assessment to determine appropriate procedures and controls to 
447  secure data at rest and in transit to prevent access by intervening or malicious parties.   
448   
449  Security safeguards (e.g., firewalls; antivirus, anti-malware, and anti-spyware software) should 
450  be in place and continually updated, as appropriate, to prevent, detect, and remedy the effects of 
451  computer viruses; replicating malware computer programs (i.e., worms); and other potentially 
452  harmful software code on clinical investigation data, software, and hardware.  Other safeguards, 
453  such as encryption, should be used to ensure confidentiality of the data.  In the case of security 
454  breaches to devices or systems, sponsors and other regulated entities should make reasonable 
455  efforts to ensure the continued validity of the source data.45  Security breaches that could affect 
456  the safety or privacy of clinical investigation participants and data should be reported to the IRB 
457  and FDA as soon as possible. 
458   
459  Q12.  What are considerations for sponsors and other regulated entities when 
460  implementing audit trails?  
461   
462  Audit trails provide a means to verify the quality, authenticity, and integrity of data, allowing 
463  reconstruction of significant details about clinical investigation conduct and source data 
464  collection.  Electronically generated, time-stamped audit trails, in addition to other security 
465  measures, can also capture information related to the creation, modification, or deletion of 
466  electronic records. 
467   
468  Audit trails must capture electronic record activities including all changes made to the electronic 
469  record, the individuals making the changes, the date and time of the changes, and the reasons for 
470  the changes.46  Original information must not be obscured by the use of audit trails or other 
471  security measures.47,48  Audit trails should be protected from modification and from being 
472  disabled.  Periodic review of the audit trail may be helpful for sponsors to ensure data quality, 
473  authenticity, and integrity.  The decision to review audit trails should be based on a risk 
 
44 See  11.10(d).  
45 Note that this security functionality should be part of the validation process of the software.   
46 See  11.10(e) and 11.30.  
47 Ibid. 
48 See the guidance for industry Electronic Source Data in Clinical Investigations (September 2013) (2013 
guidance).  Note that the 2013 guidance was prepared and issued by CBER, CDER, and CDRH.  CTP continues to 
consider the relevance of the recommendations and policies of the guidance to tobacco product submissions. 
13  Contains Nonbinding Recommendations 
Draft  Not for Implementation 
474  assessment of the clinical investigation, taking into account the systems, procedures, and controls 
475  in place.   
476   
477  All audit trail information on the creation, modification, and deletion of electronic records must 
478  be available for FDA inspection.49  A risk-based approach should be applied for retaining access 
479  logs (i.e., records of individuals who accessed the system and the times they did so).  For 
480  example, regulated entities should retain all system access logs for electronic systems or files 
481  that contain unblinding information to verify the authenticity and integrity of the blind 
482  throughout the clinical investigation.   
483   
484  FDA recommends that the audit trail be retained as a dynamic file (i.e., a file where the audit 
485  trail can be seen in the system while the record is being reviewed).  If it is not possible to retain a 
486  dynamic file, the audit trail should be retained as a fixed-data document (e.g., PDF) provided that 
487  the copy of the audit trail information is a certified copy and is clearly linked to the respective 
488  record (see Q3).  The audit trail information should accompany all copies of the record, 
489  including those retained by clinical investigators (whether at the clinical investigation site or at 
490  an alternate location).  The information should be complete and understandable with clear and 
491  concise terms to describe the components of the audit trail.  Audit trail components must include 
492  (1) the date and time the data element or information was entered or modified; (2) the individual 
493  making the change (e.g., user ID and user role); and (3) the old value, new value, and reason for 
494  the change if applicable.50 
495   
496  In the 2003 part 11 guidance, FDA stated that it intends to exercise enforcement discretion with 
497  respect to specific part 11 requirements, including, but not limited to, computer-generated, time-
498  stamped audit trails ( 11.10(e) and (k)(2) and any corresponding requirement in 11.30).  
499  Persons must still comply with all applicable predicate rules.  Even where there are no predicate 
500  rule requirements related to documentation, it is nonetheless important to have audit trails or 
501  other physical, logical, or procedural security measures in place to ensure the trustworthiness and 
502  reliability of the electronic records.  FDA recommends basing a decision regarding whether to 
503  apply audit trails or other appropriate measures on the need to comply with predicate rule 
504  requirements, a justified and documented risk assessment, and a determination of the potential 
505  effect on product quality and record integrity.   
506   
507  Q13.   Should an audit trail record every key stroke? 
508   
509  It is not necessary to record every key stroke in an audit trail.  However, the audit trail should be 
510  available once the user has taken a deliberate action to create, modify, or delete electronic 
511  records.  Any edits to completed fields should be captured in the audit trail.  If an edit check 
512  exists for submitted data and prompts the user to make a correction, the audit trail should include 
513  the original response, the fact that the edit check prompted a correction, and any change made in 
514  response.   
515   
 
