Source: http://www.labcompliance.com/tutorial/part11/
Timestamp: 2019-12-13 02:02:38
Document Index: 214308825

Matched Legal Cases: ['art 11', 'art 11', 'art=58', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 211', 'art 58', 'art 11', 'art 211', 'art 11', 'art 11', 'art 11', '§ 11', '§ 11', 'art 11', 'art 11', '§ 11', '§11', '§ 58', 'art 58', 'art 211', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art11', 'art 11', 'art 11', 'art 211', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11']

Understanding FDA's
Links to specific sections of the primer Oher information in the tutorial
In 1997 the United States Food and Drug Administration (FDA) issued a regulation that provides criteria for acceptance by the FDA of electronic records, electronic signatures and handwritten signatures (1). This was done in response to requests from the industry. With this regulation, titled Rule 21 CFR Part 11, electronic records can be equivalent to paper records and handwritten signatures.
The development of the rule was initiated around 1990 by the US Pharmaceutical Manufacturing Association (PMA, now Pharmaceutical Research and Manufacturing Association, PhRMA). Shortly after that the PMA and also the US Parental Drug Association (PDA) formed technical groups to address the subject. Industry representatives met many times with the FDA's task force under Paul J. Motise to determine how to accommodate paperless record systems under the current Good Manufacturing Practice (cGMP) regulations. The task force recommended publication of an “Advanced Notice of Proposed Rulemaking” (ANPRM) to obtain public comments on the issues involved.
The ANPRM was published in 1992. The FDA requested and received comments on a number of concerns. In 1994 the FDA published the proposed rule that incorporated many of the comments received to the ANPRM. Again, the FDA received comments from individuals, manufacturers and trade associations on the proposed rule. Finally, the rule became effective on Aug 20th, 1997 as 21 CFR Part 11. The rule is available on the FDA's website http://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfcfr/CFRSearch.cfm?CFRPart=58&showFR=1.
The new rule has high visibility and is the subject of discussion not only in the United States but also in many other countries. There are two reasons:
Many pharmaceutical companies located outside the US export drugs to the US market, and as such they have to follow US regulations. The FDA can inspect these companies according to US regulations. In case of non-compliance, the company is not allowed to export pertinent drugs to the United States, which can have a tremendous business impact.
1. In many situations using computers cannot be avoided, for example in analytical laboratories for automated data acquisition and evaluation. In this case the laboratories “must” comply with Part 11.
2. There may come a time when the FDA will no longer accept paper records and; Electronic records have some significant advantages vs. paper records: tangibly lower space requirements and easier retrieval are just two of those advantages.
Requirements of Part 11 are:
Although the rule is well-documented and the FDA gave an interpretation to 130 industry comments in their preamble, corporate IT professionals and analysts in laboratories are often unsure when it comes to implementation. Although in some areas the regulation is very specific, for example, it not only requires an electronic audit trail to demonstrate data integrity, it also specifies some attributes, but in other areas it leaves a lot of room for interpretations, for example, about the scope of Part 11. The biggest problem is finding a compromise between doing too much and satisfying minimum requirements.
What do we do with existing computer systems that don't have the appropriate functionality?
What records should we archive: original electronic records, standard files such as PDF or XML, or can we make printouts and delete the electronic records?
The FDA promotes risk-based compliance, what does this mean for Part 11?
This ´tutorial will give an overview on key requirements and discuss the FDA’s new and narrower approach and the scope of Part 11. In the second part it will discuss specific requirements more in detail, for example, validation and long-term archiving and retrieval of electronic records. We will also discuss specific applications, for example, using the Internet and Intranet and Excel applications in FDA regulated environments.
A clear understanding of the terminology is of utmost importance for a common understanding of the rule and its implementation. Therefore we will dedicate this chapter to terminology. All quotations come from 21 CFR Part 11 (1).
