Presentation is loading. Please wait.

Presentation is loading. Please wait.

©QPharma 2010 21 CFR Part 11 Regulatory Overview and What’s New with the FDA Presented by: Frederick J. Sperry Validation Manager.

Similar presentations

Presentation on theme: "©QPharma 2010 21 CFR Part 11 Regulatory Overview and What’s New with the FDA Presented by: Frederick J. Sperry Validation Manager."— Presentation transcript:

1 ©QPharma CFR Part 11 Regulatory Overview and What’s New with the FDA Presented by: Frederick J. Sperry Validation Manager

2 2 ©QPharma 2010 Agenda Regulatory History Regulation Applicability E-Record Requirements Review E-Signature Requirements Review What’s New With FDA Enforcement Q&A

3 3 ©QPharma 2010 Regulatory History 1997 – 21 CFR Part 11; Final Rule – Enforcement, 6 Draft Guidances Issued 2003 – Previous Guidances Withdrawn 2003 – Guidance on Scope and Application (Kindler – Gentler Part 11)  cGMPS for 21 st Century  Enforcement discretion

4 4 ©QPharma 2010 Regulatory History Enforcement Discretion – what did that mean?  Agency has not generally enforced certain Part 11 requirements without other issues  Guidance does not carry the weight of law  Systems and applications still must meet predicate rule requirements  The use of a System or Application Risk Assessment is a good tool to identify and focus on key issues associated with compliance to predicate rules.

5 5 ©QPharma 2010 Regulatory History Risk Assessment Basics for Part 11  Determining the Need for a Control  Determining the Type of Control to be Implemented  Factors for Consideration  Impact on Product Quality and / or Public Health  Likelihood of Risk Scenario impacting product or status reporting or release data  Identify any Mitigating Factors – extra testing or procedural controls

6 6 ©QPharma 2010 Regulatory History The Future  Revision to Part 11 eventually  But hasn’t been a priority  Current Part 11 regulations continue to be enforceable  Enforcement likely to reflect current thinking from latest guidance  New Inspectional Guidance Process  To assess compliance in Industry  Post Inspections, expect Part 11 to be revisited

7 7 ©QPharma 2010 Why is Part 11 necessary? Paper Records / Handwritten Sigs E-Records / E-Signatures (+) Fixed Representation (+) Durable (+) Changes Very Evident (+) Copies Evident (+) Signatures Hard to Forge (-) Need Storage Space (-) Inefficiency of Search / Sharing (+) Global Sharing (+) Rapid Analysis and Search (+) Efficient Review and Approval (-) Changes / Copies Not Evident (-) Selective Data Views (-) Higher Possibility of Data Loss (-) Easy to Forge Signatures Regulation Applicability

8 8 ©QPharma 2010 Regulation Applicability Electronic records used to meet record keeping requirements of FDA regulations  Example Predicate Requirements:  § – “Batch production and control records shall be prepared for each batch of drug product…”  §820.30(j) – “Design history file. Each manufacturer shall establish and maintain a DHF for each type of device.”

9 9 ©QPharma 2010 Regulation Applicability Building Management Systems (BMS) Calibration Management Systems (CMS) Maintenance Management Systems (MMS) Manufacturing Execution Systems (MES) Enterprise Resource Planning (ERP) Distributed Control Systems (DCS) SCADA and PLC Systems Chromatography Data Acquisition Systems Environmental Monitoring Systems (EMS) Lab Information Management Systems (LIMS) Stability Systems DM & PK Systems Case Report Form Systems Clinical Data Management Systems Statistical Analysis Software (e.g., SAS) Adverse Event Reporting Systems (AERS) Training Record Systems Electronic Submission Systems Sales Force Automation Systems (SFA) Standard Operating Procedure Systems Document Management Systems (DMS)

10 10 ©QPharma 2010 Regulation Applicability Paper vs. Electronic Records  Previous Interpretation  Regulated data written in non-temporary form to tangible media is an electronic record with Part 11 impact  True even if records were printed and paper was called the “official” copy  2003 Guidance  Electronic records are exempt from Part 11 if only paper versions of the electronic records are used for regulated activities

11 11 ©QPharma 2010 Regulation Applicability Paper vs. Electronic Records  Key Points for Exemption  Still responsible for ensuring data integrity from creation to printing  Once hardcopy is generated, electronic records cannot be used for any regulated purpose – even as a backup in case paper is lost  Decision to use paper (or electronic records) should be documented  Should have procedures and training indicating electronic records not to be used after printing  Preferable to purge electronic records after printing

12 12 ©QPharma 2010 Legacy Systems  Previous Interpretation  No grandfathering of systems  Even if a system was in place before Part 11 was legally enforceable, Part 11 still applies effective August 20, 1997  2003 Guidance  Enforcement discretion for legacy systems  Part 11 will not be enforced for systems that were in production prior to August 20, 1997 Regulation Applicability