49 Audit trail documentation must be retained for a period at least as long as the period required for the subject 
electronic records and must be available for FDA review and copying (see  11.10(e) and 11.30). 
50 See  11.10(e).  
14  Contains Nonbinding Recommendations 
Draft  Not for Implementation 
516  Q14.  What controls should be in place to ensure that the electronic systems date and 
517  time are correct? 
518   
519  Controls should be in place to ensure that the systems date and time are correct.  The ability to 
520  change the date or time should be limited to authorized system administrators (see Q11), who 
521  should be notified if a system date or time discrepancy is detected.  Any changes to date or time 
522  should be documented, except for automatic time changes made by systems for daylight savings. 
523   
524  For electronic systems used in clinical investigations that span different time zones, the sponsor 
525  should indicate the time zone that corresponds to the date and time stamp.   
526   
527  Q15.  What are the requirements and recommendations regarding training of individuals 
528  who use electronic systems in clinical investigations? 
529   
530  Anyone who develops, maintains, or uses electronic systems subject to part 11 must have the 
531  education, training, and experience necessary to perform their assigned tasks.51  Relevant 
532  training should be provided to individuals regarding the electronic systems they will use during 
533  the clinical investigation.  Training should be conducted before the start of the clinical 
534  investigation and as needed during the study when changes are made to the electronic system.  
535  Training should cover processes and procedures to access the system, to complete clinical 
536  investigation documentation, and to detect and report incorrect data.  Training should be 
537  documented.  Current training materials should also be available to clinical investigation 
538  personnel and participants during the clinical investigation if needed.  See Q8 and Q9 for more 
539  information on retention of training documentation. 
540   
541  Q16.   Does FDA provide preliminary evaluations of electronic systems to be used in a 
542  clinical investigation to determine whether they comply with part 11 requirements? 
543   
544  No.  FDA does not perform preliminary evaluations of electronic systems (e.g., EDC system, 
545  eCTMS) to determine whether they comply with part 11 requirements.  These systems will be 
546  evaluated during an inspection. 
547   
548  C.  Information Technology Service Providers and Services 
549   
550  Sponsors and other regulated entities can contract with vendors to provide IT services for a 
551  clinical investigation (e.g., data hosting, cloud computing software, platform and infrastructure 
552  services).  Sponsors and other regulated entities are responsible for ensuring that electronic 
553  records meet applicable part 11 regulatory requirements.  When determining the suitability of the 
554  IT service and IT service provider, sponsors and other regulated entities should consider the 
555  following regarding the IT service providers ability to ensure the authenticity, integrity, and 
556  confidentiality of clinical investigation records and data: 
557   
558    Policies the IT service provider has in place to allow the sponsor to perform oversight of 
559  the clinical investigation functions provided by the IT service provider  
 
51 See  11.10(i). 
15  Contains Nonbinding Recommendations 
Draft  Not for Implementation 
560   
561    Processes and procedures the IT service provider has in place for validation of specific IT 
562  services to be used in the clinical investigation (see Q7) 
563   
564    Ability of the IT service provider to generate accurate and complete copies of records and 
565  to provide access to data for as long as the records are required to be retained by 
566  applicable regulations (see Q5)52  
567   
568    Processes and procedures the IT service provider has for retaining records and making 
569  them available for FDA inspection for as long as the records are required to be retained 
570  by applicable regulations (see Q5)53 
571   
572    Access controls used by the IT service provider for specific IT services used in the 
573  clinical investigation, including SOPs for granting and revoking access (see Q11) 
574   
575    Ability of the IT service provider to provide secure, computer-generated, time-stamped 
576  audit trails of users actions and changes to data (see Q12) 
577   
578    Ability of the IT service provider to secure and protect the confidentiality of data at rest 
579  and in transit (as appropriate for the content and nature of the record)  
580   
581    Processes and procedures the IT service provider has in place related to electronic 
582  signature controls (see section III.E) 
583   
584    Relevant experience of the IT service provider 
585   
586  Q17.  Should sponsors or other regulated entities establish service level agreements with 
587  IT service providers? 
588   
589  Yes, FDA recommends that sponsors and other regulated entities have written service level 
590  agreements (SLAs) with IT service providers that describe how the IT services will meet the 
591  sponsors requirements.  Before entering an agreement, the sponsor or other regulated entity 
592  should evaluate and select IT services based on the IT service providers ability to provide data 
593  integrity and data security safeguards (described in the bulleted list in section III.C) that are 
594  relevant to the IT service being provided.  The SLAs should address services that provide data 
595  integrity and data security safeguards, such as participant confidentiality, data reliability, and 
596  adherence to applicable regulatory requirements.  This should include, but not be limited to, the 
597  following:  
598   
599    The scope of the work and IT service being provided. 
600   
 