Electronic signatures are the electronic equivalent to handwritten signatures on paper. They may be based on biometric identification methods like fingerprint scanners or facial and voice recognition, but a simple combination of a user I.D. and password is also sufficient. Within a company, the user I.D. must be unique to a specific person. Electronic signatures are sufficient for closed systems.
Digital signatures are required for open systems and as such need higher security levels. Therefore, in addition to electronic signatures, cryptographic methods have to be applied for authentication of the user and integrity of the record.
Examples of biometrics include facial recognition, voice recognition and fingerprint scanners. Most of them need specific hardware and software. The biggest problem with such devices is validating that they work reliably for the specified user but not for anyone else.
Hybrid systems are a combination of electronic records and paper records. They are common systems in analytical laboratories today. Raw data are recorded electronically to reconstruct the analysis but the final results are printed and signed on paper. The FDA does not prohibit hybrid systems but has expressed some concerns about their acceptability.
Meta data is important for reconstructing a final report from raw data. In chromatography it includes integration parameters and calibration tables.
Predicate rule as referred in 21 CFR Part 11 are the 21 CFR Food and Drugs regulations (besides 21 CFR Part 11). They are basically promulgated under the authority of the Food, Drug and Cosmetic Act or under the authority of the Public Health Service Act.
t Specifications for Software and Computer Systems (E-153).
"Procedures should be in place for Validation of systems to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records".
That condition applies to both new and existing systems. This is nothing new for operations using computers in a regulated environment. Validating computer systems has been very well described and most companies have developed strategies for implementation. The problem lies not as much with new or fairly new systems but more with older systems. They require a formal evaluation and a statement on their validation status. If an older system cannot be validated it should not be used under 21 CFR Part 11. Information on validating software and computer systems can be found in References 2 and 3. The extent of validation depends on the complexity of the system and impact of the system on product quality and data integrity.
Binding signatures with records. Sign a data file electronically. Check the system design and verify that there is a clear link between the electronic signature and the data file. For example, the link should include the printed name or a clear reference to the person who signed, the date and time and the meaning of the signature.
Accurate and Complete Copies - 11.10(b) and 11.10(c)
The agency wants to be able to trace final results back to the raw data using the same tools as the user had when this data was generated. This is probably one of the most difficult requirements to implement. Knowing that in some instances the records must be kept for ten or more years, and as computer hardware and software have a much shorter lifetime, one can anticipate problems with this paragraph. While with the original interpretation of Part 11 this was required for each record and records had to be retained in their original form for the full retention period as required by the predicate rule, this has changed with the FDA’s new scope. Depending on a company’s business practices, on the value of the record over time and based on justified and documented risk assessment the new interpretation allows to copy the electronic records to paper or to standard electronic formats such as PDF (Portable Data Format).
Limited Access - 11.10(d)
"Procedures should be in place to limit system system access to authorized users".
Limited access can be ensured through physical and/or logical security mechanisms. Most companies already have procedures in place. For logical security users typically log on to a system with a user I.D. and password. Physical security through key locks or pass cards in addition to logical security is recommended for high-risk areas, for example, for data centers with network severs and back-data. These procedures should be very well documented and validated.
This requirement refers to automatically determining the identification and location of a piece of equipment hardware or another computer system. An example would be that a computer system controlling an instrument should automatically recognize the equipment as a valid input device through its serial number. If the serial number is not set up in the computer’s database the instrument cannot be used as an input device.
Device checks are not required in all cases but only “where appropriate”.
Procedures should make employees aware that electronic signatures have the same meaning as handwritten signatures. The content of the procedures should be communicated in trainings and enforced. It is recommended that employees should sign a statement like: “I understand that electronic signatures are legally binding and have the same meaning as handwritten signatures”.