13 13 ©QPharma 2010 Legacy Systems  Key Points for Legacy Exemption  System must have met all predicate rule requirements prior to August 20, 1997  The system currently meets all predicate rule requirements  Documented evidence and justification exists that the system meets its intended use (i.e., validation)  No changes have been made to the system that prevent the system from meeting predicate rule requirements Regulation Applicability

14 14 ©QPharma 2010 Electronic Signatures  Previous Interpretation  Part 11 applies to all electronic signatures used to meet the signature requirements of predicate rules and an organization’s internal procedures  2003 Guidance  Part 11 does not apply to signatures required by internal procedures if there is no corresponding predicate rule requirement Regulation Applicability

15 15 ©QPharma 2010 Signatures  Types  Handwritten  Biometric  Non-biometric  Example Predicate Requirement  § (a) – “To ensure uniformity from batch to batch, master production and control records for each drug product, including each batch size thereof, shall be prepared, dated, and signed…” Regulation Applicability

16 16 ©QPharma 2010 Hybrid Systems  Combination of Electronic and Hardcopy Components  Maintain data electronically – print and sign a hardcopy  Raw data maintained electronically – derived data printed (and possibly signed) Regulation Applicability

17 17 ©QPharma 2010 Which Sections of the Regulation Apply? Regulation Applicability

18 18 ©QPharma 2010 §11.10(a) – Validation  Previous Interpretation  If Part 11 applies to a system, it must be validated  2003 Guidance  Enforcement discretion for this requirement  The need for validation is determined by predicate rule requirements and documented risk assessment  Even if no predicate requirement, may still be important to validate to determine if system meets its intended use E-Record Requirements

19 19 ©QPharma 2010 §11.10(a) – Validation  FDA Cited Validation References  General Principles of Software Validation; Final Guidance for Industry and FDA Staff  GAMP 4 or 5 Guide for Validation of Automated Systems  Example Predicate Requirement:  §820.70(i) – “Automated processes. When computers or automated data processing systems are used as part of production or the quality system, the manufacturer shall validate computer software for its intended use according to an established protocol. All software changes shall be validated before approval and issuance. These validation activities and results shall be documented.” E-Record Requirements

20 20 ©QPharma 2010 §11.10(b) – Copies of Records  Previous Interpretation  It must be possible to provide complete and accurate copies of all electronic records and associated metadata to FDA in both hardcopy and electronic format  Converted formats must have same search, sort and trend operations as original records  2003 Guidance  Enforcement discretion - Agency investigators must be afforded reasonable and useful access to records in accordance with predicate rules  Preserve content and meaning E-Record Requirements

21 21 ©QPharma 2010 §11.10(b) – Copies of Records  Example Predicate Requirement:  § – “All records required by this part shall be maintained at the manufacturing establishment or other location that is reasonably accessible to responsible officials of the manufacturer and to employees of FDA designated to perform inspections. Such records, including those not stored at the inspected establishment, shall be made readily available for review and copying by FDA employee(s). Such records shall be legible and shall be stored to minimize deterioration and to prevent loss. Those records stored in automated data processing systems shall be backed up.” E-Record Requirements

22 22 ©QPharma 2010 §11.10(c) – Record Retention  Previous Interpretation  Electronic records must be protected such that accurate copies could be readily provided throughout retention period  If created electronically, records must be maintained electronically  Archived records must have same search, sort and trend operations as original records E-Record Requirements

23 23 ©QPharma 2010 §11.10(c) – Record Retention  2003 Guidance  Enforcement discretion for this requirement  Records must be retained in accordance with predicate rules  Retained records must preserve content and meaning of the original records  Records may be archived to non-electronic format such as paper, microfilm, or microfiche E-Record Requirements

24 24 ©QPharma 2010 §11.10(c) – Record Retention  Example Predicate Requirements:  § (a) – “Any production, control, or distribution record that is required to be maintained in compliance with this part and is specifically associated with a batch of a drug product shall be retained for at least 1 year after the expiration date of the batch or, in the case of certain OTC drug products lacking expiration dating because they meet the criteria for exemption under , 3 years after distribution of the batch.”  § – “Such records shall be legible and shall be stored to minimize deterioration and to prevent loss.” E-Record Requirements

25 25 ©QPharma 2010 §11.10(d) – Security  Limit access to authorized individuals  Physical security  Logical security  Backend file / database access E-Record Requirements

