It happens at least a few times a year as I interface with pharma/bio/med tech clients. We start talking about computerized system use or data integrity of records, and I invariably hear some version of:
“Our electronic data is printed out and stored as ‘original data’ so there is no computerized systems data integrity issue.”
And honestly, even though I know this is patently untrue, I can understand how we all got here. The Pharmaceutical Industry originally asked FDA for guidelines around the use of computer systems to eliminate paper records in the early 1990s – back when some of us were still saving data to floppy disks. A task force was convened, and the final rule for 21 CFR Part 11 was published in 1997.
The Purpose of 21 CFR Part 11
21 CFR Part 11 Electronic Records, Electronic Signatures (Part 11) applied to all FDA program areas and stated that the use of electronic records was not mandatory. Just that comment alone created widespread confusion.
In 1999, a Compliance Policy Guide (CPG) and five guidance documents were drafted to try to help clear the confusion, however, the consensus was that the CPG and associated guidance documents significantly increased the cost of using technology, thereby discouraging technological innovation, and restricting the use of technology. Basically, having the complete opposite impact that was hoped.
Then in 2003, the FDA revoked the CPG and the five guidance documents. It was replaced by the Guidance Document on the Scope and Application of Part 11 (released September 3, 2003). It was widely known that there would purposely be a narrower interpretation of which records would be subjected to the full authority of Part 11.
The guidance document specifically states when records that must be maintained under predicate rules (like 21 CFR 211 or 21 CFR 820) or submitted to FDA are maintained in electronic format, Part 11 applies.
The Importance of 21 CFR Part 11 Electronic Records, Electronic Signatures Validation
On the other hand, when computers are used in the generation of a permanent paper record, Part 11 does not apply. This is also known as the 'typewriter clause' because just as a typewriter would not be subject to inspection, the computer that generated a document will not be inspected if the document itself is a true and official record.
In addition, it was understood that systems in which records existed in electronic form as well as in traditional paper format may or may not be subject to Part 11. If you use the electronic portion of the system for any GxP function, then the electronic system would fall under Part 11 jurisdiction. However, if you are keeping records in both formats, but use the paper form as the sole means for making any regulated decisions, then Part 11 does not apply.
And I am finding it is commonly believed that if you have electronic system assessments that are fully documenting these decisions, then it can be shown that the implications were thought through proactively, and therefore the system is protected from regulatory scrutiny.
However, the understanding and application of the treatment of electronic data have changed, especially in the past several years. Through 483 observational and Warning Letter trends, the implementation of the Part 11 rules and its relation to the integrity of data has become more consistent.
With the release of the Data Integrity and Compliance with Drug CGMP, Guidance for Industry (December 2018), the regulatory framework for the treatment of electronic data in relation to the ability to fully comply with 21 CFR 211 has been clearly stated.
The Final Word on Data Integrity Compliance
So, simplistically, if you print the electronic data and store it as a paper record, that’s nice. But it’s not the original record. The original record is electronic data held within the computerized system.
The good news is that the most recent computer operating systems have features which easily enable Part 11 data integrity compliance. However, as with most things in life, it’s not that easy. These features are not automatic, and data integrity practices do need to be deliberately implemented.
This article was contributed by our expert Jackie Torfin.
Frequently Asked Questions Answered By Jackie Torfin
Q1. What does 21 CFR Part 11 apply to, and who must comply?
21 CFR Part 11 applies to any electronic records required by or used to show compliance to regulations under the Food Drug and Cosmetic Act (FD&C Act) or the Public Health Service Act (PHS Act). So any records are created for human or animal drugs, vaccines, medical devices, food, cosmetics, and tobacco.
Q2. What is the purpose of 21 CFR Part 11?
It defines the criteria under which electronic records and electronic signatures are considered trustworthy, reliable, and equivalent to paper records.
Q3. How do you become 21 CFR Part 11 compliant?
You become compliant by following the 21 CFR Part 11 regulation and incorporating the rules into your business, electronic and quality systems. Activities like computerized system validation prove that the records are trustworthy and reliable by demonstrating things like data audit trails and the inability of data to be deleted or corrupted. Like all regulations under FDA, you are presumed compliant until proven otherwise through inspection or surveillance activities.
Q4. What makes a computerized system 21 CFR Part 11 compliant?
This is a BIG question. There is specific testing and validation that is done to show that a computerized system meets all of the requirements that are defined.
Q5. What is the main difference between Annex 11 and 21 CFR Part 11?
Annex 11 is the Europe equivalent to 21 CFR Part 11. Annex 11 technically only applies to pharmaceutical products. 21 CFR Part 11 is required by regulation. However, Annex 11 is only a strongly suggested guideline.
