In September 2004, 21 CFR Part 11, the FDA’s regulation governing electronic records and signatures came full circle. Current wisdom is that the FDA initiated its activity leading to the promulgation of Part 11 in response to a pharmaceutical industry request for permission to maintain batch records electronically. Thus, an industry petition was the incubator for Part 11. Now the industries regulated under Part 11 have collectively petitioned the FDA to withdraw the regulation as unnecessary. On 17 September 2004, the Industry 21 CFR Part 11 coalition filed a citizen petition asking the FDA to withdraw Part 11.
Before addressing the petition in detail and the current legal environment, it will be useful to discuss the environment surrounding the use of electronic records and signatures that existed through much of the 1990s. After all, the FDA was operating in that environment when it developed and promulgated Part 11. The 1990s were not very long ago, but when you consider the use of computers in business, they may as well have been eons ago.
Go deeper with GlobalData
A decade ago, a company’s PCs had processors running at least an order of magnitude slower than today’s machines. Today, a typical PC costing much less than those in use in 1994 has a 3GHz processor and many other enhancements to speed data storage and portability. Laptops were slow, heavy and rare luxury items. To maintain electronic records was to be at the forefront of technology, and using electronic signatures was almost exotic. Certainly, small businesses did not work this way: they were happy to have word processors and quality printers, if they had computers at all.
Now, of course, it is close to impossible for a company of any size to operate without a computer, and many individuals find them equally indispensable. Yet Part 11 remains in force with the same nominal requirements as when the FDA promulgated it in 1997, and the FDA’s enforcement of this regulation is still patchy and relatively rare. The FDA has, however, modified its approach to Part 11 by issuing guidance.
During the first four years of the regulation’s existence, it was largely ignored. In 1999, the FDA and its regulated industries addressed most of their efforts regarding computer technology to averting a crisis at midnight on 31 December 1999. Fortunately, the year 2000 arrived and the crisis did not. With the intense focus on the Y2k problem, Part 11 languished in the background until the crisis had passed.
However, during the busy year of 1999, PhRMA prepared and presented to the FDA a white paper expressing the pharmaceutical industry’s concerns with Part 11. The FDA, busy with Y2k and not wanting to engage in a series of separate discussions with each regulated industry affected by Part 11, asked PhRMA to form a coalition that could present a single voice to the FDA on Part 11 issues.
How well do you really know your competitors?
Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.
Thank you!
Your download email will arrive shortly
Not ready to buy yet? Download a free sample
We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form
By GlobalDataThe Industry 21 CFR Part 11 coalition held its first organisational meeting the following summer and had a ‘get acquainted’ meeting with the FDA in September 2000. This was the first of a series of meetings that paralleled the FDA’s issuing of a series of draft guidance documents that it hoped would clarify the intent and requirements of Part 11. From the start, the FDA described its schedule for issuing guidance and opened public dockets to receive comments on each contemplated guidance topic. It did not, however, describe a schedule issuance of a draft ‘scope’ guidance. In the FDA’s words, that was ‘on a separate track’.
The coalition and its individual members responded with enthusiasm. Representative groups met frequently with the FDA. While each discussion was intended to cover a specific guidance topic, every discussion eventually circled back to the scope issue. There was a valuable exchange of information and positions on each of the guidance topics, but the most important result of these meetings was that the FDA realised that the scope guidance would be the linchpin of its Part 11 efforts.
THE GUIDANCE
The FDA’s guidance fell into three parts:
Glossary: The FDA intended this draft guidance to be a list of all computer terms related to Part 11 compliance and enforcement. The industry response was not favourable. The FDA already had similar guidance, its Glossary of Computerized System and Software Development Terminology. If such a document were necessary, it would make more sense to update the existing document than create a new one. The sense of the industry comments was that the FDA would do better to withdraw the draft and concentrate on more pressing Part 11 issues.
Time stamps: With the time stamps draft, the FDA scored its first real Part 11 success. The guidance repudiated previous agency advice and acknowledged that time stamps could be in local time as long as they could be related to a central time source. Industry uniformly applauded this advice.
Electronic copies: Industry concerns regarding this guidance centred on its specificity. The guidance reflected the FDA’s desire for companies to provide electronic copies in a form that the FDA could handle, but lacked flexibility. It specified media (diskettes, for example) and indicated that copies had to afford the FDA the opportunity to manipulate data (appropriate to the programs available to the investigator).
THE SCOPE ISSUE
Why was the scope issue so critical? Shouldn’t it be straightforward? Typically, one of the first sections of any regulation outlines its scope, specifying those entities or activities that it regulates. For many people, the Part 11 scope raised more questions than it answered.
The problem was simple: the scope section left open the question of when a set or piece of electronically maintained information becomes a record under Part 11. Thus, regulated industries could not with any confidence define those records that were regulated under Part 11. Considering the number of records and the sheer quantity of data maintained by FDA-regulated industries, the issue of how much of that information falls under the regulation is rather significant. Such regulatory ambiguity is clearly serious.