26 26 ©QPharma 2010 §11.10(e) – Audit Trail  Previous Interpretation  A secure, computer generated, time-stamped audit trail is required for all operator actions that create, modify or delete e-records  Audit trail must retain a full history of changes made to the record  2003 Guidance  Enforcement discretion for this requirement  Need for audit trail and the form it takes is determined by predicate rule requirements and documented risk assessment  Even if no predicate requirement, may still be important to have audit trail to ensure trustworthiness and reliability of records E-Record Requirements

27 27 ©QPharma 2010 §11.10(e) – Audit Trail  Example Predicate Requirement: §58.130(e) – “Any change in entries shall be made so as not to obscure the original entry, shall indicate the reason for such change, and shall be dated and signed or identified at the time of the change..” E-Record Requirements

28 28 ©QPharma 2010 §11.10(f) – Operational System Checks  System enforces logical sequencing of events (where applicable) §11.10(g) – Authorization Checks  Access to functionality limited to user role §11.10(h) –Device Checks  Ensure sources of data input are properly identified and verified (where applicable) E-Record Requirements

29 29 ©QPharma 2010 §11.10(i) – Training  System developers, administrators and users must be properly trained §11.10(j) – Accountability  Accountability policies for user actions in the system §11.10(k) – Documentation Controls  Control over distribution, access and use of system docs  Revisioning procedures for system documentation E-Record Requirements

30 30 ©QPharma 2010 Open vs. Closed Systems  Closed System  The access to the data in the system stay within owner’s control  Open System  The system access is not controlled by persons who are responsible for the data §11.30 – Open System Controls  Additional controls to ensure authenticity, integrity, and confidentiality of records  Encryption  Digital signatures E-Record Requirements

31 31 ©QPharma 2010 §11.50 – Signature Manifestation  Signature information associated with record must appear in all human readable forms  Printed name of signer  Date and time of signing  Meaning of the signature §11.70 – Signature Linkage  Signature must be securely linked to electronic records such that the signature cannot be excised, copied, or transferred by ordinary means  Includes handwritten signatures executed to electronic records E-Signature Requirements

32 32 ©QPharma 2010 § – General Requirements  (a) Signature must be unique to one individual  (b) Identity verification required prior to electronic signature access and release  (c) Certify use of electronic signatures to FDA E-Signature Requirements

33 33 ©QPharma 2010 § – Electronic Signatures Components and Controls  (a)(1) Non-biometric signatures must employ at least two distinct components  (a)(1)(i) Must enter all components during first signing of continuous session – must enter one private component on subsequent signings  (a)(1)(ii) Must enter all components during non- continuous session  System inactivity lock out E-Signature Requirements

34 34 ©QPharma 2010 § – Electronic Signature Components and Controls  (a)(2) E-sigs may only be used by genuine owner  (a)(3) Collaboration would be necessary for non-owner to use signature  System admin cannot view passwords  (b) Biometrics can only be used by genuine owners  Resolution of scan to avoid false positives E-Signature Requirements

35 35 ©QPharma 2010 § – Controls for ID Codes / Passwords  (a) ID Code / Password combo must be unique  (b) Password aging is required  (c) Loss management for devices  (d) Transaction safeguards  Lock out after N failed attempts  Immediate (reasonable) notification to security  (e) Device testing E-Signature Requirements

36 36 ©QPharma 2010 FDA New Part 11Initiative The FDA’s Next Step –Presented at ISPE Washington conference By: Center for Drug Evaluation and Research (CDER) Agency to re-examine 21 CFR Part 11 as currently implemented in industry Company Drug inspectional assignments will include a Part 11 Requirements component Compare requirements in Part 11 Scope & Application guidance published in August of 2003 with actual implemented systems.

37 37 ©QPharma 2010 FDA New Part 11Initiative Purpose of Inspections: –To evaluate industry’s compliance and current understanding of Part 11 –In light of the enforcement discretion described in the 2003 Scope of Application Guidance Inspectional Note: –CDER intends to take appropriate enforcement action to Part 11 requirements for serious predicate rule issues raised during the inspections

38 38 ©QPharma 2010 FDA New Part 11Initiative In Summary –The FDA will evaluate industry compliance with Part 11 Regulation –Inspections performed in light of the enforcement discretion described in the scope of application guidance – issued August 2003 –CDER intends to take appropriate action to enforce Part 11 requirements for issues raised during inspections. –FDA may use the inspectional findings as a part of the re- evaluation of the 21 CFR Part 11 Regulation and Guidance documents.

39 39 ©QPharma 2010 Questions

40 Thank you!: Fred Sperry Validation Manager QPharma, Inc. QPharma, Inc. 22 South Street Morristown, NJ (973) x2028 (973) (FAX)

Download ppt "©QPharma 2010 21 CFR Part 11 Regulatory Overview and What’s New with the FDA Presented by: Frederick J. Sperry Validation Manager."

Similar presentations

Ads by Google