Part 11, Electronic Records; Electronic Signatures 4/24/2017 Part 11, Electronic Records; Electronic Signatures John F. Murray Jr. U.S. Food and Drug Administration Center for Devices and Radiological Health John F Murray Jr

What is Part 11? Part 11 is an FDA regulation that imposes certain requirements on manufacturers when they choose to maintain FDA- required records in electronic form Part 11 requirements are intended to help assure the integrity, validity and trustworthiness of electronic records John F Murray Jr

4/24/2017 Why is Part 11 important? For electronic records and submissions to have the same integrity as paper records, they must be developed, maintained, and used under circumstances that make it difficult for them to be inappropriately modified. [Preamble, p. 13464] John F Murray Jr

Paper vs Electronic Records 4/24/2017 Paper vs Electronic Records Paper records/handwritten signatures Old established technology Familiar and well understood Electronic records/electronic signatures New technology Less familiar and less well understood John F Murray Jr

Paper vs Electronic Records 4/24/2017 Paper vs Electronic Records Paper records/handwritten signatures Well established forensic methods for detecting changes and forgeries Handwritten signatures considered binding Electronic records/electronic signatures Forensic methods for detecting changes are neither familiar nor widely understood Many do not perceive E-signatures as binding John F Murray Jr

History of Part 11 Went into effect on 20 August 1997 Industry consistently expressed concerns that some interpretations of part 11 would: Unnecessarily restrict use of electronic technology Significantly increase costs of compliance Discourage innovation and technological advances More . . . John F Murray Jr

History of Part 11 In February 2003 FDA withdrew Part 11 draft guidance on: Electronic copies of electronic records Validation Glossary of terms Time stamps Maintenance of electronic records Compliance Policy Guide 7153.17 More . . . John F Murray Jr

History of Part 11 FDA issued new draft guidance on 25 February 2003 FDA is re-examining Part 11 and anticipates rulemaking to revise provisions FDA is issuing new guidance describing how we intend to exercise enforcement discretion for certain Part 11 requirements while we re-examine Part 11 John F Murray Jr

What does “exercise enforcement discretion” mean? It means FDA does not intend to take enforcement action to enforce compliance with certain requirements - usually under certain specified conditions For foreign manufacturers enforcement action means sending a Warning Letter or sending a Warning Letter AND preventing products from entering the U.S. John F Murray Jr

New FDA Approach to Part 11 Fewer records will be considered subject to Part 11 FDA will exercise enforcement discretion in regard to certain Part 11 requirements FDA will continue to enforce all predicate rule requirements, including requirements for records and recordkeeping John F Murray Jr

What is a predicate rule? For purposes of Part 11, a predicate rule is any FDA rule, regulation or law that requires manufacturers to maintain records The predicate rule identifies what records must be maintained and for how long Part 11 addresses how electronic records must be maintained John F Murray Jr

Scope of Part 11 21 CFR § 11.1 John F Murray Jr

What records will be subject to Part 11 requirements? Part 11 will apply when electronic records are used in place of paper records Part 11 will NOT apply when: Computers are used to generate paper printouts of electronic records; These paper records meet all predicate rule requirements; and Persons rely on paper records to perform regulated activities John F Murray Jr

What should I do? Determine which electronic records you maintain in place of paper records to meet predicate rule requirements and which electronic records are NOT required by predicate rules Those records not required by a predicate rule are not covered by Part 11 Document your decisions John F Murray Jr

What if I use the electronic records? If you use an electronic record to perform regulated activities, Part 11 applies, even if you generate a paper printout Determine in advance whether you will use the electronic record or the paper record to perform regulated activities Document your decision in a Standard Operating Procedure or specification John F Murray Jr

What about electronic records I submit to FDA? Part 11applies to electronic records submitted to FDA under a predicate rule, even if such records are not specifically identified in FDA regulations Part 11 does not apply to records that are not submitted to FDA but are used in generating a submission – unless a predicate rule requires such records to be maintained John F Murray Jr

What about electronic signatures? Part 11 applies to electronic signatures that are: Intended to be the equivalent of handwritten signatures, initials, or other signings required by predicate rules Used to document the fact that certain events or actions occurred in accordance with the predicate rule (e.g. approved, reviewed, verified) John F Murray Jr

Validation and Related Requirements 21 CFR § 11. 10(a), § 11 Validation and Related Requirements 21 CFR § 11.10(a), § 11.30 & 21 CFR § 820.70(i) John F Murray Jr

Must I validate my electronic recordkeeping and signature system? FDA intends to exercise enforcement discretion for Part 11 validation requirements However, the Quality System Regulation requires computerized systems to be validated [21 CFR 820.70(i)] New FDA Part 11 guidance does not impose any additional validation requirements John F Murray Jr

Why is validation important? Your computerized systems can have an impact on: Your ability to meet predicate rule requirements The accuracy, reliability, integrity, availability and authenticity of required records and signatures John F Murray Jr

Do you have additional advice? Base your approach to validation on: A justified and documented risk assessment A determination of the potential of the system to affect product quality and safety and record integrity John F Murray Jr

What guidance is available for software validation? General Principles of Software Validation: http://www.fda.gov/cdrh/comp/guidance/938.pdf http://www.fda.gov/cdrh/comp/guidance/938.html Good Automated Manufacturing Practice Guide for Validation of Automated Systems, GAMP 4: http://www.ispe.org/gamp/ John F Murray Jr