52 See, e.g.,  56.115(b), 312.57, 312.62, 511.1(b)(7)(ii), 511.1(b)(8)(i), and 812.140(d). 
53 Ibid. 
16  Contains Nonbinding Recommendations 
Draft  Not for Implementation 
601    The roles and responsibilities of the sponsor or other regulated entity and the IT service 
602  provider, including those related to quality and risk management.  The sponsor is 
603  responsible for any duties and functions related to the clinical investigation not 
604  specifically and lawfully transferred to and assumed by an IT service provider (e.g., via a 
605  transfer of regulatory obligation (TORO)).54 
606   
607    Details regarding access to the data throughout the regulatory retention period. 
608   
609  Q18.  What should sponsors and other regulated entities have available to demonstrate 
610  that the IT services are performed in accordance with FDAs regulatory 
611  requirements? 
612   
613  Sponsors and other regulated entities who outsource IT services should make the following 
614  information available for FDA upon request: 
615   
616    SLAs and any other agreements that define the sponsors expectations of the IT service 
617  provider 
618   
619    All quality or risk management procedures related to the IT service 
620   
621    Documentation of ongoing oversight of IT services  
622   
623  Q19.  Would FDA inspect or investigate IT service providers in a clinical investigation?  
624   
625  FDA may inspect IT service providers who have assumed obligations in an IND set forth in a 
626  TORO in writing as described in  312.52.  FDA can also request to conduct focused 
627  investigations of IT service providers for examination of trial records, regardless of whether a 
628  TORO is established.  An investigation is a targeted information-gathering activity triggered by a 
629  specific regulatory concern; for example, concerns regarding the integrity of trial data.  
630  Regardless, the sponsor should have access to all study-related records maintained by IT service 
631  providers since those records may be reviewed during a sponsor inspection.55  
632   
633  D.  Digital Health Technologies 
634   
635  For the purposes of this guidance, a DHT is a system that uses computing platforms, 
636  connectivity, software, and/or sensors for health care and related uses.  DHTs may take the form 
637  of hardware and/or software.56  In many instances, DHT software may run on general-purpose 
638  computing platforms (e.g., mobile phone, tablet, or smart watch). 
639   
 
54 See  312.52. 
55 See, e.g.,  312.57 for specific requirements. 
56 In this guidance, the term hardware includes its firmware (i.e., software that is embedded within the hardware and 
that is essential to the core operation of the hardware).  The term software refers to other software (e.g., a mobile 
application) that is not part of the hardware. 
17  Contains Nonbinding Recommendations 
Draft  Not for Implementation 
640  Sponsors, clinical investigators, and other regulated entities can use DHTs to record and transmit 
641  data during a clinical investigation.  The recommendations in this section apply to DHTs used in 
642  a clinical investigation, whether the sponsor provides the DHT or the participants use their own 
643  DHTs.   
644   
645  When final, the draft guidance for industry, investigators, and other stakeholders Digital Health 
646  Technologies for Remote Data Acquisition in Clinical Investigations (December 2021)57 will 
647  provide recommendations for sponsors, clinical investigators, and other parties on the use of 
648  DHTs for remote data acquisition from participants in clinical investigations evaluating medical 
649  products.  The draft guidance discusses, among other things, selection of DHTs for clinical 
650  investigations; verification, validation, and usability testing;58 use of DHTs to collect data for 
651  clinical investigation endpoints; training on the use of DHTs; and identification and management 
652  of risks related to the use of DHTs in clinical investigations.  The draft guidance also provides 
653  recommendations for designing clinical investigations incorporating DHTs.  
654   
655  The principles previously discussed in sections III.A through C regarding electronic systems are 
656  applicable when DHTs are used to record data in a clinical investigation.  In addition, the 
657  following questions and answers discuss specific considerations regarding part 11 compliance 
658  for data collection from DHTs in a clinical investigation.  
659   
660  Q20.  When using DHTs to capture data from participants in clinical investigations, how 
661  do sponsors identify the data originator? 
662   
663  As part of an audit trail, each electronic data element should be associated with an authorized 
664  data originator.  The data originator may be a person, a computer system, a DHT, or an EHR 
665  that is authorized to enter, change, or transmit data elements via a secure protocol into a durable 
666  electronic data repository, such as an EDC system, a clinical investigation site database, and/or a 
667  vendor database (e.g., database of the CRO, IT service provider, DHT manufacturer).59     
668   
669  If a participant manually enters data into the DHT (e.g., when using an ePRO app or when 
670  performing a task-based measure, such as a cognitive test) and the data are then uploaded into a 
671  durable electronic data repository, the clinical investigation participant should be identified as 
672  the data originator.  In cases where another individual (e.g., clinical investigation personnel, 
673  health care provider, parent, or other caregiver) enters data on behalf of the clinical investigation 
674  participant, the individual entering the data should be identified as the data originator, and the 
675  reason should be documented.   
 
