1. 1 Presented at AAPS 2000 David Judd and Ludwig Huber, Agilent Technologies

2. 2 Content  Requirements, FDA’s enforcement practices and guidelines  Types of data that should be archived and retrieved  Criteria for selecting physical storage media  Three alternative procedures for ‘ready’ retrieval  Summary recommendations

3. 3 21 CFR Part 11 Accurate and Complete Copies Accurate and complete means all raw data, processed data and meta-data 11.10 (b):Procedures and controls shall include the ability to generate accurate and complete copies of records in both human readable and electronic form suitable for inspection, review, and copying by the agency.

4. 4 21 CFR Part 11 Protection and Retrieval of Records 11.10 (c): Procedures and controls shall include: Protection of records to enable their accurate and ready retrieval throughout the records retention period Retention period depends on predicate rule Ready retrieval means processing the data as originally done

5. 5 FDA 483 Observation - complete and accurate copies, protection of records - The firm does not electronically store all integration parameters and chromatograms Backup tapes were never restored and verified, and were stored offsite in an employee’s home.

6. 6 FDA Warning Letter - exact copies - Examples include: No documentation to show if the system has the ability to generate accurate and complete copies of records in electronic form; copies of electronic records cannot be generated at these sites. It is vital for FDA to be able to audit electronic production records by, among other things, reviewing electronic copies of your electronic records. It is therefore a serious matter if your system cannot generate such on-site electronic copies.

7. 7 Why is it so difficult? Records must be available in electronic form. Paper print-outs are no substitute for an electronic record Records must be stored as complete and accurate copies. A complete copy includes meta-data Records must be ‘readily’ retrieved throughout the entire retention period Retention period as determined by the predicate rule may be up to 10 or more years

8. 8 FDA Guidelines “FDA expects to be able to reconstruct a study. This applies not only to the data, but also how the data were obtained or managed. Therefore, all versions of application software, operating systems, and software development tools involved in processing of data or records should be available as long as data or records associated with these versions are required to be retained” US FDA, Guidance for industry: Computerized Systems Used in Clinical Trials, May 1999

9. 9 FDA Guidelines “Sponsors may retain these (old computer systems) themselves or may contract for the vendors to retain the ability to run (but not necessarily support) the software. Although FDA expects sponsors or vendors to retain the ability to run older versions of software, the agency acknowledges that, in some cases, it will be difficult for sponsors and vendors to run older computerized systems” US FDA, Guidance for industry: Computerized Systems Used in Clinical Trials, May 1999

10. 10 FDA Guidelines "Recognizing that computer products may be discontinued or supplanted by newer (possibly incompatible) systems, it is nonetheless vital that sponsors retain the ability to retrieve and review the data recorded by the older systems. This may be achieved by maintaining support for the older systems or transcribing data to the newer systems". US FDA, Guidance for industry: Computerized systems used in clinical trials, May 1999

11. 11 FDA Guidelines The agency notes that … persons would not necessarily have to retain supplanted hardware and software systems provided they implemented conversion capabilities when switching to replacement technologies FDA 21 CFR Part 11, Preamble

12. 12 More Recommendations "The agency did not expect companies to save computer hardware and software for the sole purpose of recreating events. We anticipated that it would be possible to make an accurate and complete copy of those electronic records". Paul Motise at the ECA conference: FDA requirements for computers in laboratories, Berlin, Germany http://www.labcompliance.com/conferences/august99.htm

13. 13 Consequences for Users of Computer Systems Records must be kept electronically Data must be able to be retrieved and processed, no matter if the original computer system is in use or not It is up to the user to select the mechanism to comply with these requirements E-records in the context of part 11 must be processible: Read, accurately interpreted, and (re)evaluate by current and future computer hardware and software

14. 14 Basic Considerations for Long Term Storage / Retrieval Which physical storage media should we select, considering digital information should be preserved 10 or more years? How can we retrieve, reconstruct and re-evaluate data, when the original software is obsolete?