Controls Over System Documentation - 11.10(k)
With the release of the draft guidance on “Scope and Applications for Part 11” in February 2003 (5) the FDA promoted a new and narrower approach. With the final guidance released on September 3, 2003 and the FDA’s announcement to re-examine Part 11 and initiate a new rule-making process, this new approach became official and most probably will be the basis for an updated regulation in the future.
The guidance states that Part 11 applies when:
The record is required by a predicate rule, e.g., electronic batch records for 21 CFR Part 211 and electronic training records in 21 CFR Part 58.
While 1, 3 and 4 are obvious, 2 requires some interpretation. It is related to hybrid systems where the computer is used to generate, evaluate and/or transmit electronic records and the final results are printed and the printout is maintained as the “master” record. The question is if the electronic records existing on the computer system must comply with Part 11.
FDA representatives interpreted this situation in various presentations. The recommendations are illustrated in Figure 1. First we check if the record is required by a predicate rule or used to demonstrate compliance with a predicate rule. Next, we determine if the record fits in the new, narrow scope. The main criterion is whether the record is maintained in electronic format in place of paper format, or if the record is maintained in electronic format in addition to paper records and if persons rely on the electronic record to perform regulated activities. A “regulated activity” is any activity that is required by a FDA regulation, for example, analytical test results are required to be recorded by the FDA’s 21 CFR Part 211. In this case the regulated activity is not limited to signing the record, for example, a paper printout of an electronic record, but it also includes all steps from data acquisition and evaluation. Finally, we make a risk assessment of the criticality of the Part 11 records and document the result. Based on the outcome appropriate Part 11 controls are implemented.
The last criterion is to evaluate the level of risk the record has on product quality and data integrity. Examples of high-risks records are electronic batch records and analytical records of final product testing. Errors at this stage will not be identified and can no longer be recovered before the product is shipped to the market. An example of a low-risk record would be electronic planning documents such as cleaning or maintenance schedules. Electronic standard operating procedures could fall into the medium or low risk category, depending on what impact the procedure has on product quality
While everybody seems to read and understand the first part of #1 the words “as explained in this guidance” as well as the second, third and fourth paragraph are frequently overlooked. For example, validation and audit trail are requirements of many predicate rules and the FDA can always take actions if they find deviations from predicate rules.
In the next few chapters we will take a closer look at the requirements.
"The Agency intends to exercise enforcement discretion regarding specific Part 11 requirements for validation of computerized systems (§ 11.10(a) and corresponding requirements in § 11.30)".
"Although persons must still comply with all applicable predicate rule requirements for validation (e.g., 21 CFR 820.70(i)), this guidance should not be read to impose any additional requirements for validation".
"We suggest that your decision to validate computerized systems, and the extent of the validation, take into account the impact the systems have on your ability to meet predicate rule requirements".
"We recommend that you base your approach on a justified and documented risk assessment and a determination of the potential of the system to affect product quality and safety, and record integrity".
"For instance, validation would not be important for a word processor used only to generate SOPs".
With #5 the guide gives an example on the meaning of enforcement discretion. With the old interpretation there were lots of discussions about Part 11 compliance of computer systems like word processing systems. With this statement the FDA would not expect that such systems should be validated.
While in the example of word processing systems the situation is quite obvious, in other examples it is not. The FDA expects a justification based on a documented risk assessment (see #4 of above) for all computer systems that are not validated or not fully tested.
Define risk categories for computer systems, for example, high, medium or low.
For each validation phase define the extent of validation for each risk level. For example, vendor assessment for a high-risk system may require a vendor audit and for medium and low risk systems just documentation on the vendor’s reputation and experience.
Assign each individual computer system used for GxP applications to a specific risk level.
The four steps are very well described in a reference paper “Risk-Based Validation of Commercial Off-the-Shelf Computer Systems” (7). We recommend developing a procedure for consistent implementation. An example SOP is shown in Reference 8.
"The Agency intends to exercise enforcement discretion regarding specific Part 11 requirements related to computer-generated, time-stamped audit trails (§ 11.10 (e), (k)(2) and any corresponding requirement in §11.30)".