57 When final, this guidance will represent FDAs current thinking on this topic.  Note that the draft guidance covers 
drugs, biologics, and devices. 
58 As used in the draft guidance for industry, investigators, and other stakeholders Digital Health Technologies for 
Remote Data Acquisition in Clinical Investigations (December 2021) (when final, this guidance will represent 
FDAs current thinking on this topic), the terms verification and validation are not intended to be synonymous with 
the terms defined in 21 CFR 820.3(aa) and 820.3(z) under the Quality System Regulation for devices (21 CFR part 
820) or the terms device software function verification and validation as described in the guidance for industry and 
FDA staff General Principles of Software Validation (January 2002). 
59 See the 2013 guidance. 
18  Contains Nonbinding Recommendations 
Draft  Not for Implementation 
676   
677  If a DHT, such as an activity tracker or a glucose sensor, transmits data automatically to the 
678  durable electronic data repository without any human intervention, the DHT should be identified 
679  as the data originator.  In these cases, a data element identifier should be created that 
680  automatically identifies the particular DHT (e.g., name and type) as the originator of the data 
681  element.  Other information associated with a data element, such as the date and time of entry 
682  and the unique identifier of the participant to whom it applies, should be recorded in the durable 
683  electronic data repository.   
684   
685  In some cases, data from DHTs are obtained in the course of medical care and entered manually 
686  or automatically into an EHR.  The EHR data can, in turn, under appropriate circumstances be 
687  used in a clinical investigation and entered into the EDC system.  In this situation, identifying the 
688  EHR as the data originator is sufficient because sponsors are not expected to ascertain the details 
689  about all of the users and DHTs that contribute information to the patients EHR.  
690   
691  The sponsor should develop and maintain a list of authorized data originators, which should be 
692  available during an FDA inspection.  When identification of data originators relies on unique 
693  codes, usernames, and passwords, access controls should be employed to ensure the security, 
694  authenticity, and integrity of the authorized usernames and passwords (see Q21).60  When 
695  fingerprints or other biometrics are used by data originators in place of username and password 
696  combinations, controls should be designed to ensure that the biometrics cannot be used by 
697  anyone other than the data originator (see Q27).61,62     
698   
699  Q21.  How should data attribution be ensured when DHTs are used to capture, transmit, 
700  and record data in clinical investigations? 
701   
702  Sponsors should ensure that data obtained using DHTs are correctly attributed to the data 
703  originator.  Approaches may include the use of access controls, education of participants, and 
704  data monitoring.  Data attribution concerns should be addressed during protocol development 
705  and at the time of DHT selection. 
706   
707  DHTs should be designed to prevent unauthorized changes to the data stored on the DHT before 
708  data are transmitted to and recorded in a durable electronic data repository.  Access controls 
709  (e.g., biometrics, multi-factor authentication) should be in place for a mobile application that 
710  relies on user entry of data to ensure that entries come from the clinical investigation 
711  participants, personnel, or other individuals authorized to enter the data (e.g., health care 
712  providers, parents, or other caregivers).63  Clinical investigation personnel, participants, and 
 
