Mayo Clinic flexible and risk-based strategies to address FDA data integrity requirements

1191 Introduction: In December 2018 FDA issued a final guidance for industry titled “Data Integrity and Compliance with Drug CGMP: Questions and Answers” which also applies to PET drugs. Data integrity has recently been a hot topic in FDA inspections at PET drug production facilities. The purpose of this report is to share our initial experience with the PET community on our approaches to meaningfully and effectively manage the data integrity risks in our PET radiochemistry facility. Methods: FDA data integrity guidance, as well as FDA presentations, publications, and inspections related to data integrity issues were used to evaluate the data integrity compliance status of our PET CGMP operations. The seven questions covered in the FDA guidance are: (1) Are controls in place to ensure that data is complete? (2) Are activities documented at the time of performance? (3) Are activities attributable to a specific individual? (4) Can only authorized individuals make changes to records? (5) Is there a record of changes to data? (6) Are records reviewed for accuracy, completeness, and compliance with established standards? (7) Are data maintained securely from data creation through disposition after the record’s retention period? A gap analysis was conducted and focused initially on key manufacturing and analytical devices such as PET drug synthesizer, radio-TLC, GC, HPLC, and endotoxin testing devices to see if these devices in our lab meet the data integrity requirements. Results: Answers to questions (1) and (2): both data completeness and contemporaneous data recording could be achieved by equipment operation system and audit trail (a secure, computer-generated, time-stamped electronic record). Data completeness could be further ensured by implementing procedural standard operation procedures. To solve questions (3) and (4), we removed generic login and build-in administration accounts. Individual login with different level of access privileges was assigned implemented. If the equipment cannot handle login credentials and access privileges, Windows-based program can be utilized. Permission to alter specifications, process parameters, and manufacturing or testing methods were only assigned to personnel independent from those responsible for the record content. The requirement described in question (5) could be easily realized by audit trail. Audit trail supports tracking actions such as attempts to access the system, rename or delete a file, as well as reconstructing of the course of events relating to the creation, modification, or deletion of an electronic record. However, not all devices that we have evaluated possess audit trail functionality. HPLC systems in our lab do have both instrument and data audit trail capability. Our current policy in dealing with question (6) was to review records (including rerunning analytical testing, invalidated data, and audit trails which are considered part of the associated records, etc.) by the quality oversight unit. Review frequency was determined based on PET CGMP operation of risk. Audit trails that capture changes to critical data was an important review aspect. Our approach to address question (7) was securing all original and backup data on a server or external hard drives throughout the record’s retention period with all associate metadata required to reconstruct the CGMP activities. Conclusions: Our risk-based strategies in tackling data integrity issues took into consideration of operation flexibility, financial affordability, and “checks and balances” objectivity. Further assessments of our data integrity program will be continued and extended to other types of equipment and paper-record activities.