21 CFR Part 11:

1
21 CFR - Part 11

• Electronic Records and Electronic Signatures -
• was published March 20, 1997
• went into effect August 20, 1997
• Electronic record keeping systems established
  before the effective date and still in use must
  meet Part 11 requirements.

2
Part 11

• Good News
• Bad News

3
Part 11

• Bad News
• Part 11 is still a Law that is in effect!

4
Part 11

• Good News
• FDA has opted to use Regulatory Discretion
  regarding enforcement of Part 11 on a case by
  case basis.
• Current FDA policy
• www.fda.gov/cder/guidance/5667fnl.doc

5
Part 11 and Predicate Rules

• A predicate rule is any FDA regulation that
  includes a requirement to keep a record.
• Part 11 is always associated with a predicate
  rule.

6
Predicate Rule Part 11

• The predicate rule mandates
• What records must be maintained
• The content of records
• Whether signatures are required
• How long records must be maintained

7
Hybrid Systems

• FDA considers the official version of the
  record to be the electronic version - therefore,
  the electronic system must be Part 11 compliant!

8
Electronic Records/Signature Systems

• Section 11.1(e) -
• Computer systems (including hardware and
  software), controls, and attendant documentation
  maintained under this part shall be readily
  available for, and subject to, FDA inspection.

9
Closed vs. Open System

• Closed system means an environment in which
  system access is controlled by persons who are
  responsible for the content of electronic records
  that are on the system. 21 CFR 11.3(b)(4)

10
Closed vs. Open System

• Open system means an environment in which system
  access is not controlled by persons who are
  responsible for the content of electronic records
  that are on the system. 21 CFR 11.3(b)(9)

11
Electronic Records/Signature Systems

• System must be designed to assure
• authenticity
• integrity
• confidentiality, when appropriate
• System must be validated - for its intended
  use.
• System must have a secure, computer generated,
  time stamped audit trail.

12
Closed vs. Open System

• Additional measures needed for open systems to
  ensure record authenticity, integrity and
  confidentiality of records e.g. document
  encryption

13
What is FDA looking atre Part 11?

• Does the system meet part 11 requirements?
• Has the system been validated?
• Have part 11 administrative requirements been
  met?
• Has certification been submitted for electronic
  signatures?

14
Federal Register NoticeVol. 64, No. 139, July
21, 1999

• Page 39147 - Firms should have a reasonable
  timetable for promptly modifying any systems not
  in compliance (including legacy systems) to make
  them Part 11 compliant, and should be able to
  demonstrate progress in implementing their
  timetable.