john f murray jr 1 part 11, electronic records; electronic signatures john f. murray jr. u.s. food...

John F Murray JrJohn F Murray Jr 11

Part 11, Electronic Records; Part 11, Electronic Records; Electronic SignaturesElectronic Signatures

John F. Murray Jr.John F. Murray Jr.U.S. Food and Drug AdministrationU.S. Food and Drug AdministrationCenter for Devices and Radiological Center for Devices and Radiological

HealthHealth


What is Part 11?What is Part 11?

Part 11 is an FDA regulation that imposes Part 11 is an FDA regulation that imposes certain requirements on manufacturers certain requirements on manufacturers when they choose to maintain FDA-when they choose to maintain FDA-required records in electronic formrequired records in electronic form

Part 11 requirements are intended to help Part 11 requirements are intended to help assure the integrity, validity and assure the integrity, validity and trustworthiness of electronic recordstrustworthiness of electronic records


Why is Part 11 important?Why is Part 11 important?

For electronic records and submissions For electronic records and submissions

to have the same integrity as paper to have the same integrity as paper

records, they must be developed, records, they must be developed,

maintained, and used under maintained, and used under

circumstances that make it difficult for circumstances that make it difficult for

them to be inappropriately modified. them to be inappropriately modified.

[Preamble, p. [Preamble, p.

13464]13464]


Paper vs Electronic RecordsPaper vs Electronic Records

Paper records/handwritten signaturesPaper records/handwritten signatures

Old established technologyOld established technology

Familiar and well understoodFamiliar and well understood

Electronic records/electronic signaturesElectronic records/electronic signatures

New technology New technology

Less familiar and less well understoodLess familiar and less well understood


Paper vs Electronic RecordsPaper vs Electronic Records

Paper records/handwritten signaturesPaper records/handwritten signaturesWell established forensic methods for detecting Well established forensic methods for detecting

changes and forgeries changes and forgeries

Handwritten signatures considered bindingHandwritten signatures considered binding

Electronic records/electronic signaturesElectronic records/electronic signaturesForensic methods for detecting changes are Forensic methods for detecting changes are

neither familiar nor widely understoodneither familiar nor widely understood

Many do not perceive E-signatures as binding Many do not perceive E-signatures as binding


History of Part 11History of Part 11Went into effect on 20 August 1997Went into effect on 20 August 1997

Industry consistently expressed concerns Industry consistently expressed concerns that some interpretations of part 11 would:that some interpretations of part 11 would:

Unnecessarily restrict use of electronic Unnecessarily restrict use of electronic technologytechnology

Significantly increase costs of complianceSignificantly increase costs of compliance

Discourage innovation and technological Discourage innovation and technological advances advances More . . .More . . .


History of Part 11History of Part 11 In February 2003 FDA withdrew Part 11 In February 2003 FDA withdrew Part 11

draft guidance on:draft guidance on:Electronic copies of electronic recordsElectronic copies of electronic records

ValidationValidation

Glossary of termsGlossary of terms

Time stampsTime stamps

Maintenance of electronic recordsMaintenance of electronic records

Compliance Policy Guide 7153.17 Compliance Policy Guide 7153.17 More . . .More . . .


History of Part 11History of Part 11

FDA issued new draft guidance on FDA issued new draft guidance on 25 February 200325 February 2003

FDA is re-examining Part 11 and FDA is re-examining Part 11 and anticipates rulemaking to revise provisionsanticipates rulemaking to revise provisions

FDA is issuing new guidance describing FDA is issuing new guidance describing how we intend to exercise enforcement how we intend to exercise enforcement discretion for discretion for certaincertain Part 11 requirements Part 11 requirements while we re-examine Part 11while we re-examine Part 11


What does “exercise enforcement What does “exercise enforcement discretion” mean?discretion” mean?