15. 15 Signal (mV) RT Peak area Processed data: peak area, amoun t Meta data: processing parameters, - integration parameters - calibration tables - post run calculations Types of Data: Example Chromatography Rawdata: area slices

16. 16 Alternative Storage Media Computer’s hard disc Digital tapes (DVC) CD-ROMs Digital video discs (DVD) Criteria IT environenment existing practices storage capacity anticipated physical lifetime anticipated lifetime until obsolescence

17. 17 The Biggest Problem with Storage Media: Real lifetime Driven by introduction of new media with higher storage capacity lower price longer lifetime higher speed greater convenience Examples: - 8 in floppy - 5 1/2 in floppy - tape cartidges Through inadequate support by operating systems

18. 18 Storage Media Recommendations Select a physical storage media that fits your environment Develop and implement procedure to verify accurate content at regular intervals, e.g. five years Move to new media before the old one becomes obsolete

19. 19 Software to Read and Interpret Data Digital information stored as 0’s ans 1’s Software reads and understands the sequence and converts numbers into meaningful data Examples: - Replay animated presentation - Header and formatting of text documents - Spreadsheet calculations

20. 20 Typical Chromatography Work Flow Instrument control& measurements Server/Database data management archiving PC instrument control, data acquisition data evaluation

21. 21 Types of Records to be Archived Analysis Report Instr. Control & Sequence parameters E-signatures Spectral processing parameters Spectral libraries Audit trail Calibration tables Integration parameters & results Raw data Hash-factors Sample name Operator name Report layout Pre/Post run Macros Re-integration parameters & results

22. 22 Alternative Solutions Use neutral data interchange format and software standards; platform and vendor independent Keep old computer hardware, application software and operating systems (vendor or user) Migrate the data to new systems

23. 23 #1: Generic Data Formats and Software Standards Use generic data format as agreed by different vendors, example Analytical Instrument Association (AIA), Analytical Data Interchange (ANDI) protocol, sponsored by ASTM (subcommittee E01.25) Problem is not the data format but the set of processing parameters All software products must have the same functionality

24. 24 Generic Data Formats and Software Standards - Conclusions - Several years away May be feasible for routine work in a static environment Difficult to implement for emerging technologies (need proprietary features to drive development)

25. 25 #2: Keeping Old Hardware Keep a generation of computer hardware, application software and operating systems (at the vendor or at the user’s site) Old computers run the original software to access, reevaluate and display original results Problems with limited lifetime of computer chips and with high operating costs

26. 26 Keeping Old Hardware - Recommendations - Only temporary solution Don’t keep computer museums for a long time The agency did not expect companies to save computer hardware and software for the sole purpose of recreating events"., P.Motise, Berlin 1999

27. 27 #3: Data Migration to New Systems The new system can process migrated data in exactly the same way as the old one Requires the same or superset software functionality Typically works well for single vendor Vendors should provide validated conversion routines and software for validity checks

28. 28 Data Migration to New Systems - Recommendations - Include data migration in user requirement and functional specifications for new systems Verify file conversion using automated validity checks software Set reasonable acceptance limits for the check

29. 29 Example: Migration Check Software on the Agilent Chemstation Data files Test parameters Test Output Test method

30. 30 Summary Recommendations (I) Develop migration policy and strategy for your entity Select storage media Define data and meta-data for all system categories to be retained When collecting data save data and processing parameters in the same directory Define retention period for records (depends on predicate rule). Include compatibility of data and processing parameters in users requirement and functional specifications for new systems

31. 31 Summary Recommendations (II) Select a vendor with track record of providing compatibility across at least five years Develop and implement procedures to check data integrity at regular intervals (e.g., five years) Before an existing system is retired, validate correct reprocessing on new system. Results should be within the limits as specified during original processing Develop active implementation plan for legacy systems

32. 32 Additional Information Six publications so far Overview and selected topics Security, audit trail, importance of instrument control, biometric devices Data Migration and Long Term Archiving for Ready Retrieval Biopharm Vol 13 (6), 58/64 Order or download from www.labcompliance.com Global on-line resource for validation&compliance issues in laboratories Regulatory news Discussion forum Monthly newsletter (free) Usersclub with free downloads Links to literature, documents and other websites Several pages dedicated to 21CFR11 www.labcompliance.com Implementing Part 11 in Laboratories