As a life sciences customer, you are probably already using Microsoft Office 365 SharePoint Online or have at least heard the word being tossed around by your IT co-workers now and then. For those of you unfamiliar with SharePoint Online, the good people at Microsoft define SharePoint Online as a “collection of Web-based tools and technologies that help your organization store, share and manage digital information.” In other words, it’s your traditional file room moved into the digital space, only that this one is cooler than the real one.
There's an inside joke in the life sciences industry that the industry produces more documents than drugs. With such a sheer volume of content to manage in a compliant fashion, the challenge is real. But not to worry, Microsoft provides several features to its clientele through SharePoint Online that make it a less cumbersome task to manage their content. Instead, Microsoft makes it easier to focus more on the primary purpose of their market presence, i.e., delivering quality products to patients.
With Office 365 cloud services and SharePoint Online, it’s up to regulated customers to manage data governance, authorize access, and configure settings to ensure data integrity. Over time, evolving business and technical needs, and growing operational requirements add to the demand for life science users of cloud-based content management systems to have a robust governance plan in place. In this article, we discuss the controls and functionalities made available in Office 365 for advanced data GxP governance.
The Paperwork
Governance of data in SharePoint Online is a segment of the larger umbrella encompassing governance of SharePoint Online. It would be worthwhile to read an article that Montrium published on Governance of SharePoint Online to better understand the premise of governance.
All GxP content created, handled and stored digitally, falls under the purview of regulations on electronic records like US FDA’s 21 CFR Part 11 and EU’s Eudralex Volume 4 Annex 11. Although the scope of these regulations is vast, the scope of this blog will be limited to the principle which mandates that electronic records should be protected and should be retrievable throughout the retention period.
Life science teams must put technical controls in place via various features of SharePoint Online to achieve the targets put forth by regulations. The need for robust procedural controls identifying various stakeholders involved in data governance, defining responsibilities, and outlining adopted methodologies and functionalities, cannot be stressed enough.
Some SharePoint Online functionalities that provide customers the capability to manage their content include In-Place Records Management, Content Types, and Retention Labels and Label Policies.
In-Place Records Management
As the name suggests, In-Place Records Management provides customers with the ability to declare content as records in their original location, instead of moving them to a records center. By declaring a document as a record, it can be configured so that the content of the record can no longer be edited or deleted. SharePoint Online also provides functionality to control who can declare or un-declare a record. At a library level, it can also be configured to automatically declare every item added to the library as a record.
Content Types
You can now declare records and prevent any unauthorized or unintended changes to the content on SharePoint Online. That’s great. But, you have auditors sitting in a meeting room and auditing your Quality Management system and want to take a look at its Validation Plan drafted two years ago. You have no idea about which folder among thousands of folders on SharePoint Online you put it in...
What now?
This is where Content Types come to the rescue. Using Content Types, it is possible to associate properties, workflows, retention policies, and various custom features with items being attributed to a certain type. This makes filtering down to the desired content and applying relevant retention policies to content based on their criticality possible.
Retention Labels and Label Policies
With Microsoft continuously improving its features, Retention Labels are gaining popularity among the users who choose SharePoint Online for their data management as a one-stop-shop for data governance. The following can be achieved using Retention Labels and Label Policies:
- Classify content.
- Label an item as a record and prevent modification of the content.
- Prevent the moving of a document from its original and intended location.
- Define and enforce retention policies on a specific site, library, folder, or item based on various criteria.
The Takeaway
Microsoft has been a trusted partner of the life sciences industry for quite some time when it comes to the management of GxP regulated content in the digital space. Microsoft has been continuously working towards improving the existing features and introducing new features like Retention Labels to improve user experience, content classification, and record management capabilities. Technical controls via SharePoint Online functionality and procedural controls via corporate procedures in tandem ensure that your data is held online in compliance with industry standards and regulations.
To help mitigate compliance risk, Office 365 customers' data benefits from having multiple layers of granular control within a robust governance model to support the management of GxP content. Montrium has developed an Office 365 Cloud Compliance Toolkit to support the governance efforts of those interested in leveraging Office 365 cloud services for regulated business processes.
Whether you are looking to make Office 365 a major part of your IT strategy or are simply just curious about this topic, we highly recommend attending The Compliance Playbook webinar series hosted by Montrium's Professional Services team. You can also register for our upcoming webinar - Best Practices for GxP Governance Processes in Office 365 to learn more on this subject.