It means FDA does not intend to take It means FDA does not intend to take enforcement action to enforce compliance enforcement action to enforce compliance with certain requirements - usually under with certain requirements - usually under certain specified conditionscertain specified conditions

For foreign manufacturers enforcement For foreign manufacturers enforcement action means sending a Warning Letter or action means sending a Warning Letter or sending a Warning Letter AND preventing sending a Warning Letter AND preventing products from entering the U.S. products from entering the U.S.


New FDA Approach to Part 11New FDA Approach to Part 11Fewer records will be considered subject Fewer records will be considered subject

to Part 11to Part 11

FDA will exercise enforcement discretion FDA will exercise enforcement discretion in regard to certain Part 11 requirementsin regard to certain Part 11 requirements

FDA will continue to enforce all predicate FDA will continue to enforce all predicate rule requirements, including requirements rule requirements, including requirements for records and recordkeepingfor records and recordkeeping


What is a predicate rule?What is a predicate rule?

For purposes of Part 11, a predicate rule is For purposes of Part 11, a predicate rule is any FDA rule, regulation or law that any FDA rule, regulation or law that requires manufacturers to maintain requires manufacturers to maintain recordsrecords

The predicate rule identifies what records The predicate rule identifies what records must be maintained and for how longmust be maintained and for how long

Part 11 addresses how electronic records Part 11 addresses how electronic records must be maintainedmust be maintained


Scope of Part 11Scope of Part 11

21 CFR 21 CFR § 11.1§ 11.1


What records will be subject to What records will be subject to Part 11 requirements?Part 11 requirements?

Part 11 will apply when electronic records Part 11 will apply when electronic records are used in place of paper recordsare used in place of paper records

Part 11 will NOT apply when:Part 11 will NOT apply when:Computers are used to generate paper Computers are used to generate paper

printouts of electronic records;printouts of electronic records;These paper records meet all predicate rule These paper records meet all predicate rule

requirements; andrequirements; andPersons rely on paper records to perform Persons rely on paper records to perform

regulated activities regulated activities


What should I do?What should I do?

Determine which electronic records you Determine which electronic records you maintain in place of paper records to meet maintain in place of paper records to meet predicate rule requirements and which predicate rule requirements and which electronic records are NOT required by electronic records are NOT required by predicate rulespredicate rules

Those records not required by a predicate Those records not required by a predicate rule are not covered by Part 11rule are not covered by Part 11

Document your decisionsDocument your decisions


What if I use the electronic What if I use the electronic records?records?

If you use an electronic record to perform If you use an electronic record to perform regulated activities, Part 11 applies, even regulated activities, Part 11 applies, even if you generate a paper printout if you generate a paper printout

Determine in advance whether you will Determine in advance whether you will use the electronic record or the paper use the electronic record or the paper record to perform regulated activitiesrecord to perform regulated activities

Document your decision in a Standard Document your decision in a Standard Operating Procedure or specification Operating Procedure or specification


What about electronic records I What about electronic records I submit to FDA?submit to FDA?

Part 11applies to electronic records Part 11applies to electronic records submitted to FDA under a predicate rule, submitted to FDA under a predicate rule, even if such records are not specifically even if such records are not specifically identified in FDA regulationsidentified in FDA regulations

Part 11 does Part 11 does notnot apply to records that are apply to records that are not submitted to FDA but are used in not submitted to FDA but are used in generating a submission – unless a generating a submission – unless a predicate rule requires such records to be predicate rule requires such records to be maintained maintained


What about electronic signatures?What about electronic signatures?

Part 11 applies to electronic signatures Part 11 applies to electronic signatures that are:that are:

Intended to be the equivalent of handwritten Intended to be the equivalent of handwritten signatures, initials, or other signings required signatures, initials, or other signings required by predicate rulesby predicate rules

Used to document the fact that certain events Used to document the fact that certain events or actions occurred in accordance with the or actions occurred in accordance with the predicate rule (e.g. approved, reviewed, predicate rule (e.g. approved, reviewed, verified)verified)


Validation and Related Validation and Related RequirementsRequirements

21 CFR 21 CFR § 11.10(a), § 11.30 & § 11.10(a), § 11.30 & 21 CFR § 820.70(i)21 CFR § 820.70(i)


Must I validate my electronic Must I validate my electronic recordkeeping and signature system?recordkeeping and signature system?

