In 1997, the US Food and Drug Administration issued a regulation"Rule 21 CFR Part 11," that provides criteria for the acceptance of electronic records, electronic signatures, and handwritten signatures
(1). FDA issued the guidance in response to requests from the industry. With this regulation, electronic records can be equivalent
to paper records and handwritten signatures. The rule applies to all industry segments regulated by FDA that include good
laboratory practice, good clinical practice, and current good manufacturing practice.
It is anticipated that electronic records will be more cost effective for the industry and FDA. In addition, the industry
expects the drug approval process will be shorter and access to documentation will be faster and more productive. The Part
11 rule requires:
- that companies only use validated computerized systems;
- secure retention of electronic records and instant retrieval;
- user-independent, computer-generated, time-stamped audit trails;
- system and data security, data integrity, and confidentiality through limited, authorized access to systems and records;
- secure electronic signatures for closed and open systems;
- digital signatures for open systems;
- operational checks;
- device checks;
- the determination that individuals who develop, maintain, or use electronic systems have the education, training, and experience
to perform their assigned tasks.
This article provides an overview of the rule's key requirements and discusses FDA's new approach and narrower scope of Part
11. Although it presents the current interpretations of the rule and its enforcement, it is important to note that such discussions
are ongoing. Frequently updated information is available at
http://www.labcompliance.com/e-signatures/. Additional information also is presented elsewhere (2).
Key requirements and concerns
"All computer systems used to generate, maintain, and archive electronic records must be validated to ensure accuracy,
reliability, consistent independent performance, and the ability to discern invalid or altered records." (Par. 11.10 [a])
This condition applies to new and existing systems, but is not new for operations using computers in a regulated environment.
Most companies have developed strategies for implementing computer system validation.
Nonetheless, older systems can be problematic because they require a formal evaluation and a statement about their validation
status (3, 4). The extent of validation depends on the system's complexity and its effect on product quality and data integrity.
Under 21 CFR Part 11, older systems that cannot be validated should not be used.
Secure retention of electronic records to instantly reconstruct the analysis.
"Procedures should be in place to generate accurate and complete copies of records in both human readable and electronic
form suitable for inspection, review, and copying by the agency. Records must be protected to enable their accurate and ready
retrieval throughout the records retention period." (Par. 11.10 [b], Par. 11.10 [c])
The agency should be able to trace final results back to the raw data using the same tools the company used when those data
were generated. This task is probably one of the most difficult for which to implement requirements. In some instances, records
must be kept for ten years or more. Because computer hardware and software have a much shorter lifetime, one can anticipate
problems complying with this paragraph.
Under the original interpretation of Part 11, each record had to meet this requirement. In addition, records had to be retained
in their original form for the full retention period, as required by the predicate rule. This interpretation has changed with
FDA's new scope, however.