Part 11, Electronic Records; Electronic Signatures

1. Part 11, Electronic Records; Electronic Signatures John F. Murray Jr. U.S. Food and Drug Administration Center for Devices and Radiological Health John F Murray Jr

2. What is Part 11? • Part 11 is an FDA regulation that imposes certain requirements on manufacturers when they choose to maintain FDA-required records in electronic form • Part 11 requirements are intended to help assure the integrity, validity and trustworthiness of electronic records John F Murray Jr

3. Why is Part 11 important? For electronic records and submissions to have the same integrity as paper records, they must be developed, maintained, and used under circumstances that make it difficult for them to be inappropriately modified. [Preamble, p. 13464] John F Murray Jr

4. Paper vs Electronic Records • Paper records/handwritten signatures • Old established technology • Familiar and well understood • Electronic records/electronic signatures • New technology • Less familiar and less well understood John F Murray Jr

5. Paper vs Electronic Records • Paper records/handwritten signatures • Well established forensic methods for detecting changes and forgeries • Handwritten signatures considered binding • Electronic records/electronic signatures • Forensic methods for detecting changes are neither familiar nor widely understood • Many do not perceive E-signatures as binding John F Murray Jr

6. History of Part 11 • Went into effect on 20 August 1997 • Industry consistently expressed concerns that some interpretations of part 11 would: • Unnecessarily restrict use of electronic technology • Significantly increase costs of compliance • Discourage innovation and technological advances More . . . John F Murray Jr

7. History of Part 11 • In February 2003 FDA withdrew Part 11 draft guidance on: • Electronic copies of electronic records • Validation • Glossary of terms • Time stamps • Maintenance of electronic records • Compliance Policy Guide 7153.17 More . . . John F Murray Jr

8. History of Part 11 • FDA issued new draft guidance on 25 February 2003 • FDA is re-examining Part 11 and anticipates rulemaking to revise provisions • FDA is issuing new guidance describing how we intend to exercise enforcement discretion for certain Part 11 requirements while we re-examine Part 11 John F Murray Jr

9. What does “exercise enforcement discretion” mean? • It means FDA does not intend to take enforcement action to enforce compliance with certain requirements - usually under certain specified conditions • For foreign manufacturers enforcement action means sending a Warning Letter or sending a Warning Letter AND preventing products from entering the U.S. John F Murray Jr

10. New FDA Approach to Part 11 • Fewer records will be considered subject to Part 11 • FDA will exercise enforcement discretion in regard to certain Part 11 requirements • FDA will continue to enforce all predicate rule requirements, including requirements for records and recordkeeping John F Murray Jr

11. What is a predicate rule? • For purposes of Part 11, a predicate rule is any FDA rule, regulation or law that requires manufacturers to maintain records • The predicate rule identifies what records must be maintained and for how long • Part 11 addresses how electronic records must be maintained John F Murray Jr

12. Scope of Part 1121 CFR § 11.1 John F Murray Jr

13. What records will be subject to Part 11 requirements? • Part 11 will apply when electronic records are used in place of paper records • Part 11 will NOT apply when: • Computers are used to generate paper printouts of electronic records; • These paper records meet all predicate rule requirements; and • Persons rely on paper records to perform regulated activities John F Murray Jr

14. What should I do? • Determine which electronic records you maintain in place of paper records to meet predicate rule requirements and which electronic records are NOT required by predicate rules • Those records not required by a predicate rule are not covered by Part 11 • Document your decisions John F Murray Jr

15. What if I use the electronic records? • If you use an electronic record to perform regulated activities, Part 11 applies, even if you generate a paper printout • Determine in advance whether you will use the electronic record or the paper record to perform regulated activities • Document your decision in a Standard Operating Procedure or specification John F Murray Jr

16. What about electronic records I submit to FDA? • Part 11applies to electronic records submitted to FDA under a predicate rule, even if such records are not specifically identified in FDA regulations • Part 11 does not apply to records that are not submitted to FDA but are used in generating a submission – unless a predicate rule requires such records to be maintained John F Murray Jr

17. What about electronic signatures? • Part 11 applies to electronic signatures that are: • Intended to be the equivalent of handwritten signatures, initials, or other signings required by predicate rules • Used to document the fact that certain events or actions occurred in accordance with the predicate rule (e.g. approved, reviewed, verified) John F Murray Jr

18. Validation and Related Requirements21 CFR § 11.10(a), § 11.30 & 21 CFR § 820.70(i) John F Murray Jr

19. Must I validate my electronic recordkeeping and signature system? • FDA intends to exercise enforcement discretion for Part 11 validation requirements • However, the Quality System Regulation requires computerized systems to be validated [21 CFR 820.70(i)] • New FDA Part 11 guidance does not impose any additional validation requirements John F Murray Jr

20. Why is validation important? • Your computerized systems can have an impact on: • Your ability to meet predicate rule requirements • The accuracy, reliability, integrity, availability and authenticity of required records and signatures John F Murray Jr

21. Do you have additional advice? • Base your approach to validation on: • A justified and documented risk assessment • A determination of the potential of the system to affect product quality and safety and record integrity John F Murray Jr

22. What guidance is available for software validation? General Principles of Software Validation: • http://www.fda.gov/cdrh/comp/guidance/938.pdf • http://www.fda.gov/cdrh/comp/guidance/938.html Good Automated Manufacturing Practice Guide for Validation of Automated Systems, GAMP 4: • http://www.ispe.org/gamp/ John F Murray Jr