FDA intends to exercise enforcement FDA intends to exercise enforcement discretion for Part 11 validation discretion for Part 11 validation requirementsrequirements

However, the Quality System Regulation However, the Quality System Regulation requires computerized systems to be requires computerized systems to be validated [21 CFR 820.70(i)]validated [21 CFR 820.70(i)]

New FDA Part 11 guidance does not New FDA Part 11 guidance does not impose any impose any additionaladditional validation validation requirementsrequirements


Why is validation important?Why is validation important?

Your computerized systems can have an Your computerized systems can have an impact on:impact on:

Your ability to meet predicate rule Your ability to meet predicate rule requirementsrequirements

The accuracy, reliability, integrity, The accuracy, reliability, integrity, availability and authenticity of required availability and authenticity of required records and signaturesrecords and signatures


Do you have additional advice?Do you have additional advice?

Base your approach to validation on: Base your approach to validation on:

A justified and documented risk A justified and documented risk assessmentassessment

A determination of the potential of the A determination of the potential of the system to affect product quality and system to affect product quality and safety and record integritysafety and record integrity


What guidance is available for What guidance is available for software validation?software validation?

General Principles of Software Validation: General Principles of Software Validation:

http://www.fda.gov/cdrh/comp/guidance/938.pdfhttp://www.fda.gov/cdrh/comp/guidance/938.pdf

http://www.fda.gov/cdrh/comp/guidance/938.htmlhttp://www.fda.gov/cdrh/comp/guidance/938.html

Good Automated Manufacturing Practice Good Automated Manufacturing Practice Guide for Validation of Automated Guide for Validation of Automated Systems, GAMP 4:Systems, GAMP 4:

http://www.ispe.org/gamp/http://www.ispe.org/gamp/


Audit Trail and RelatedAudit Trail and RelatedRequirementsRequirements

21 CFR 21 CFR § 11.10(e), 11.10(k)§ 11.10(e), 11.10(k)(2) and 11.30(2) and 11.30


What is an audit trail?What is an audit trail?

An audit trail:An audit trail: Is secure and computer generated and Is secure and computer generated and

associated with a specific recordassociated with a specific recordRecords who creates, modifies or deletes an Records who creates, modifies or deletes an

electronic recordelectronic recordRecords when the record was created, Records when the record was created,

modified or deletedmodified or deleted

Changes made to records should not Changes made to records should not obscure previously recorded informationobscure previously recorded information


Must all electronic records have an Must all electronic records have an audit trail?audit trail?

FDA will exercise enforcement discretion FDA will exercise enforcement discretion in regard to audit trail requirementsin regard to audit trail requirements

Persons must comply with all predicate Persons must comply with all predicate rule requirements related to:rule requirements related to:

Date, time or sequencing of eventsDate, time or sequencing of events

Ensuring that changes to records do not Ensuring that changes to records do not obscure previous entries obscure previous entries

More . . .More . . .


Should all electronic records have Should all electronic records have an audit trail?an audit trail?

Even in the absence of predicate rule Even in the absence of predicate rule requirements to document date, time or requirements to document date, time or sequence of events, an audit trail will help sequence of events, an audit trail will help ensure the trustworthiness and reliability of ensure the trustworthiness and reliability of recordsrecords

Audit trails are especially appropriate Audit trails are especially appropriate when users are expected to create, modify when users are expected to create, modify or delete regulated records during normal or delete regulated records during normal operationsoperations


How can I decide whether records How can I decide whether records should have audit trails?should have audit trails?

