11/2/99 1

CDER’s 21 CFR Part 11Implementation Study

CDER’s 21 CFR Part 11Implementation Study

Greg BrolundGreg Brolund

Associate Director, Office of Associate Director, Office of Information Technology, CDER/FDAInformation Technology, CDER/FDA

11/2/99 2

BackgroundBackground

CDER heard many concerns about the CDER heard many concerns about the implementation of Part 11implementation of Part 11 TimingTiming Legacy SystemsLegacy Systems Inconsistent information from FDAInconsistent information from FDA 483’s483’s etc.etc.

11/2/99 3

Implementation Recommendation ProjectImplementation Recommendation Project

CDER task force directed to make CDER task force directed to make recommendations for implementation of recommendations for implementation of Part 11Part 11 Directed by Dr. Janet Woodcock - May 99Directed by Dr. Janet Woodcock - May 99 To be based on an analysis of the issues raised To be based on an analysis of the issues raised

by industry, FDA inspectors, and the software by industry, FDA inspectors, and the software industry.industry.

11/2/99 4

Pharmaceutical InterviewsPharmaceutical Interviews

Representatives of four large pharmaceutical firms were interviewed. The groups consisted of people who are involved with the planning and implementation of measures to comply with Part 11 and represented the GxP areas as well as regulatory, legal, and information technology areas.

11/2/99 5

FDA InterviewsFDA Interviews

Two FDA inspectors and several FDA staff familiar with inspections, compliance policy and Part 11 were interviewed.

11/2/99 6

Software Industry InterviewsSoftware Industry Interviews

Two major software companies dealing with the pharmaceutical industry were interviewed.

11/2/99 7

CDER Task Force AnalysisCDER Task Force Analysis

The CDER task force reviewed the results of the interviews and supporting material. The task force produced the implementation recommendations.

11/2/99 8

Common Industry Part 11 ActivitiesCommon Industry Part 11 Activities

Assess current systems and try to learn as much about the FDA interpretation of the rule as possible.

Create and internal interpretation based on current business practices, impact of change on system quality, cost of changes, and feasibility of changes to meet the requirements of Part 11.

Create implementation plans. Conduct training of company staff in the meaning

of Part 11 and SOPs to comply with Part 11.

11/2/99 9

Common Industry ConcernsCommon Industry Concerns

Why are existing, validated systems that include both paper and electronic components are no longer acceptable?

Long term archiving of electronic records is not technologically feasible.

What is the true scope of Part 11?

11/2/99 10

Concerns ContinuedConcerns Continued

Automated audit trails are not feasible for many existing systems and are often not available in new software, especially in manufacturing systems.

Company systems will take years to be made compliant with the current perceived FDA interpretation of Part 11.

11/2/99 11

Concerns ContinuedConcerns Continued

The cost to become Part 11 compliant for a The cost to become Part 11 compliant for a global company is estimated to be > $100 global company is estimated to be > $100 million.million.

The cost is perceived to far out weigh the The cost is perceived to far out weigh the benefit.benefit.

11/2/99 12

FDA Concerns (sample)FDA Concerns (sample)

Electronic records are easier to falsify than Electronic records are easier to falsify than paper records if adequate controls are not in paper records if adequate controls are not in place.place.

Hybrid systems are difficult to validate and Hybrid systems are difficult to validate and verifyverify

Records must be inspected on site and over Records must be inspected on site and over long periods of time. Archiving and retrieving long periods of time. Archiving and retrieving the records could be a problem for inspectors.the records could be a problem for inspectors.

11/2/99 13

FDA Concerns ContinuedFDA Concerns Continued

Paper printouts of electronic records may Paper printouts of electronic records may omit important information.omit important information. ChangesChanges SignaturesSignatures Analysis parametersAnalysis parameters

11/2/99 14

Two Software ProvidersTwo Software Providers

Difficult to know exactly what is required.Difficult to know exactly what is required. Other industries don’t have the same Other industries don’t have the same

electronic record keeping requirements.electronic record keeping requirements. Companies would like FDA to review their Companies would like FDA to review their

interpretation and implementation for Part interpretation and implementation for Part 11 compliance11 compliance

11/2/99 15

Task Force RecommendationsTask Force Recommendations

Create a Part 11 Implementation Guidance for Industry that addresses specific issues raised by FDA and industry.

Create a position of Electronic Signature / Electronic Records Ombudsman or Coordinator to coordinate policy, internal and external training, and coordinate answers or clarification for industry and within FDA

11/2/99 16

Recommendations Recommendations

Conduct public workshops to explain the implementation policy and post appropriate materials on the FDA internet web site.

Issue clarifications on the existing Computers in Clinical Trials Guidance.

Create case studies of the characteristics of acceptable systems under the implementation policy without endorsing specific companies or products

11/2/99 17

RecommendationsRecommendations

Provide FDA participants on instrument data interchange standards committees such as those sponsored by ASTM and IUPAC.

11/2/99 18

Points to be Addressed in Specific GuidancePoints to be Addressed in Specific Guidance

Acceptability of Acceptability of paper records that are generated from electronic data

Hybrid systems - what kind of hybrid system is acceptable.

Legacy Systems - describe the characteristic of a legacy system that is acceptable until it can be upgraded.

Length of time allowed to phase out legacy systems or marginal hybrid systems..

11/2/99 19

Guidance ContinuedGuidance Continued

Electronic record archiving. Possibilities include printing the records with all available "meta" data. The paper becomes the official archive.

Scope - describe what records in a process are covered by Part 11.

Automated audit trails - describe audit trails that are part of a hybrid system. For example, if the electronic data is printed and the printed record is the official record, can changes be made in the usual way to the paper record to satisfy the audit trail requirement?

11/2/99 20

Guidance ContinuedGuidance Continued

Hospital records systems - describe the level of industry control and Part 11 compliance that is expected over systems such as hospital patient record keeping systems that are typically outside of FDA jurisdiction.

Electronic Signatures - describe the acceptability of systems that use server based electronic signatures in conjunction with standard security and accessibility system controls to verify the identity of the "signer" of the electronic record.

11/2/99 21

Current StatusCurrent Status

The FDA Office of Regulatory Affairs has The FDA Office of Regulatory Affairs has been made responsible for FDA’s Part 11 been made responsible for FDA’s Part 11 implementation policy.implementation policy.

ORA has been given a copy of the CDER ORA has been given a copy of the CDER task force report and recommendations.task force report and recommendations.