"Persons must still comply with all applicable predicate rule requirements related to documentation of, for example, date (e.g., § 58.130(e)), time, or sequencing of events, as well as any requirements for ensuring that changes to records do not obscure previous entries".
Audit trail is a requirement of some FDA predicate rules, for example 21 CFR Part 58 (GLP). Others don’t specifically mention audit trail but require changes to data to be recorded, for example 21 CFR Part 211 (drug cGMP) states in Paragraph 194b: "Complete records shall be maintained of any modification of an established method employed in testing. Such records shall include the reason for the modification and data to verify that the modification produced results that are at least as accurate and reliable for the material being tested as the established method". If the audit trail is not generated by the computer it should be generated manually, as a minimum. A record’s integrity is a basic requirement of regulations and users of computer systems must be able to demonstrate this, especially for critical records.
#3 above mentions “other appropriate measures”. This means you can use other techniques to demonstrate record integrity, for example to demonstrate file integrity through hash values.
#4 is important as it talks about manual interaction with the system. It is difficult to demonstrate record integrity if users sit in front of a computer and can change data on the screen if there is no electronic audit trail. This becomes really critical if a change of such data can have an impact on critical records, for example, accuracy of product test results. In this case the system should have a built-in electronic audit trail and the function should be validated. This is one example where discretion would not be exercised “as explained in this guidance”.
"We recommend that you supply copies of electronic records by":
"If you have the ability to search, sort, or trend Part 11 records, copies given to the Agency should provide the same capability if it is reasonable and technically feasible".
"You should allow inspection, review, and copying of records in a human readable form at your site using your hardware and following your established procedures and techniques for accessing records".
"FDA does not intend to object if you decide to archive required records in electronic format to nonelectronic media such as microfilm, microfiche, and paper, or to a standard electronic file format (examples of such formats include, but are not limited to, PDF, XML, or SGML)".
"Persons must still comply with all predicate rule requirements, and the records themselves and any copies of the required records should preserve their content and meaning".
"As long as predicate rule requirements are fully satisfied and the content and meaning of the records are preserved and archived, you can delete the electronic version of the records".
The issues with record retention are somewhat similar as with copying records. While the original interpretation of Part 11 required maintaining the records in original form with reprocessability throughout the entire retention period as required by the predicate rule, the new approach allows other options. Most important is the statement that decisions about the retention format should be based on the record’s value over time. The value of a record is at its highest at the time when it is created, processed and displayed or printed. The information is used to make decisions about a product release, for example. If there is any doubt about correct processing the data can be reprocessed either with the same or with different parameters, if this is scientifically justified.
The value remains fairly high after the product is shipped until it is fully accepted by the market, which means no complaints from clients. The record quickly looses its value in the first years and the main reason to retain it is to have it available for the next FDA inspection. In research and development companies the value of the original record with reprocessing capability remains high for a longer time for scientific reasons. Such facilities want to be able to go back and look at the data again if new scientific challenges come up.
For hybrid systems the FDA inspector will normally ask for the paper printout. If this includes all information original electronic records are not required. However, in many situations they do not include all information to preserve the content and meaning. An example is a computerized analytical instrument, for example, a computerized liquid chromatograph with spectral capability for peak purity and compound confirmation.
Figure 2 shows the records generated during and after an analysis and all this information should be recorded either because it is directly required by a predicate rule or to demonstrate compliance with a predicate rule. While clients are primarily interested in the analysis results with graphics showing the chromatogram and tables with sample amounts, the FDA may want to see traceability of the final results back to instrument and method parameters, instrument I.D., operator name, chromatographic parameters, peak integration marks and calibration tables and audit trails for re-integration. As it is inconvenient and very difficult to print all this information for each analytical result it is recommended to keep it in original electronic form together with the original software for reprocessing if the need arises.
