Source: https://www.labfolder.com/white-papers/fda-compliance/
Timestamp: 2019-04-24 17:57:29
Document Index: 674854419

Matched Legal Cases: ['art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11']

FDA Compliance - labfolder
Since the compliant adherence to 21 CFR Part 11 is not solely depending on the software system but also on procedural controls (e.g. document control, SOPs, training etc.) within an organization which uses electronic records, a software cannot be certified to be compliant (and any software vendor claiming a 21 CFR Part 11-compliance is incorrect!). It is, however, possible for software vendors to offer a system which meets the technical requirements for electronic records set by the FDA in a compliant set-up.
This document gives a brief overview of technical features which fulfill the requirements of 21 CFR Part 11 and facilitate its implementation within an organization. This document does not give detailed information on 21 CFR Part 11, nor does it provide legal advice for full compliance.
The full text of 21 CFR Part 11 can be found on the FDA website.
The following outline below summarizes the sections of the 21 CFR part 11 regulations which are relevant to electronic systems, also pointing out the labfolder implementation to meet these technical requirements.
*If you would like to have the FDA compliance information as a file, you can get a free access of the PDF version of this whitepaper here:
labfolder implementation: According to the FDA classification above, labfolder is a closed system because the use of the electronic lab notebook requires a login and password which are both unique to the labfolder-system.
Confidentiality: All records are by default only available to the authors, and authors can share them with other users whithin the closed system. Sharing rules and access rights can be set up within an organization to further increase confidentiality.
Integrity: Every single record as well as changes to a record are tracked in a full audit trail and obtain a time stamp provided by the server-system which cannot be manipulated by users. The deletion of documents is possible after authorization, and can be further controlled by organizational policy.
labfolder implementation: Access to records in the closed system can be granted to any individual or organization, and PDFs of records can be exported anytime. In both implementations, third parties can review records, authors, time stamps, audit trails and electronic signatures.
labfolder implementation: In the cloud version, records are stored for three years beyond the subscription period unless explicitly being deleted by the user. Thus, labfolder complies with the standard “records retention period” of 21 CFR Part 11. On local server installations, retrieval throughout the records retention period is within the responsibility of the hosting organization.
labfolder implementation: Access to labfolder requires authentication via a unique username and password. Access to records can be controlled, granted and revoked anytime by the organization which controls and owns these records.
labfolder implementation: All records and record changes are provided with a system-created time-stamp and recorded in an audit trail which cannot be manipulated by any user of labfolder. Deletion of records can be controlled and prohibited by organizational policy.
labfolder implementation: If an organization requires the sequence check of steps and events, they can implement these into their procedural descriptions in labfolder, using the placeholder templates.
labfolder implementation: Additional to the login, every user can be assigned administrative roles within an organization. Read/write access to records as well as the possibility to sign can be managed for every member of the organization individually, allowing to enforce authority checks even within nested and branched organizational structures.
labfolder implementation: A login is required from every device from which records are accessed and IP addresses of the device is stored for every session.
labfolder implementation: The labfolder development team is well trained on the field of software design, implementation of cryptographic methods and regulations. labfolder team members who are not familiar with the system and the requirements are being provided with manuals and training.
This feature is beyond the scope of the software system provided by labfolder. However, labfolder can provide guidelines and training to ensure compliance.
labfolder implementation: This section does not apply to labfolder because labfolder is a ‘closed system’ according to FDA definition.
labfolder implementation: labfolder provides a digital signature which indicates the printed name of the signer, a time-stamp for the signature and the meaning of the signature. Signature meanings can be controlled within an organization.
labfolder implementation: Digital signatures in labfolder as well as their authors and time-stamps cannot be altered once issued. Digital signatures are displayed at the bottom of each record, and are exported as well during a PDF export.
labfolder implementation: Apart from being electronically linked to each record, electronic signatures in labfolder are linked to the SHA-1 hash-sum of each record, and can thus not be excised, copied or transferred to another record.
labfolder implementation: Any combination of username and password in labfolder is unique. SInce electronic signatures are linked to the username/password combination, they can be used only by one individual per signature.
The submission of certifications to the FDA is beyond the scope of the software system provided by labfolder. However, labfolder can provide templates for submission forms, which can then be submitted to the agency.
labfolder implementation: The first check whether a signature is executed by the authorized individual is provided by the system-login, which is unique for each individual user of labfolder. labfolder offers both biometric (handwritten) signatures and non-biometric signatures. When using a non-biometric signature, the login and password combination has to be entered again for every signature.
labfolder implementation: The user name/password combination which is required to authenticate to the system is unique for each individual user of labfolder.
This feature is beyond the scope of the software system provided by labfolder. A regular password change has to be governed by organizational policies.
This feature is beyond the scope of the software system provided by labfolder. labfolder does not natively require access tokens, but can provide consulting on how to implement token safeguards.
labfolder implementation: labfolder has implemented security features that report suspicious behaviour (multiple logins, subsequent logins from alternating locations etc.). Unauthorized use can further be detected and prevented by monitoring and restricting IP addresses for system access.