July 2003
'Withdrawal' of 21 CFR 11?
The document upon which I have supplied my opinion was a draft for comment and the final document has yet to be issued.
Alas Poor Part 11
Alas poor Part 11. I knew it Horatio: a regulation of infinite interpretation, of most excellent detail: it hath been on my agenda a thousand times; and now; how abhorred in my regular meetings and validation activities it is'
Please forgive the corruption of a well-known Shakespeare eulogy, but the impression has been created that Part 11 is no more or is in tatters. In this short article I want to briefly discuss the current situation regarding Part 11 and offer my personal view on what the truth of the matter is.
The term 'predicate rule', by the way, is used to describe those requirements set forth in the United States Federal Food Drugs and Cosmetics Act, the PHS Act, or any FDA (Title 21 CFR) regulation, with the exception of Part 11.
Part 11 has not gone away
Part 11 has definitely not gone away and is still very much intact and enforceable by the Food and Drug Administration (FDA). What the FDA has done is withdraw Part 11 draft, and approved, guidance documents covering the topics of (listed alphabetically):
Compliance Policy Guide (CPG 7153.17),
Electronic Copies of Electronic Records,
Glossary of Terms,
Maintenance of Electronic Records,
Time Stamps and
Validation.
The FDA made the withdrawal public in a new Part 11 Guidance document, (Part 11, Electronic Records; Electronic Signatures – Scope and Application) www.fda.gov/cber/gdlns/prt11elect.pdf, issued in February 2003 following concerns voiced by the Pharmaceutical industry and others. For example, that some interpretations of Part 11 requirements would (I quote):
Unnecessarily restrict the use of electronic technology in a manner that is inconsistent with FDA's stated intent in issuing the rule,
Significantly increase the costs of compliance to an extent that was not contemplated at the time the rule was drafted,
Discourage innovation and technological advances without providing a significant public health benefit.
These concerns have been raised particularly in the areas of Part 11 requirements concerning validation, audit trails, record retention, record copying, and legacy systems.
Guidance Part 11 issues
The February Part 11 guidance states that records must be maintained and submitted in compliance to the underlying predicate rule(s), but that FDA will take a risk based approach to enforcing compliance to Part 11 requirements for:
validation,
audit trail,
record retention, and
record copying.
Clearly, if a system can impact product safety and quality or integrity of regulated records, then the full scope of Part 11 still applies. Otherwise, 'enforcement discretion' will be used regarding these four Part 11 requirements while all other requirements of Part 11 will continue to be enforced in full.
The FDA's approach to specific Part 11 requirements can be summarised as follows:
Validation:
Predicate rule requirements for validation must be met. Businesses should base their extent of validation 'on a justified and documented risk assessment and a determination of the potential of the system to affect product quality and safety and record integrity.'
Audit Trail:
The objective is to ensure the trustworthiness and reliability of regulated records and this may require audit trails or 'other physical, logical, or procedural security measures' based on predicate rule requirements and a documented risk assessment. 'Audit trails are particularly important where the users are expected to create, modify, or delete regulated records during normal operation.'
Legacy Systems:
The FDA will not normally take regulatory action to enforce any Part 11 requirements for legacy systems that otherwise met predicate rule requirement prior to August 20, 1997. 'However, all systems must comply with all applicable predicate rule requirements and should be fit for their intended use.' In other words, legacy systems must meet predicate rule requirements for validation and have documented, auditable, evidence as to their suitability for their intended purpose.
Copies of Records:
Copying processes used should produce copies that preserve the content and the meaning of the record. Inspection, review, and copying of records should be allowed on site using local equipment and local SOPs for system access. 'If you have the ability to search, sort, or trend Part 11 records, copies provided to the Agency should provide the same capability if it is technically feasible.'
Record Retention:
How to maintain records should be based on predicate rule requirements and the value of the records over time. 'FDA normally does not intend to object if you decide to archive required records in electronic format to nonelectronic media such as microfilm, microfiche, and paper, or to a standard electronic file format, such as PDF... the records themselves and any copies of the required records should preserve their content and meaning.
FDA will also 'interpret' Part 11 more narrowly than appeared to be the case prior to February 2003 and the guidance clarifies that fewer records will be subject to Part 11. The records, to which Part 11 is applicable, can be summarised as follows:
Those that are required by predicate rules and are maintained in electronic format in place of paper format.
Those that are required to be maintained by predicate rules, are maintained in electronic format in addition to (as well as) paper format and are relied upon to perform regulated activities.
Those submitted to FDA under predicate rules, even if they are not specifically identified in regulation, in electronic format, assuming that they are identified in the docket as those which FDA will accept in electronic format.
Electronic signatures that are intended to be the equivalent of those signatures, initials and other general signings required by predicate rules.
Conclusion
21 CFR Part 11 is United States Federal law and must be followed – assuming you wish to market in that region. You should also remember that any FDA 'Guidance to Industry' document is not law and as such it and other guidance's issued by the FDA simply represent current thinking on a subject. These documents must be viewed only as a recommendation on how to proceed in meeting the requirements of Part 11. Having said that the FDA's Guidance to Industry for Computerized Systems Used in Clinical Trials remains as an excellent guidance document and also applies to these systems.
So really, in my humble opinion, nothing much has changed but some of the 'fog' has been cleared away. No matter what we might like to think, GxP predicate rules and Part 11 definitely still apply to many of our computerised systems.
In closing, may I strongly recommend that you visit the website www.accessdata.fda.gov/scripts/oc/ohrms/index.cfm frequently.
Dave Smith
Roche