The US Food and Drug Administration (FDA) specifies the regulations for electronic records and signatures in 21 CFR Part 11. This guide applies to FDA-regulated industries, such as biotechnology, pharmaceutical, contract research, and medical device industries. Part 11 advises on how to handle electronic records and signatures and explains why they are equivalent to paper records. Furthermore, an organization that uses a computer system to create, maintain, or modify records needs to define the predicate rules and control their records according to the rules. Examples of predicate rules are as follows:
Controls should be implemented, such as internal audits, audit trails, system validations, electronic signature protocols, and software documentation. Additionally, an organization that uses e-signatures should comply with requirements. The objective of Part 11 is to maintain traceability and accountability of electronic records, including e-signatures. Here are some requirements:
- Are controls used to ensure that only authorized personnel can access the system, electronically sign a record, change a record, and perform an operation?
- Does a signed electronic record contain the following?
- The name of the signer
- The date and time of the signature
- The meaning of the signature, such as review, approval, responsibility, etc.
- Is system access restricted to authorized personnel?
- Can the system create, maintain, and store audit trails?
- Can the system deliver transaction protection to control/prevent unauthorized use of passwords and/or identification codes?
- Can the system instantly detect unauthorized attempts and report them to the system security unit and organizational management?
Electronic records
Part 11 defines electronic records as “any combination of text, graphics, data, audio, pictorial, or other information representation in digital form that is created, modified, maintained, archived, retrieved, or distributed by a computer system.” According to the FDA, any information that is generated and stored within an electronic system must comply with requirements. Electronic records should be stored remotely or on a local hard drive. Furthermore, since you can print electronic records, treat them like paper records.
Electronic signatures
Part 11 defines the electronic signature as “a computer data compilation of any symbol or series of symbols executed, adopted, or authorized by an individual to be the legally binding equivalent of the individual’s handwritten signature.” Part 11 includes requirements to guarantee that electronic signatures are legally equivalent to handwritten signatures.
Electronic records management
To handle electronic records properly and safely, you need to implement an electronic records management system. The system should have the following qualities:
- Protection: Records and information that are private, confidential, privileged, secret, and classified must be protected to a reasonable level. Furthermore, protection should include recovery and continuous planning, such as backups, off-site storage, etc.
- Integrity: It is important for an organization to be able to verify and ensure the authenticity of its electronic records.
- Compliance: To comply with FDA regulations, life science companies should have a records management department. Records management departments should have their own policies, laws, and regulations.
- Retention: There must be a clear policy for electronic records retention, and it should be supported by validated tools and technologies. Part 11 does not ask organizations to keep electronic records forever. Organizations should determine retention time by considering each record’s legal, regulatory, fiscal, operational, and archival characteristics.