Base your decision on:Base your decision on:

The need to comply with predicate rule The need to comply with predicate rule requirementsrequirements

A justified and documented risk assessmentA justified and documented risk assessment

A determination of the potential effect of lack A determination of the potential effect of lack of record integrity on product quality and of record integrity on product quality and safety and record integritysafety and record integrity


Legacy SystemsLegacy Systems


What is a legacy system?What is a legacy system?

For purposes of Part 11, a legacy For purposes of Part 11, a legacy

system is a computerized system is a computerized

recordkeeping system that was in recordkeeping system that was in

operation before Part 11 went into operation before Part 11 went into

effect on 20 August 1997effect on 20 August 1997


Must legacy systems comply with Must legacy systems comply with Part 11?Part 11?

FDA intends to exercise enforcement FDA intends to exercise enforcement

discretion with respect to all Part 11 discretion with respect to all Part 11

requirement for legacy systems if the requirement for legacy systems if the

certain criteria are met for a specific certain criteria are met for a specific

systemsystem


What are the criteria for legacy What are the criteria for legacy systems?systems?

Operational before 20 August 1997Operational before 20 August 1997Met all applicable predicate rule Met all applicable predicate rule

requirements before 20 August 1997requirements before 20 August 1997Currently meets all applicable predicate Currently meets all applicable predicate

rule requirementsrule requirementsDocumented evidence shows system is fit Documented evidence shows system is fit

for intended use and has an acceptable for intended use and has an acceptable level of record security and integritylevel of record security and integrity


What if I made changes to my legacy What if I made changes to my legacy system since 20 August 1997?system since 20 August 1997?

If the changes introduce risks to record If the changes introduce risks to record

security and integrity, apply Part 11 security and integrity, apply Part 11

controls to records and signatures using controls to records and signatures using

this guidancethis guidance


Copies of RecordsCopies of Records

21 CFR 21 CFR § 11.10(b) and § 11.30§ 11.10(b) and § 11.30


Must I provide electronic copies of Must I provide electronic copies of records to FDA investigators?records to FDA investigators?

FDA intends to exercise enforcement FDA intends to exercise enforcement discretion with regard to generating copies discretion with regard to generating copies of recordsof records

You should provide an FDA investigator You should provide an FDA investigator with reasonable and useful access to with reasonable and useful access to records during an inspectionrecords during an inspection

All records held by you are subject to All records held by you are subject to inspection according to predicate rules inspection according to predicate rules



Must I provide electronic copies of Must I provide electronic copies of records to FDA investigators?records to FDA investigators?

FDA recommends that you supply copies FDA recommends that you supply copies of electronic records by:of electronic records by:Producing copies of records in common Producing copies of records in common

portable formats when records are maintained portable formats when records are maintained in these formatsin these formats

Using established automated conversion or Using established automated conversion or export methods where available to make export methods where available to make copies in a more common format (copies to copies in a more common format (copies to PDF, XML or SGML for example)PDF, XML or SGML for example)


Does FDA have other requirements Does FDA have other requirements for electronic copies?for electronic copies?

The copying process used should produce The copying process used should produce copies that preserve the content and copies that preserve the content and meaning of the recordmeaning of the record

If you have the ability to search, sort or If you have the ability to search, sort or trend records, copies given to FDA should trend records, copies given to FDA should preserve the same capability if reasonable preserve the same capability if reasonable and technically feasibleand technically feasible


Must I allow the FDA investigator to Must I allow the FDA investigator to look at my electronic records?look at my electronic records?

You should allow inspection, review and You should allow inspection, review and

copying of records in a human readable copying of records in a human readable

form at your site using your hardware and form at your site using your hardware and

following your established procedures and following your established procedures and

techniques for accessing recordstechniques for accessing records


Record RetentionRecord Retention

21 CFR 21 CFR § 11.10(c) and §11.30§ 11.10(c) and §11.30


Will FDA enforce record retention Will FDA enforce record retention requirements in Part 11?requirements in Part 11?

