Computer systems have revolutionized the way that we as everyday people go about our day. Whether it is a smartphone in our pocket with the latest apps, a tablet device in our lab or a desktop computer in our office, using technology has, and will continue to have a positive impact on productivity and efficiency – that’s just a fact.
With the way that we consume information today and the non-flinching adoption of new devices and technology, it just seems natural that we use these systems to manage records electronically in place of paper records. As the phrase goes, “with great power, comes great responsibility.” The same can be said for computerized systems in regulated industries.
Let's take a deeper look at the 21 CFR Part 11 Regulations from the FDA, and why they are so important in today’s life science environment.
What is 21 CFR Part 11?
21 CFR Part 11 is a section in the Code of Federal Regulations (CFR) that sets forth the United States Food and Drug Administration’s (FDA) guidelines on using electronic records and electronic signatures. Each title of the CFR addresses a different regulated area, 21 CFR relates to Pharmaceuticals and Medical Devices and Part 11 being applicable to electronic records and electronic signatures.
At a high level, Part 11 is a law that ensures that companies and organizations implement good business practices by defining the criteria under which electronic records and signatures are considered to be accurate, authentic, trustworthy, reliable, confidential, and equivalent to paper records and handwritten signatures on paper. Part 11 essentially allows any paper records to be replaced by an electronic record, and allows any handwritten signature to be replaced by an electronic one.
Here are the definitions…
- Electronic Record: Any combination of text, graphics, data, audio, or pictorial information represented in digital form that is created, modified, maintained, archived, retrieved or distributed by a computer.
- Electronic Signature: A compilation of any symbol(s) executed to be the legally binding equivalent of an individual’s handwritten signature.
- Handwritten Signature: The scripted name or legal mark of an individual handwritten by that individual and executed or adopted with the present intention to authenticate a writing in a permanent form.
- Digital Signature: An electronic signature based upon cryptographic methods of originator authentication, computed by using a set of rules and a set of parameters such that the identity of the signer and the integrity of the data can be verified.
A brief history of 21 CFR Part 11
In early 1991, key groups who operated within the pharmaceutical industry met the FDA to determine how the industry would deal with electronic record keeping systems that fell within the age old GMP regulations.
Over the next few years these groups alongside the FDA started to build out the early versions of the rules we are governed by today, with the final rule becoming effective on August 20th, 1997.
From the year 2000, the FDA stated that alongside the released criteria, they would consider electronic records to carry the same compliance requirements as paper records, and including electronic signatures as an equivalent to the traditional wet ink handwritten signatures.
From the year 2000 to now (2014), the FDA has released a number of guidance papers in response to the changing landscape in an effort to clarify the rule and how it should be interpreted. Here’s a short chronological history:
- 1991 – Project Launched
- 1992 – Advanced Notice
- 1994 – Proposed Rule
- 1997 - Final Rule
- 2000 – Electronic Records
- 1999 – Computerized Systems Used in Clinical Trials (CSUCT)
- 2003 – “Scope and Application” Guidance
- 2004 – Draft Computerized Systems Used in Clinical Trials Guidance
- 2007 – Final Guidance Published
Confusion and controversy over Part 11
In essence, the rule is designed to allow life science organizations the greatest flexibility in implementing the required controls, but is highly open to interpretation. There has been much controversy and confusion about Part 11 over the years, with doubts of its comprehensiveness being a key argument. The constant revision of its guidance documents and the continuous redirection of the rule plagued opinions and have only now started to clear some of the confusion.
Why do we need the regulation?
By introducing the 21 CFR Part 11 rule, the FDA have essentially enabled the Life Science community and other FDA regulated industries to streamline business processes, reduce turnaround time and costs, all by establishing standard criteria for the use of electronic records and signatures. If it were not for this rule, we would be unable to manage records and other content electronically, significantly increasing the risk of human errors, increasing operational costs and increasing time-to-market for pharmaceutical products.
Life science applications for 21 CFR Part 11
There are three main areas in which FDA regulated companies must look at as primary areas of focus when dealing with 21 CFR Part 11:
- Features of Your System - In accordance with 21 CFR Part 11 there are a range of features that you are required to have in place when implementing a computer system to manage electronic records and processes. Assurances for audit trail functionality, electronic signatures, security and data integrity, records retention and file formats are to name but a few.
- Standard Operating Procedures - As with all regulated industries, the companies that operate within them use Standard Operating Procedures (SOP’s) to govern and describe how they are to do things. Currently in accordance with Part 11, there are around 9 IT SOP’s needed to address the IT Infrastructure requirements.
- System Validation – When implementing an electronic system for the use in regulated activities, you have to ensure that you document that the electronic system is fit for its intended use. In other words, demonstrate that your system does what it should do. You must also have controls in place that allow you to identify when the system doesn’t function as per its intended use. Here you should be utilizing your SOP’s and industry best practices (such as outlined in GAMP 5) to facilitate the validation process. However, before you start to even think about validating your application, there are some steps to take first.