Audit Trail and Related Requirements 21 CFR § 11. 10(e), 11 Audit Trail and Related Requirements 21 CFR § 11.10(e), 11.10(k)(2) and 11.30 John F Murray Jr

What is an audit trail? An audit trail: Is secure and computer generated and associated with a specific record Records who creates, modifies or deletes an electronic record Records when the record was created, modified or deleted Changes made to records should not obscure previously recorded information John F Murray Jr

Must all electronic records have an audit trail? FDA will exercise enforcement discretion in regard to audit trail requirements Persons must comply with all predicate rule requirements related to: Date, time or sequencing of events Ensuring that changes to records do not obscure previous entries More . . . John F Murray Jr

Should all electronic records have an audit trail? Even in the absence of predicate rule requirements to document date, time or sequence of events, an audit trail will help ensure the trustworthiness and reliability of records Audit trails are especially appropriate when users are expected to create, modify or delete regulated records during normal operations John F Murray Jr

How can I decide whether records should have audit trails? Base your decision on: The need to comply with predicate rule requirements A justified and documented risk assessment A determination of the potential effect of lack of record integrity on product quality and safety and record integrity John F Murray Jr

Legacy Systems John F Murray Jr

What is a legacy system? For purposes of Part 11, a legacy system is a computerized recordkeeping system that was in operation before Part 11 went into effect on 20 August 1997 John F Murray Jr

Must legacy systems comply with Part 11? FDA intends to exercise enforcement discretion with respect to all Part 11 requirement for legacy systems if the certain criteria are met for a specific system John F Murray Jr

What are the criteria for legacy systems? Operational before 20 August 1997 Met all applicable predicate rule requirements before 20 August 1997 Currently meets all applicable predicate rule requirements Documented evidence shows system is fit for intended use and has an acceptable level of record security and integrity John F Murray Jr

What if I made changes to my legacy system since 20 August 1997? If the changes introduce risks to record security and integrity, apply Part 11 controls to records and signatures using this guidance John F Murray Jr

Copies of Records 21 CFR § 11.10(b) and § 11.30 John F Murray Jr

Must I provide electronic copies of records to FDA investigators? FDA intends to exercise enforcement discretion with regard to generating copies of records You should provide an FDA investigator with reasonable and useful access to records during an inspection All records held by you are subject to inspection according to predicate rules More . . . John F Murray Jr

Must I provide electronic copies of records to FDA investigators? FDA recommends that you supply copies of electronic records by: Producing copies of records in common portable formats when records are maintained in these formats Using established automated conversion or export methods where available to make copies in a more common format (copies to PDF, XML or SGML for example) John F Murray Jr

Does FDA have other requirements for electronic copies? The copying process used should produce copies that preserve the content and meaning of the record If you have the ability to search, sort or trend records, copies given to FDA should preserve the same capability if reasonable and technically feasible John F Murray Jr

Must I allow the FDA investigator to look at my electronic records? You should allow inspection, review and copying of records in a human readable form at your site using your hardware and following your established procedures and techniques for accessing records John F Murray Jr

Record Retention 21 CFR § 11.10(c) and §11.30 John F Murray Jr

Will FDA enforce record retention requirements in Part 11? FDA intends to exercise enforcement discretion with regard to Part 11 requirements for protection of records to enable their accurate and ready retrieval throughout the record retention period John F Murray Jr

What should I consider when deciding how to archive records? How you maintain your records should be based on: Predicate rule requirements A justified and documented risk assessment A determination of the value of records over time John F Murray Jr

How may I archive electronic records? You may archive electronic records to nonelectronic media such as: Microfilm Microfiches Paper Standard electronic file format such as PDF, XML or SGML John F Murray Jr

May I delete electronic records after they have been archived? You may delete the original electronic records after archiving them if: You comply with all predicate rule requirements The archived copies preserve the content and meaning of the original records John F Murray Jr

Can I use a combination of paper and electronic records? Paper and electronic record and signature components can co-exist if: Predicate rule requirements are met The content and meaning of records are preserved John F Murray Jr

Are there any Part 11 requirements not affected by this guidance? Yes. FDA intends to enforce provisions relating to the following controls and requirements: Limiting system access to authorized individuals Use of operational system checks Use of authority checks Use of device checks More . . . John F Murray Jr

Are there any Part 11 requirements not affected by this guidance? Yes. FDA intends to enforce provisions relating to the following controls and requirements: Determination that persons who develop, maintain or use electronic systems have the education, training and experience to perform their assigned tasks More . . . John F Murray Jr

Are there any Part 11 requirements not affected by this guidance? Yes. FDA intends to enforce provisions relating to the following controls and requirements: Establishment of and adherence to written policies that hold individuals accountable for actions initiated under their electronic signatures More . . . John F Murray Jr

Are there any Part 11 requirements not affected by this guidance? Yes. FDA intends to enforce provisions relating to the following controls and requirements: Appropriate controls over systems documentation Controls for open systems corresponding to controls for closed systems bulleted above More . . . John F Murray Jr

Are there any Part 11 requirements not affected by this guidance? Yes. FDA intends to enforce provisions relating to the following controls and requirements: Requirements related to electronic signatures (§§ 11.50, 11.70, 11.100, 11.200 and 11.300) John F Murray Jr

What if I have questions about Part 11 in the future? Contact: Mr. John Murray Office of Compliance E-mail: jfm@cdrh.fda.gov Ms. Christine Nelson Office of Health and Industry Programs Division of Small Manufacturers, International and Consumer Assistance E-mail: mcn@cdrh.fda.gov John F Murray Jr