60 See  11.10(d) and (g) and 11.30 (for additional information related to the requirements to limit system access to 
authorized individuals and the use of authority checks to ensure that only authorized individuals can access and use 
the system). 
61 See  11.200(b) (for additional information related to the rule regarding electronic signatures based upon 
biometrics). 
62 See the 2013 guidance. 
63 See footnote 60.  
19  Contains Nonbinding Recommendations 
Draft  Not for Implementation 
713  other individuals should use their own usernames and passwords and not share them with others 
714  or use access controls belonging to others (e.g., biometrics). 
715   
716  For certain DHTs (e.g., wearable sensors), access controls may be difficult to implement.  
717  Sponsors should consider how they will address user authentication and data attribution for these 
718  DHTs, particularly when the data collected from such DHTs will be used to support a clinical 
719  investigation endpoint.  The clinical investigator should discuss the appropriate use of such 
720  DHTs with participants.  Clinical investigation participants should be instructed that only they 
721  should wear or use such DHTs.  This discussion should be documented in the clinical 
722  investigation records.  Periodic monitoring of DHT data during the clinical investigation can help 
723  to identify situations where data may be coming from individuals other than the intended user.  
724   
725  Q22.  What should be considered during the initial transfer of the data from a DHT to the 
726  durable electronic data repository?  
727   
728  Data captured from a DHT and any relevant associated metadata should be transmitted to a 
729  durable electronic data repository according to the sponsors pre-specified plan.  The durable 
730  electronic data repository can be owned by sponsors or by vendors such as IT service providers.  
731  Transmission should occur contemporaneously or as soon as possible after data are generated.  
732  The date and time the data are transferred from the DHT to the electronic data repository should 
733  be included in the audit trail.  Source data captured by a DHT can be subsequently moved from 
734  one durable electronic data repository to a different durable electronic data repository using a 
735  validated process.   
736   
737  Q23.  What is the location of the source data collected by a DHT, and what DHT-collected 
738  data would FDA intend to inspect during an inspection? 
739   
740  Electronic source data are considered to be located in the first durable electronic data repository 
741  (e.g., EDC system, clinical investigation site database, cloud-based digital platform) to which the 
742  data are transferred.  FDA does not intend to inspect individual DHTs for source data when the 
743  data captured by the DHT, including all associated metadata, are securely transferred to and 
744  retained in the durable electronic data repository according to the sponsors pre-specified plan. 
745   
746  FDA may verify the data the sponsor submits in support of an application or submission against 
747  the electronic source data during an inspection.64  As discussed in the 2003 part 11 guidance, 
748  FDA intends to exercise enforcement discretion with regard to the requirements for generating 
749  copies of records in human readable and electronic form for inspection, review, and copying by 
750  the Agency ( 11.10(b) and any corresponding requirement in 11.30).65  However, such records 
751  are also subject to requirements under predicate rules.66  FDA recommends that sponsors allow 
752  for the inspection, review, and copying of such records in human readable form.67    
 
64 See  11.10(b). 
65 See the 2003 part 11 guidance. 
66 See, e.g.,  211.180(c) and (d). 
67 See the 2003 part 11 guidance.  
20  Contains Nonbinding Recommendations 
Draft  Not for Implementation 
753   
754  E.  Electronic Signatures  
755   
756  An electronic signature is a computer data compilation of any symbol or series of symbols 
757  executed, adopted, or authorized by an individual to be the legally binding equivalent of the 
758  individuals handwritten signature.68  In general, a signature may not be denied legal effect or 
759  validity solely because it is in an electronic format, and a record relating to a transaction may not 
760  be denied legal effect, validity, or enforceability solely because an electronic signature or 
761  electronic record was used in its formation.69   
762   
763  In general, electronic signatures and their associated electronic records that meet all applicable 
764  requirements under part 11 will be considered to be equivalent to handwritten signatures.70  Part 
765  11 specifies that signed electronic records must contain the printed name of the signer, the date 
766  and time when the signature was executed, and the meaning associated with the signature.71  In 
767  addition, electronic signatures must be linked to the respective electronic records to ensure that 
768  the signatures cannot be excised, copied, or otherwise transferred to falsify an electronic record 
769  by ordinary means.72  In situations where electronic signatures cannot be placed in a specified 
770  signature block, a statement of testament (e.g., I approved the contents of this document) 
771  should be placed elsewhere in the document to state the meaning of the signature and link the 
772  signature to the electronic record.  
773   
774  Q24.  What methods might be used to create valid electronic signatures? 
775   
776  Part 11 regulations do not specify a particular method to confirm the users identity when 
777  creating electronic signatures.  Examples of methods used to create valid electronic signatures 
778  include, but are not limited to, the use of computer-readable ID cards, biometrics, digital 
779  signatures, and username and password combinations.  
780   
781  Various COTS electronic signature services are available to create electronic signatures.  
782  Sponsors, clinical investigators, and other regulated entities should ensure that these services 
783  conform to part 11 requirements based on information from the COTS vendors or their own 
784  validation of the services when warranted.  
785   
 