Figure 2: Records in Chromatography
As explained in the previous paragraphs implementation of some Part 11 controls should be based on a couple of criteria such as:
Is the record required by predicate rule?
Is a regulated activity dependent on the record?
If Part 11 controls are not implemented the FDA wants to see a documented justification as to why not. Therefore each company is advised to prepare such documentation. An example is shown in Figure 3 for a computerized analytical system used in a pharmaceutical quality control laboratory. The left upper part of the figure shows a graphical representation of the system. The right upper part lists the business practices.
The sample is injected into a computer-controlled liquid chromatograph. The signal is acquired by the PC (computer 1) and original data are stored on the computer as digital data. Data are automatically processed on this computer and results are transferred together with the evaluation parameters to a second PC with a database (computer 2) for storage and printout. The operator reviews the printout and depending on the findings may decide to manually reevaluate the data. Finally the records are maintained in electronic form because the company may need to reprocess the data later on for business reasons.
The left lower part of the figure shows a legend with information on who has access to the data on which computer and what data can be changed. In the right lower part of the figure we document the criticality of the record, if the record is required by a predicate rule and if the regulated activity depends on the record. In the middle lower part of the figure we document our decisions and justifications.
Both computer systems must be validated according to the high-risk categories. Computers 1 and 2 should have a built-in electronic audit trail because operators have access to the records and operators can change records, they are required by predicate rule and regulated activities depend on the record. We also keep the records in electronic form in addition to the paper printout because they may be needed to demonstrate compliance with the predicate rule and the company may also maintain the records in electronic form for other business reasons.
Figure 3: Documentation of Part 11 Controls
Does this software have to comply with Part 11?
· In this chapter we will discuss the most commonly used applications.
Reference 11 includes an extensive list of questions and answers.
Spreadsheet applications are popular in all kinds of businesses. Results generated are frequently used to make business decisions. They are also frequently used in regulated environments, for example, batch releases in pharmaceutical manufacturing can be based on calculations by spreadsheets. Spreadsheet programs were not designed for the regulated environment and without preventive actions the risk that they will generate errors is relatively high.
There are four possibilities to solve or reduce the compliance problem:
Perform the tasks using other software that better enable users to comply with regulations.
Change the way spreadsheets are developed and used and apply all functions built into the spreadsheet programs to increase the level of compliance. Develop a gap analysis and a corrective action plan. One action item can be step 3.
Evaluate and implement “add on” software packages that better enable users of spreadsheet programs to comply with regulations.
Use data management software with built-in Excel support and Part11/GxP functionality
While all four options are good alternatives we believe that #2 has the most long-term benefits. It requires a good understanding of the spirit of Part 11 and a good technical understanding of spreadsheet programs, for example, Excel. Most important is to understand the functions to ensure spreadsheet security and integrity.
Prepare an inventory list with all computers that run spreadsheets.
Standardize “development and use” as much as possible.
The package can be ordered from: www.labcompliance.com/books/macros.
The source directory, file name and revision number of the spreadsheet are printed together with the results. This demonstrates that only the original spreadsheet has been used.
Cells for data entry are in green. This makes it easy for the user to only access cells for data entry.
Data input are validated for plausibility. Operators are alerted about input data that are outside allowed ranges. This reduces errors during data entry.
Results are displayed in table and graphics form.
All menu items have been removed. Operators are only able to start, print and exit.
The entire spreadsheet is validated. The focus is more on checking limited access, retrieval of correct files and correct input and output locations than on verification of standard Excel calculations.
Despite modern computer technology there are still many paper records generated. Archiving large numbers of paper records requires large storage capacities. Such paper archives are also more difficult to search than electronic databases. Therefore companies prefer to scan paper records into standard electronic files, such as PDF or XML and add meta data to facilitate any search.
