1. Part 11, Electronic Records; Electronic Signatures
4/24/2017
Part 11, Electronic Records; Electronic Signatures
John F. Murray Jr.
U.S. Food and Drug Administration
Center for Devices and Radiological Health
John F Murray Jr

2. What is Part 11?
Part 11 is an FDA regulation that imposes certain requirements on manufacturers when they choose to maintain FDA- required records in electronic form
Part 11 requirements are intended to help assure the integrity, validity and trustworthiness of electronic records
John F Murray Jr

3. 4/24/2017
Why is Part 11 important?
For electronic records and submissions to have the same integrity as paper records, they must be developed, maintained, and used under circumstances that make it difficult for them to be inappropriately modified.
[Preamble, p ]
John F Murray Jr

4. Paper vs Electronic Records
4/24/2017
Paper vs Electronic Records
Paper records/handwritten signatures
Old established technology
Familiar and well understood
Electronic records/electronic signatures
New technology
Less familiar and less well understood
John F Murray Jr

5. Paper vs Electronic Records
4/24/2017
Paper vs Electronic Records
Paper records/handwritten signatures
Well established forensic methods for detecting changes and forgeries
Handwritten signatures considered binding
Electronic records/electronic signatures
Forensic methods for detecting changes are neither familiar nor widely understood
Many do not perceive E-signatures as binding
John F Murray Jr

6. History of Part 11 Went into effect on 20 August 1997
Industry consistently expressed concerns that some interpretations of part 11 would:
Unnecessarily restrict use of electronic technology
Significantly increase costs of compliance
Discourage innovation and technological advances More . . .
John F Murray Jr

7. History of Part 11
In February 2003 FDA withdrew Part 11 draft guidance on:
Electronic copies of electronic records
Validation
Glossary of terms
Time stamps
Maintenance of electronic records
Compliance Policy Guide More . . .
John F Murray Jr

8. History of Part 11 FDA issued new draft guidance on 25 February 2003
FDA is re-examining Part 11 and anticipates rulemaking to revise provisions
FDA is issuing new guidance describing how we intend to exercise enforcement discretion for certain Part 11 requirements while we re-examine Part 11
John F Murray Jr

9. What does “exercise enforcement discretion” mean?
It means FDA does not intend to take enforcement action to enforce compliance with certain requirements - usually under certain specified conditions
For foreign manufacturers enforcement action means sending a Warning Letter or sending a Warning Letter AND preventing products from entering the U.S.
John F Murray Jr

10. New FDA Approach to Part 11
Fewer records will be considered subject to Part 11
FDA will exercise enforcement discretion in regard to certain Part 11 requirements
FDA will continue to enforce all predicate rule requirements, including requirements for records and recordkeeping
John F Murray Jr

11. What is a predicate rule?
For purposes of Part 11, a predicate rule is any FDA rule, regulation or law that requires manufacturers to maintain records
The predicate rule identifies what records must be maintained and for how long
Part 11 addresses how electronic records must be maintained
John F Murray Jr

12. Scope of Part CFR § 11.1
John F Murray Jr

13. What records will be subject to Part 11 requirements?
Part 11 will apply when electronic records are used in place of paper records
Part 11 will NOT apply when:
Computers are used to generate paper printouts of electronic records;
These paper records meet all predicate rule requirements; and
Persons rely on paper records to perform regulated activities
John F Murray Jr

14. What should I do?
Determine which electronic records you maintain in place of paper records to meet predicate rule requirements and which electronic records are NOT required by predicate rules
Those records not required by a predicate rule are not covered by Part 11
Document your decisions
John F Murray Jr

15. What if I use the electronic records?
If you use an electronic record to perform regulated activities, Part 11 applies, even if you generate a paper printout
Determine in advance whether you will use the electronic record or the paper record to perform regulated activities
Document your decision in a Standard Operating Procedure or specification
John F Murray Jr

16. What about electronic records I submit to FDA?
Part 11applies to electronic records submitted to FDA under a predicate rule, even if such records are not specifically identified in FDA regulations
Part 11 does not apply to records that are not submitted to FDA but are used in generating a submission – unless a predicate rule requires such records to be maintained
John F Murray Jr

17. What about electronic signatures?
Part 11 applies to electronic signatures that are:
Intended to be the equivalent of handwritten signatures, initials, or other signings required by predicate rules
Used to document the fact that certain events or actions occurred in accordance with the predicate rule (e.g. approved, reviewed, verified)
John F Murray Jr

18. Validation and Related Requirements 21 CFR § 11. 10(a), § 11
Validation and Related Requirements 21 CFR § 11.10(a), § & 21 CFR § (i)
John F Murray Jr

19. Must I validate my electronic recordkeeping and signature system?
FDA intends to exercise enforcement discretion for Part 11 validation requirements
However, the Quality System Regulation requires computerized systems to be validated [21 CFR (i)]
New FDA Part 11 guidance does not impose any additional validation requirements
John F Murray Jr

20. Why is validation important?
Your computerized systems can have an impact on:
Your ability to meet predicate rule requirements
The accuracy, reliability, integrity, availability and authenticity of required records and signatures
John F Murray Jr

21. Do you have additional advice?
Base your approach to validation on:
A justified and documented risk assessment
A determination of the potential of the system to affect product quality and safety and record integrity
John F Murray Jr

22. What guidance is available for software validation?
General Principles of Software Validation:
Good Automated Manufacturing Practice Guide for Validation of Automated Systems, GAMP 4:
John F Murray Jr

23. Audit Trail and Related Requirements 21 CFR § 11. 10(e), 11
Audit Trail and Related Requirements 21 CFR § 11.10(e), 11.10(k)(2) and 11.30
John F Murray Jr