68 See  11.3(b)(7). 
69 See the Government Paperwork Elimination Act (GPEA), enacted on October 21, 1998 (Public Law 105-277), 
and the Electronic Signatures in Global and National Commerce Act, enacted on June 30, 2000 (Public Law 106-
229, 114 Stat. 464) (15 U.S.C. 7001-7006). 
70 See  11.1(c).  
71 See  11.50. 
72 See  11.70. 
21  Contains Nonbinding Recommendations 
Draft  Not for Implementation 
786  Q25.  Does FDA consider signatures drawn with a finger or an electronic stylus on a 
787  mobile platform or other electronic system to be electronic signatures?  
788   
789  No.  Signatures drawn with a finger or an electronic stylus are considered handwritten 
790  signatures.73  A handwritten signature executed to an electronic record must be linked to its 
791  respective electronic record.74  The handwritten signature should be placed on the electronic 
792  document just as it would appear on a printed document to link the signature to the respective 
793  electronic record.   
794   
795  Q26.  How should sponsors and regulated entities verify the identity of the individual who 
796  will be electronically signing records as required in  11.100(b)? 
797   
798  Part 11 regulations do not specify a particular method for verifying the identity of the individual 
799  who will be electronically signing records.75  Methods for verifying someones identity may 
800  include, but are not limited to, use of official Government-issued identification, security 
801  questions, or strong digital login credentials accompanied by multi-factor authentication or video 
802  observation. 
803   
804  Q27.  What requirements must an electronic signature based on biometrics meet to be 
805  considered acceptable?  
806   
807  Biometrics are a method of verifying an individuals identity based on measurements of the 
808  individuals physical feature(s) or repeatable action(s) where those features and/or actions are 
809  both unique to that individual and measurable.76  Examples of biometrics may include, but are 
810  not limited to, fingerprints, hand geometry (i.e., finger length and palm size), iris patterns, retinal 
811  patterns, or voice prints.  
812   
813  Electronic signatures based on biometrics must be designed to ensure that they cannot be used by 
814  anyone other than their genuine owners.77  Suitable biometrics should be uniquely identified with 
815  the individual and should not change over time.   
816   
817  Electronic signatures based on biometrics that meet the requirements under part 11 subpart C are 
818  considered trustworthy, reliable, and generally equivalent to handwritten signatures.78 
819   
 
73 See  11.3(b)(8).  
74 See  11.70. 
75 See  11.100.  
76 See  11.3(b)(3). 
77 See  11.200(b). 
78 See  11.1(a) and (c). 
22  Contains Nonbinding Recommendations 
Draft  Not for Implementation 
820  Q28.  Does FDA certify electronic systems and methods used to obtain electronic 
821  signatures? 
822   
823  No.  FDA does not certify individual electronic systems and methods used to obtain electronic 
824  signatures.  FDA would consider an electronic signature to be trustworthy, reliable, and generally 
825  equivalent to handwritten signatures if electronic signatures and their associated electronic 
826  records meet the requirements of part 11,79 regardless of the particular technology or brand used.  
827  Sponsors should work with COTS electronic signature service vendors to ensure compliance 
828  with part 11.
829     
 
79 Ibid. 
23  Contains Nonbinding Recommendations 
Draft  Not for Implementation 
830  GLOSSARY 
831   
832  Audits:  Systematic and independent examinations of trial-related activities and documents to 
833  determine whether the evaluated trial-related activities were conducted and the data were 
834  recorded, analyzed, and accurately reported according to the protocol, sponsors standard 
835  operating procedures (SOPs), good clinical practice (GCP), and the applicable regulatory 
836  requirements.80  
837   
838  Audit Trails:  Processes that capture details such as additions, deletions, or alterations of 
839  information in an electronic record without obscuring the original record.  Audit trails facilitate 
840  the reconstruction of the course of such details relating to the electronic record.81  Audit trails 
841  typically capture each change itself, the individual making the change, the data and time of the 
842  change and, when applicable, the reason or reasons for the change. 
843   
844  Biometrics:  Methods of verifying an individuals identity based on measurements of the 
845  individuals physical features or repeatable actions where those features and/or actions are both 
846  unique to that individual and measurable.82   
847   
848  Certified Copy:  A copy (irrespective of the type of media used) of the original record that has 
849  been verified (i.e., by a dated signature or by generation through a validated process) to have the 
850  same information, including data that describe the context, content, and structure, as the 
851  original.83 
852     
853  Cloud Computing:  A model for enabling ubiquitous, convenient, on-demand network access to 
854  a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, 
855  and services) that can be rapidly provisioned and released with minimal management effort or 
856  service provider interaction.84   
857   
858  Commercial Off-the-Shelf (COTS) System:  A commercially available electronic system 
859  (including hardware or software) that can be purchased from third-party vendors.  
860   
861  Customized Electronic System:  System and software including functionalities that are adapted 
862  for the needs of the clinical investigation.  
863   
 