FDA intends to exercise enforcement FDA intends to exercise enforcement

discretion with regard to Part 11 discretion with regard to Part 11

requirements for protection of records to requirements for protection of records to

enable their accurate and ready retrieval enable their accurate and ready retrieval

throughout the record retention periodthroughout the record retention period


What should I consider when What should I consider when deciding how to archive records?deciding how to archive records?

How you maintain your records should be How you maintain your records should be based on:based on:

Predicate rule requirements Predicate rule requirements

A justified and documented risk A justified and documented risk assessmentassessment

A determination of the value of records A determination of the value of records over timeover time


How may I archive electronic How may I archive electronic records?records?

You may archive electronic records to You may archive electronic records to nonelectronic media such as:nonelectronic media such as:MicrofilmMicrofilm

MicrofichesMicrofiches

PaperPaper

Standard electronic file format such as Standard electronic file format such as PDF, XML or SGMLPDF, XML or SGML


May I delete electronic records May I delete electronic records after they have been archived?after they have been archived?

You may delete the original electronic You may delete the original electronic records after archiving them if:records after archiving them if:

You comply with all predicate rule You comply with all predicate rule requirementsrequirements

The archived copies preserve the The archived copies preserve the content and meaning of the original content and meaning of the original recordsrecords


Can I use a combination of paper Can I use a combination of paper and electronic records?and electronic records?

Paper and electronic record and Paper and electronic record and signature components can co-exist if:signature components can co-exist if:

Predicate rule requirements are metPredicate rule requirements are met

The content and meaning of records are The content and meaning of records are preservedpreserved


Are there any Part 11 requirements Are there any Part 11 requirements not affected by this guidance?not affected by this guidance?

Yes. FDA intends to enforce provisions Yes. FDA intends to enforce provisions relating to the following controls and relating to the following controls and requirements:requirements:Limiting system access to authorized Limiting system access to authorized

individualsindividuals

Use of operational system checksUse of operational system checks

Use of authority checksUse of authority checks

Use of device checks Use of device checks More . . .More . . .



Yes. FDA intends to enforce provisions Yes. FDA intends to enforce provisions relating to the following controls and relating to the following controls and requirements:requirements:

Determination that persons who develop, Determination that persons who develop, maintain or use electronic systems have the maintain or use electronic systems have the education, training and experience to perform education, training and experience to perform their assigned taskstheir assigned tasks





Establishment of and adherence to written Establishment of and adherence to written policies that hold individuals accountable for policies that hold individuals accountable for actions initiated under their electronic actions initiated under their electronic signaturessignatures





Appropriate controls over systems Appropriate controls over systems documentationdocumentation

Controls for open systems corresponding to Controls for open systems corresponding to controls for closed systems bulleted abovecontrols for closed systems bulleted above





Requirements related to electronic signatures Requirements related to electronic signatures ((§§ 11.50, 11.70, 11.100, 11.200 and 11.300)§§ 11.50, 11.70, 11.100, 11.200 and 11.300)


What if I have questions about What if I have questions about Part 11 in the future?Part 11 in the future?

Contact:Contact:Mr. John MurrayMr. John Murray

Office of ComplianceOffice of Compliance

E-mail: E-mail: [email protected]@cdrh.fda.gov

Ms. Christine NelsonMs. Christine Nelson

Office of Health and Industry ProgramsOffice of Health and Industry Programs

Division of Small Manufacturers, International and Division of Small Manufacturers, International and Consumer AssistanceConsumer Assistance

E-mail: E-mail: [email protected]@cdrh.fda.gov

john f murray jr 1 part 11, electronic records; electronic signatures john f. murray jr. u.s. food...

Documents

john f murray jrwhat

fda rule

electronic formpart

certain requirements

fda regulation

predicate rule requirements

fewer records

enforcement discretion