24. What is an audit trail? An audit trail:
Is secure and computer generated and associated with a specific record
Records who creates, modifies or deletes an electronic record
Records when the record was created, modified or deleted
Changes made to records should not obscure previously recorded information
John F Murray Jr

25. Must all electronic records have an audit trail?
FDA will exercise enforcement discretion in regard to audit trail requirements
Persons must comply with all predicate rule requirements related to:
Date, time or sequencing of events
Ensuring that changes to records do not obscure previous entries More . . .
John F Murray Jr

26. Should all electronic records have an audit trail?
Even in the absence of predicate rule requirements to document date, time or sequence of events, an audit trail will help ensure the trustworthiness and reliability of records
Audit trails are especially appropriate when users are expected to create, modify or delete regulated records during normal operations
John F Murray Jr

27. How can I decide whether records should have audit trails?
Base your decision on:
The need to comply with predicate rule requirements
A justified and documented risk assessment
A determination of the potential effect of lack of record integrity on product quality and safety and record integrity
John F Murray Jr

28. Legacy Systems
John F Murray Jr

29. What is a legacy system?
For purposes of Part 11, a legacy system is a computerized recordkeeping system that was in operation before Part 11 went into effect on 20 August 1997
John F Murray Jr

30. Must legacy systems comply with Part 11?
FDA intends to exercise enforcement discretion with respect to all Part 11 requirement for legacy systems if the certain criteria are met for a specific system
John F Murray Jr

31. What are the criteria for legacy systems?
Operational before 20 August 1997
Met all applicable predicate rule requirements before 20 August 1997
Currently meets all applicable predicate rule requirements
Documented evidence shows system is fit for intended use and has an acceptable level of record security and integrity
John F Murray Jr

32. What if I made changes to my legacy system since 20 August 1997?
If the changes introduce risks to record security and integrity, apply Part 11 controls to records and signatures using this guidance
John F Murray Jr

33. Copies of Records 21 CFR § 11.10(b) and § 11.30
John F Murray Jr

34. Must I provide electronic copies of records to FDA investigators?
FDA intends to exercise enforcement discretion with regard to generating copies of records
You should provide an FDA investigator with reasonable and useful access to records during an inspection
All records held by you are subject to inspection according to predicate rules More . . .
John F Murray Jr

35. Must I provide electronic copies of records to FDA investigators?
FDA recommends that you supply copies of electronic records by:
Producing copies of records in common portable formats when records are maintained in these formats
Using established automated conversion or export methods where available to make copies in a more common format (copies to PDF, XML or SGML for example)
John F Murray Jr

36. Does FDA have other requirements for electronic copies?
The copying process used should produce copies that preserve the content and meaning of the record
If you have the ability to search, sort or trend records, copies given to FDA should preserve the same capability if reasonable and technically feasible
John F Murray Jr

37. Must I allow the FDA investigator to look at my electronic records?
You should allow inspection, review and copying of records in a human readable form at your site using your hardware and following your established procedures and techniques for accessing records
John F Murray Jr

38. Record Retention 21 CFR § 11.10(c) and §11.30
John F Murray Jr

39. Will FDA enforce record retention requirements in Part 11?
FDA intends to exercise enforcement discretion with regard to Part 11 requirements for protection of records to enable their accurate and ready retrieval throughout the record retention period
John F Murray Jr

40. What should I consider when deciding how to archive records?
How you maintain your records should be based on:
Predicate rule requirements
A justified and documented risk assessment
A determination of the value of records over time
John F Murray Jr

41. How may I archive electronic records?
You may archive electronic records to nonelectronic media such as:
Microfilm
Microfiches
Paper
Standard electronic file format such as PDF, XML or SGML
John F Murray Jr

42. May I delete electronic records after they have been archived?
You may delete the original electronic records after archiving them if:
You comply with all predicate rule requirements
The archived copies preserve the content and meaning of the original records
John F Murray Jr

43. Can I use a combination of paper and electronic records?
Paper and electronic record and signature components can co-exist if:
Predicate rule requirements are met
The content and meaning of records are preserved
John F Murray Jr

44. Are there any Part 11 requirements not affected by this guidance?
Yes. FDA intends to enforce provisions relating to the following controls and requirements:
Limiting system access to authorized individuals
Use of operational system checks
Use of authority checks
Use of device checks More . . .
John F Murray Jr

45. Are there any Part 11 requirements not affected by this guidance?
Yes. FDA intends to enforce provisions relating to the following controls and requirements:
Determination that persons who develop, maintain or use electronic systems have the education, training and experience to perform their assigned tasks More . . .
John F Murray Jr

46. Are there any Part 11 requirements not affected by this guidance?
Yes. FDA intends to enforce provisions relating to the following controls and requirements:
Establishment of and adherence to written policies that hold individuals accountable for actions initiated under their electronic signatures More . . .
John F Murray Jr

47. Are there any Part 11 requirements not affected by this guidance?
Yes. FDA intends to enforce provisions relating to the following controls and requirements:
Appropriate controls over systems documentation
Controls for open systems corresponding to controls for closed systems bulleted above More . . .
John F Murray Jr

48. Are there any Part 11 requirements not affected by this guidance?
Yes. FDA intends to enforce provisions relating to the following controls and requirements:
Requirements related to electronic signatures (§§ 11.50, 11.70, , and )
John F Murray Jr

49. What if I have questions about Part 11 in the future?
Contact:
Mr. John Murray
Office of Compliance
Ms. Christine Nelson
Office of Health and Industry Programs
Division of Small Manufacturers, International and Consumer Assistance
John F Murray Jr