80 See, e.g., 21 CFR parts 11, 16, 50, 54, 56, 58, 312, 314, 320, 511, 514, 601, 812, and 814; see also the ICH 
guidance for industry E6(R2) Good Clinical Practice: Integrated Addendum to ICH E6(R1). 
81 See the 2013 guidance. 
82 See  11.3(b)(3). 
83 See the ICH guidance for industry E6(R2) Good Clinical Practice: Integrated Addendum to ICH E6(R1). 
84 See the National Institute of Standards and Technologys definition of cloud computing, available at 
https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-145.pdf. 
24  Contains Nonbinding Recommendations 
Draft  Not for Implementation 
864  Data Element:  A single observation associated with a subject in a clinical study.  Examples 
865  include birth date, white blood cell count, pain severity measure, and other clinical observations 
866  made and documented during a study.85  
867   
868  Data Element Identifier:  The information associated with a data element that includes the 
869  origin of the data element, the date and time of entry, and the identification number of the study 
870  subject to whom the data element applies.  Once set by the electronic system, this value should 
871  not be alterable in any way.86  
872   
873  Data Originator:  Each data element is associated with an origination type that identifies the 
874  source of its capture in the eCRF.  This could be a person, a computer system, a device, or an 
875  instrument that is authorized to enter, change, or transmit data elements into the eCRF (also 
876  sometimes known as an author).87 
877   
878  Digital Health Technology (DHT):  A system that uses computing platforms, connectivity, 
879  software, and/or sensors for health care and related uses.  These technologies span a wide range 
880  of uses, from applications in general wellness to applications as a medical device.  They include 
881  technologies intended for use as a medical product, in a medical product, or as an adjunct to 
882  other medical products (devices, drugs, and biologics).  They may also be used to develop or 
883  study medical products.88 
884   
885  Digital Signatures:  Electronic signatures based upon cryptographic methods of originator 
886  authentication, computed by using a set of rules and a set of parameters such that the identity of 
887  the signer and the integrity of the data can be verified.89 
888   
889  Durable Electronic Data Repository:  An enduring database that is electronically protected 
890  from alterations and maintained until the end of the record retention period. 
891   
892  Electronic Case Report Forms (eCRFs):  Auditable electronic records of information that 
893  generally are reported to the sponsor on each participant, according to a clinical investigation 
894  protocol.  An eCRF enables clinical investigation data to be systematically captured, reviewed, 
895  managed, stored, analyzed, and reported.90 
896   
 
85 See the 2013 guidance. 
86 Ibid. 
87 Ibid. 
88 See the draft guidance for industry, investigators, and other stakeholders Digital Health Technologies for Remote 
Data Acquisition in Clinical Investigations.  When final, this guidance will represent FDAs current thinking on this 
topic.  This draft guidance covers drugs, biological products, and devices.  See also BEST (Biomarkers, EndpointS, 
and other Tools) Resource Glossary (2016), available at https://www.ncbi.nlm.nih.gov/books/NBK338448. 
89 See  11.3(b)(5). 
90 See the 2013 guidance. 
25  Contains Nonbinding Recommendations 
Draft  Not for Implementation 
897  Electronic Data Capture (EDC) Systems:  Electronic systems designed to collect, manage, and 
898  store clinical investigation data in an electronic format.   
899   
900  Electronic Health Record (EHR) System:  An electronic platform that contains individual 
901  health records for patients.  EHR systems are generally maintained by health care providers, 
902  health care organizations, and health care institutions and are used to deliver care.91 
903   
904  Electronic Records:  Any combination of text, graphics, data, audio, pictorial, or other 
905  information representation in digital form that is created, modified, maintained, archived, 
906  retrieved, or distributed by a computer system.92 
907   
908  Electronic Signatures:  Computer data compilation of any symbol or series of symbols 
909  executed, adopted, or authorized by individuals to be the legally binding equivalent of the 
910  individuals handwritten signatures.93 
911   
912  Electronic Systems:  Systems, including hardware and software, that produce electronic records. 
913       
914  Information Technology (IT) Services:  Data hosting and/or computing services, such as 
915  software as a service, platform as a service, and infrastructure as a service. 
916   
917  IT Service Provider:  A vendor who provides IT services to sponsors and other regulated 
918  entities. 
919   
920  Medical Claims Data:  The compilation of information from medical claims that health care 
921  providers submit to insurers to receive payment for treatments and other interventions.  Medical 
922  claims data use standardized medical codes, such as the World Health Organizations 
923  International Classification of Diseases Coding (ICD-CM) diagnosis codes, to identify diagnoses 
924  and treatments.94 
925   
926  Metadata:  The contextual information required to understand the data.  Metadata is structured 
927  information that describes, explains, or otherwise makes it easier to retrieve, use, or manage data.  
928  Examples of metadata include units of the data (e.g., mg), a date and time stamp for when the 
929  data were acquired, data originator, and other audit trail information associated with the data.  
930   
931  Mobile Application:  A software application that can be executed (run) on a mobile platform 
932  (i.e., a handheld COTS computing platform, with or without wireless connectivity) or a web-
933  based software application that is tailored to a mobile platform but is executed on a server.95    
 
