21 CFR 11 Overview of the Final Document and its New Scope
Ludwig Huber

This article provides an overview of Rule 21 CFR Part 11's key requirements and its new, narrower scope.
Jun 01, 2005
Volume 205 Supplement, Issue 3

In 1997, the US Food and Drug Administration issued a regulation"Rule 21 CFR Part 11," that provides criteria for the acceptance of electronic records, electronic signatures, and handwritten signatures (1). FDA issued the guidance in response to requests from the industry. With this regulation, electronic records can be equivalent to paper records and handwritten signatures. The rule applies to all industry segments regulated by FDA that include good laboratory practice, good clinical practice, and current good manufacturing practice.

It is anticipated that electronic records will be more cost effective for the industry and FDA. In addition, the industry expects the drug approval process will be shorter and access to documentation will be faster and more productive. The Part 11 rule requires:

  • that companies only use validated computerized systems;
  • secure retention of electronic records and instant retrieval;
  • user-independent, computer-generated, time-stamped audit trails;
  • system and data security, data integrity, and confidentiality through limited, authorized access to systems and records;
  • secure electronic signatures for closed and open systems;
  • digital signatures for open systems;
  • operational checks;
  • device checks;
  • the determination that individuals who develop, maintain, or use electronic systems have the education, training, and experience to perform their assigned tasks.

This article provides an overview of the rule's key requirements and discusses FDA's new approach and narrower scope of Part 11. Although it presents the current interpretations of the rule and its enforcement, it is important to note that such discussions are ongoing. Frequently updated information is available at http://www.fda.gov/ and http://www.labcompliance.com/e-signatures/. Additional information also is presented elsewhere (2).

Key requirements and concerns

System validation. "All computer systems used to generate, maintain, and archive electronic records must be validated to ensure accuracy, reliability, consistent independent performance, and the ability to discern invalid or altered records." (Par. 11.10 [a])

This condition applies to new and existing systems, but is not new for operations using computers in a regulated environment. Most companies have developed strategies for implementing computer system validation.

Nonetheless, older systems can be problematic because they require a formal evaluation and a statement about their validation status (3, 4). The extent of validation depends on the system's complexity and its effect on product quality and data integrity. Under 21 CFR Part 11, older systems that cannot be validated should not be used.

Secure retention of electronic records to instantly reconstruct the analysis. "Procedures should be in place to generate accurate and complete copies of records in both human readable and electronic form suitable for inspection, review, and copying by the agency. Records must be protected to enable their accurate and ready retrieval throughout the records retention period." (Par. 11.10 [b], Par. 11.10 [c])

The agency should be able to trace final results back to the raw data using the same tools the company used when those data were generated. This task is probably one of the most difficult for which to implement requirements. In some instances, records must be kept for ten years or more. Because computer hardware and software have a much shorter lifetime, one can anticipate problems complying with this paragraph.

Under the original interpretation of Part 11, each record had to meet this requirement. In addition, records had to be retained in their original form for the full retention period, as required by the predicate rule. This interpretation has changed with FDA's new scope, however.

lorem ipsum