This procedure complies with Part 11 and other regulations if specific controls are implemented. For example, 21 CFR Part 211.180 (d) allows to retain either original records or true copies: "Records required under this part may be retained either as original records or as true copies such as photocopies, microfilm, microfiche, or other accurate reproductions of the original records". Electronic standard files fall under the category “other accurate reproductions”.
To ensure compliance with Part 11 and other regulations, we recommend:
Save the PDF file with a high security option. This means users of the file can read but not change the file.
The Internet is increasingly used for all types of businesses. This also includes the healthcare business. Two main applications are the World Wide Web for all types of on-line transactions and e-mails for exchanging messages without and with attachments. An example where the Internet can be of significant advantage is shown in Figure 5. A pharmaceutical company outsources part of its clinical studies or laboratory analyses to a contract laboratory. The sample is sent through FedEx to the contract laboratory, analyzed and the data sent back to the sponsor through e-mail with attached reports.
Figure 5: Internet Application
Administration of electronic patient records.
Billing information exchange between healthcare provider and insurance.
When transporting a clinical study or any other data as mentioned above, data traffic needs to adhere to:
Confidentiality: The contents of the data should only be accessible by authorized persons.
Procedures to protect computers from viruses.
Procedures for downloading data from the Internet.
Program Logical Controller PLC
Program Logical Controllers (PLC) are used to control equipment used in manufacturing. Data are either entered manually or downloaded from a computer. Examples are temperature and pressure of an autoclave and valve positions. If data are entered through local controllers and actual conditions are printed through a local controller, such records are not in the scope of Part 11. However, if parameters are loaded from a computer and actual conditions are monitored and recorded through a computer with manual interaction through operators, Part 11 applies.
Typically the network also supports high-risk applications such as back-up and archiving of high-risk records. Such applications should be validated and comply with Part 11.
Loosing data or inaccurate file transfer is not only a business problem but also violates the requirement for trustworthiness. Therefore file transfer accuracy should be verified under normal and high load.
Applications supported by the network should be validated. Examples include Electronic Batch Records (EBR) Systems, Enterprise Resource Planning (ERP) Systems and Laboratory Information Management Systems (LIMS). The test environment should include the same network components as the live environment.
Network infrastructure should be qualified. This mainly means good planning and documentation of the network through diagrams and inventory lists. It also means using a well-controlled procedures for changes.
In the following paragraphs the two steps for complete network qualification and system validation are briefly described. They have been extracted from Reference 10.
Steps to build a qualified network infrastructure:
Design network infrastructure and drawings.
Select equipment and vendors for computers, NOS, network devices etc.
Develop and implement rigorous configuration management and a change control procedure for all your network hardware and software. This should also include updates of system drawings if there are any changes.
Before applying any system changes to a production environment they should be verified in a test environment to insure that they do not impact the intended functionality of the system.
Monitor ongoing network traffic using a network health monitoring software.
Steps to validate a networked system:
Verify correct functioning of this application software. Apply common computer validation practices for this.
Testing should include network transactions under normal and high load. For this test you can decide to refer to verifications done as a built-in TCP/IP transfer protocol. The advantage is that this is built into the system and done on an ongoing basis. However, this is not 100% accurate as there are rare situations where the test does not work. To be on the safe side, you should use something like MD5 hash calculation routines based on 128 bit strings. Ask the vendor of your application software as sometimes such tests are built-in.
Monitor ongoing performance of your application. The type of performance test depends on the application.
For networks supporting high-risk applications monitor network connections and traffic using a network health monitoring software.
Define a priority schedule to bring all computer systems into Part 11 compliance.
Develop a procedure on how to define Part 11 controls.
Do a gap analysis to determine missing functionality and procedures for systems in 7.
Develop an implementation plan to bring systems as identified in 7 into Part 11 compliance.
Estimate costs for the systems as identified in 7 and for the whole project.
Develop procedures for limited system access to authorized individuals. This should include a password policy.
483's, Warning Letters, EIR's, Presentations: 2004-2007