23. Audit Trail and RelatedRequirements21 CFR § 11.10(e), 11.10(k)(2) and 11.30 John F Murray Jr

24. What is an audit trail? • An audit trail: • Is secure and computer generated and associated with a specific record • Records who creates, modifies or deletes an electronic record • Records when the record was created, modified or deleted • Changes made to records should not obscure previously recorded information John F Murray Jr

25. Must all electronic records have an audit trail? • FDA will exercise enforcement discretion in regard to audit trail requirements • Persons must comply with all predicate rule requirements related to: • Date, time or sequencing of events • Ensuring that changes to records do not obscure previous entries More . . . John F Murray Jr

26. Should all electronic records have an audit trail? • Even in the absence of predicate rule requirements to document date, time or sequence of events, an audit trail will help ensure the trustworthiness and reliability of records • Audit trails are especially appropriate when users are expected to create, modify or delete regulated records during normal operations John F Murray Jr

27. How can I decide whether records should have audit trails? • Base your decision on: • The need to comply with predicate rule requirements • A justified and documented risk assessment • A determination of the potential effect of lack of record integrity on product quality and safety and record integrity John F Murray Jr

28. Legacy Systems John F Murray Jr

29. What is a legacy system? • For purposes of Part 11, a legacy system is a computerized recordkeeping system that was in operation before Part 11 went into effect on 20 August 1997 John F Murray Jr

30. Must legacy systems comply with Part 11? • FDA intends to exercise enforcement discretion with respect to all Part 11 requirement for legacy systems if the certain criteria are met for a specific system John F Murray Jr

31. What are the criteria for legacy systems? • Operational before 20 August 1997 • Met all applicable predicate rule requirements before 20 August 1997 • Currently meets all applicable predicate rule requirements • Documented evidence shows system is fit for intended use and has an acceptable level of record security and integrity John F Murray Jr

32. What if I made changes to my legacy system since 20 August 1997? • If the changes introduce risks to record security and integrity, apply Part 11 controls to records and signatures using this guidance John F Murray Jr

33. Copies of Records21 CFR § 11.10(b) and § 11.30 John F Murray Jr

34. Must I provide electronic copies of records to FDA investigators? • FDA intends to exercise enforcement discretion with regard to generating copies of records • You should provide an FDA investigator with reasonable and useful access to records during an inspection • All records held by you are subject to inspection according to predicate rules More . . . John F Murray Jr

35. Must I provide electronic copies of records to FDA investigators? • FDA recommends that you supply copies of electronic records by: • Producing copies of records in common portable formats when records are maintained in these formats • Using established automated conversion or export methods where available to make copies in a more common format (copies to PDF, XML or SGML for example) John F Murray Jr

36. Does FDA have other requirements for electronic copies? • The copying process used should produce copies that preserve the content and meaning of the record • If you have the ability to search, sort or trend records, copies given to FDA should preserve the same capability if reasonable and technically feasible John F Murray Jr

37. Must I allow the FDA investigator to look at my electronic records? • You should allow inspection, review and copying of records in a human readable form at your site using your hardware and following your established procedures and techniques for accessing records John F Murray Jr

38. Record Retention21 CFR § 11.10(c) and §11.30 John F Murray Jr

39. Will FDA enforce record retention requirements in Part 11? • FDA intends to exercise enforcement discretion with regard to Part 11 requirements for protection of records to enable their accurate and ready retrieval throughout the record retention period John F Murray Jr

40. What should I consider when deciding how to archive records? • How you maintain your records should be based on: • Predicate rule requirements • A justified and documented risk assessment • A determination of the value of records over time John F Murray Jr

41. How may I archive electronic records? • You may archive electronic records to nonelectronic media such as: • Microfilm • Microfiches • Paper • Standard electronic file format such as PDF, XML or SGML John F Murray Jr

42. May I delete electronic records after they have been archived? • You may delete the original electronic records after archiving them if: • You comply with all predicate rule requirements • The archived copies preserve the content and meaning of the original records John F Murray Jr

43. Can I use a combination of paper and electronic records? • Paper and electronic record and signature components can co-exist if: • Predicate rule requirements are met • The content and meaning of records are preserved John F Murray Jr

44. Are there any Part 11 requirements not affected by this guidance? • Yes. FDA intends to enforce provisions relating to the following controls and requirements: • Limiting system access to authorized individuals • Use of operational system checks • Use of authority checks • Use of device checks More . . . John F Murray Jr

45. Are there any Part 11 requirements not affected by this guidance? • Yes. FDA intends to enforce provisions relating to the following controls and requirements: • Determination that persons who develop, maintain or use electronic systems have the education, training and experience to perform their assigned tasks More . . . John F Murray Jr

46. Are there any Part 11 requirements not affected by this guidance? • Yes. FDA intends to enforce provisions relating to the following controls and requirements: • Establishment of and adherence to written policies that hold individuals accountable for actions initiated under their electronic signatures More . . . John F Murray Jr

47. Are there any Part 11 requirements not affected by this guidance? • Yes. FDA intends to enforce provisions relating to the following controls and requirements: • Appropriate controls over systems documentation • Controls for open systems corresponding to controls for closed systems bulleted above More . . . John F Murray Jr

48. Are there any Part 11 requirements not affected by this guidance? • Yes. FDA intends to enforce provisions relating to the following controls and requirements: • Requirements related to electronic signatures (§§ 11.50, 11.70, 11.100, 11.200 and 11.300) John F Murray Jr

49. What if I have questions about Part 11 in the future? • Contact: Mr. John Murray Office of Compliance E-mail: jfm@cdrh.fda.gov Ms. Christine Nelson Office of Health and Industry Programs Division of Small Manufacturers, International and Consumer Assistance E-mail: mcn@cdrh.fda.gov John F Murray Jr