How the Cloud is Finding its Place in the Life Sciences: Cloud Success Stories

In general, there is a reluctance among life science companies to change the manner in which they manage their records, especially when the option of utilizing cloud services is on the table. However, when you consider that records produced by these companies are frequently subject to regulatory audits, this hesitation towards embracing new technologies is entirely understandable. 

Often, life science companies are reassured when they see that other industry players have successfully put in place new technologies to improve their processes. With regards to cloud computing, Microsoft has published a series of case studies showcasing life sciences companies’ use of their Azure cloud services in the context of regulated activities. In this article, we look at how the Life Sciences companies are implementing cloud-based solutions and what the potential GxP impact of each use case could be.

1. Medplast

Overview:

Use Case Summary:

Medplast is a medical device contract manufacturer that fabricates various medical devices such as syringes, IV kits, cardiovascular stents, and orthopedic implants. As a contract manufacturer, Medplast is responsible for retaining design and supply-chain data for their customers. To streamline their data backup and disaster recovery process, MedPlast switched its data-storage environment to Microsoft StorSimple cloud-integrated storage. (You can view the full case study here)

Potential GxP Impact:

Medical device contract manufacturers, like MedPlast, must keep records related to the medical device manufacturing activities and design history as per requirements stipulated in 21 CFR 820 and ISO 13485.  Should these records be stored exclusively in an electronic format, they would be subject to regulatory requirements that cover electronic records, such as 21 CFR Part 11 and Annex 11.  These regulations require that controls be put in place to protect the records throughout their entire retention period including any data stored in a cloud environment. 

2. Opus IRB

Overview:

Use Case Summary:

Opus IRB deployed a pharmacovigilance cloud solution to increase the speed of reporting of serious adverse events (SAE) associated with clinical trials. This solution is used to collect data related to adverse events that are subsequently reported to regulatory authorities, such as the FDA. (You can view the full case study here)

Potential GxP Impact:

Good Clinical Practice (GCP) regulations as defined with 21 CFR Part 312 for adverse event reporting require that these occurrences are rapidly analyzed and reported.  Under GCP regulations, the reports of such events are considered as official records.  As per regulatory requirements, the computer systems used during a clinical trial must be validated to demonstrate that they are fit for their intended use.  Also, if SAE records are being maintained in electronic format, the systems used to manage these records must also meet the requirements of 21 CFR Part 11 about the use of electronic records and electronic signatures, if applicable. 

3. Alvogen

Overview:

Use Case Summary:

Alvogen, a manufacturer of generic pharmaceuticals, uses SAP for managing several business functions including drug development, logistics, and manufacturing.  To mitigate the risks associated with a loss of data from the SAP application, Alvogen chose to use Microsoft Azure as a disaster recovery service for its SAP instances. Every five minutes, all SAP transactions recorded in the production database are to be recorded in a log file, and then subsequently copied to the standby database in Microsoft Azure. (You can view the full case study here)

Potential GxP Impact:

Manufacturing data typically managed and maintained by Enterprise Resource Planning (ERP) systems, such as SAP, are considered to have GxP impact, as they could include critical production batch information related to the product.  The production data maintained within these systems must be retained for a specified retention period as defined in governing regulations, such as 21 CFR Part 211 and ICH Q7.   If the data is kept in electronic format only, then the requirements of 21 CFR Part 11 and Annex 11 could also be applicable.   The computerized systems used to store data as part of a disaster recovery program would need to be validated to demonstrate that the data can be readily retrieved throughout the applicable retention period and the data recovered is accurate.

What’s next?

All of the organizations profiled in the case studies summarized above share similar benefits when managing their regulated applications in the cloud, regardless of the type of GxP activities involved. Users point to cost savings incurred by not having to purchase and maintain the underlying infrastructure, as well as advantages related to system scalability and flexibility.

While these success stories are encouraging, life science organizations looking to utilize cloud solutions are nevertheless responsible for performing their due diligence to ensure that cloud applications meet current business needs and satisfy all applicable regulations.

The first step to accomplishing this is to perform a vendor assessment to ensure that the cloud products your prospective vendor offers are appropriate for your organization. Once you have selected a vendor and identified the cloud services that are right for you, it is necessary to qualify the system to demonstrate that it’s fit for its intended use. In keeping with their focus on providing cloud solutions for life science companies, Microsoft partnered with Montrium to publish a guideline to assist their customers in establishing a qualification strategy for using Microsoft Azure for GxP purposes.  This effort provided the framework for Montrium’s Microsoft Azure Cloud Qualification Template Pack, which includes a full set of qualification documents, including test scripts, developed based on industry standards.