91 See the 2018 guidance. 
92  11.3(b)(6). 
93  11.3(b)(7). 
94 See the Framework for FDAs Real-World Evidence Program (December 2018), available at 
https://www.fda.gov/media/120060/download.  
95 For more information, see the guidance for industry and FDA staff Policy for Device Software Functions and 
Mobile Medical Applications (September 2022). 
26  Contains Nonbinding Recommendations 
Draft  Not for Implementation 
934   
935  Registries:  Organized systems that collect clinical and other data in standardized formats for 
936  populations defined by a particular disease, condition, or exposure.96   
937   
938  Real-World Data (RWD):  Data relating to individual patient health status or the delivery of 
939  health care routinely collected from a variety of sources.  Examples of RWD include data from 
940  EHRs; medical claims data; data from product and disease registries; patient-generated data 
941  (including data from in-home use settings); and data gathered from other sources that can inform 
942  on health status, such as DHTs. 
943   
944  Remote Data Acquisition:  Collection of data from locations that are distant from the 
945  investigator or trial personnel.97 
946   
947  Sensor:  A transducer that converts a physical, biological, or chemical parameter into an 
948  electrical signal; for example, temperature, pressure, flow, or vibration sensor.  A sensor is 
949  typically hardware.98  
950   
951  Service Level Agreements (SLAs):  Formal, negotiated documents that define the terms of 
952  service being offered to a customer.  
953   
954  Source Data:  All information in original records and certified copies of original records of 
955  clinical findings, observations, or other activities in a clinical investigation necessary for the 
956  reconstruction and evaluation of the clinical investigation.  Source data are contained in source 
957  documents (original records or certified copies).99 
958   
959  Source Documents:  Original documents, data, and records (e.g., hospital records; clinical and 
960  office charts; laboratory notes; memoranda; subjects diaries or evaluation checklists; pharmacy 
961  dispensing records; recorded data from automated instruments; copies or transcriptions certified 
962  after verification as being accurate copies; microfiches; photographic negatives; microfilm or 
963  magnetic media; x-rays; subject files; and records kept at the pharmacy, at the laboratories, and 
964  at medico-technical departments involved in the clinical investigation).100 
965   
966  User Acceptance Testing (UAT):  A phase of testing in which users test the electronic system to 
967  ensure it can handle required tasks according to specifications.  
 
96 See the draft guidance for industry Real-World Data: Assessing Registries to Support Regulatory Decision-
Making for Drug and Biological Products (November 2021).  When final, this guidance will represent FDAs 
current thinking on this topic. 
97 See the draft guidance for industry, investigators, and other stakeholders Digital Health Technologies for Remote 
Data Acquisition in Clinical Investigations.  When final, this guidance will represent FDAs current thinking on this 
topic. 
98 See the National Institute of Standards and Technology web page, available at https://www.nist.gov/el/intelligent-
systems-division-73500/definitions. 
99 See the ICH guidance for industry E6(R2) Good Clinical Practice: Integrated Addendum to ICH E6(R1). 
100 Ibid. 
27  Contains Nonbinding Recommendations 
Draft  Not for Implementation 
968   
969  Validation:  A process of establishing and documenting that the specified requirements of an 
970  electronic system can be consistently fulfilled from design until decommissioning of the system 
971  or transition to a new system.101  
972   
973  Vendor:  A supplier that sells electronic goods or services to sponsors and other regulated 
974  entities.   
 
101 Ibid. 
28  Contains Nonbinding Recommendations 
Draft  Not for Implementation 
975  APPENDIX:  RELEVANT GUIDANCE DOCUMENTS 
976   
977  The following guidance documents, among others, have additional information pertaining to 21 
978  CFR part 11.1  They are listed in the order referenced in this guidance document.    
979   
980  1.  Guidance for industry Part 11, Electronic Records; Electronic Signatures  Scope and 
981  Application (August 2003). 
982   
983  2.  Guidance for industry E6(R2) Good Clinical Practice: Integrated Addendum to ICH 
984  E6(R1) (March 2018). 
985   
986  3.  Guidance for industry Use of Electronic Health Records Data in Clinical Investigations 
987  (July 2018). 
988   
989  4.  Guidance for industry and FDA staff Acceptance of Clinical Data to Support Medical 
990  Device Applications and Submissions:  Frequently Asked Questions (February 2018). 
991   
992  5.  Guidance for industry Q9(R1) Quality Risk Management (June 2022). 
993   
994  6.  Guidance for industry Electronic Source Data in Clinical Investigations (September 
995  2013). 
996   
997  7.  Draft guidance for industry, investigators, and other stakeholders Digital Health 
998  Technologies for Remote Data Acquisition in Clinical Investigations (December 2021).2 
999   
1000  8.  Guidance for institutional review boards, investigators, and sponsors Use of Electronic 
1001  Informed Consent in Clinical Investigations:  Questions and Answers (December 2016). 
 
1 We update guidances periodically.  For the most recent version of a guidance, check the FDA guidance web page 
at https://www.fda.gov/regulatory-information/search-fda-guidance-documents. 
2 When final, this guidance will represent FDAs current thinking on this topic.  
29