There was much give and take between industry and the FDA regarding the requirements for record retention. Predicate rules make clear which records must be retained and for how long. Part 11 raised questions relating to the migration of records to newer systems as older systems are either superseded or made obsolete. Just a few years ago, floppy discs were ubiquitous, now they are rare and fast becoming extinct.
Similarly, DVDs are superseding CD-Rs. Contemplating the rate of technological change, some companies envisioned maintaining ‘computer museums’ to satisfy the Part 11 record retention requirements. In the medical device industry, for example, the quality system regulation (QSR) defines those records that a company must maintain, and it rarely rises to a level of concern between device manufacturers and the FDA.
AUDIT TRAILS
Part 11 also requires computer-generated audit trails for all records that fall under the rule. Very few systems in use prior to the rule’s effective date in 1997 could generate these. To compound the issue, few new systems had the capability, and modifying older systems to include that function was very expensive. In addition, many discussions implied that the audit trail would have to include the reason for the change when a record was changed. At this point, software cannot definitively determine the reason for an action.
OTHER ISSUES
Three other areas of Part 11 also generated significant uncertainty in the industry and lengthy discussions between the regulated industry and the FDA: validation, record maintenance (archiving) and legacy systems.
Validation: The validation guidance recommended that companies validate all software and computer systems regulated under Part 11. It suggested that companies follow the FDA’s own General Principles of Software Validation issued as final guidance by the Center for Devices and Radiological Health (CDRH) (11 January 2002) and the ISPE5/GAMP Forum document, The Good Automated Manufacturing Guide for Validation of Automated Systems (2001) (GAMP4). Industry was already familiar with both documents.
The device industry responded to this by suggesting that the Part 11 validation guidance was not necessary, as the QSR already mandated that the manufacturers validate computer systems. The industry recommended further that the FDA broaden the software validation guidance to encompass the entire agency rather than only the CDRH.
Maintenance: This draft would have more correctly been titled record archiving. The subject of how to handle records over the long term has been a true Gordian Knot for both the industry and the agency. The guidance draft introduced a new term, processability, into the discussion.
To the industry, this seemed to imply that records must not only contain information, but the agency must, over the long term, be able to manipulate them in whatever way was initially possible. AdvaMed took specific issue with this concept and argued that information content was the key to record archives. The industry coalition employed the Cohasset Group to run a short workshop to discuss the issue. The workshop produced a paper with few solutions but several recommendations for consideration.
Legacy Systems: The term legacy system does not appear in the Part 11 regulation, yet it has played a major role in the discussions surrounding how the FDA will enforce the rule and how industry will comply with it. A legacy system was finally defined as a computer system that was in service on 20 August 1997, the day Part 11 took effect.
These systems almost certainly do not comply with the regulation, and the FDA chose not to ‘grandfather’ them under the rule. Furthermore, the FDA clearly could not compel instant compliance. The FDA partially resolved this question by issuing its Part 11 Compliance Policy Guide (CPG). In the CPG, the FDA described the circumstances that it would consider before taking enforcement action for a Part 11 violation. Most significant for industry was the stated expectation that a company would establish a reasonable plan and schedule for bringing existing systems into Part 11 compliance.
THE SCOPE GUIDANCE
In February 2003, the FDA issued what is arguably the most important Part 11 document other than the regulation itself: Guidance for Industry Part 11, Electronic Records; Electronic Signatures – Scope and Application. This guidance redefined the discussion around Part 11. The FDA withdrew all of the previously proposed draft guidance and the compliance policy guide that had been the industry’s compliance beacon.
The guidance proposed several specific actions (or inactions) that would completely change the landscape of Part 11 compliance and enforcement. The FDA chose to exercise its enforcement discretion in several key areas: validation, audit trails, record retention and record copying. The concept of enforcement discretion reflects the fact that an agency may choose under most circumstances not to enforce a specific requirement or section of a regulation.
Nevertheless, if there is egregious disregard for the spirit of a regulation or widespread violation, the agency will take enforcement action. In other words, it is not a free pass. The regulated entity must continue to maintain a responsible compliance posture. Since the FDA does not perform Part 11 inspections, Part 11 violations are generally uncovered in relation to predicate rule violations. So, for the most part, companies can expect the FDA to pass over the requirements for which they have declared an enforcement discretion policy.
The guidance also narrowed significantly the FDA’s Part 11 enforcement interest to ‘records required to be maintained under predicate rules or submitted to FDA’. Essentially, the agency directed its concern to required records that the manufacturer maintains and relies upon for regulated activities. The guidance also introduced the concept of applying a risk assessment to decisions regarding Part 11 compliance.
In addition to publishing this guidance, the FDA withdrew all of the previously proposed Part 11 guidance and the Compliance Policy Guide, wiping the slate clean for a fresh start. It also stated that, corollary to the FDA initiative to review and revise the drug and biologics current good manufacturing practices (cGMP) regulations, the FDA is re-examining Part 11 with a view to revising it.
CITIZEN PETITION
To collect industry views on whether and how to revise Part 11, the FDA scheduled a public meeting and opened a docket to collect comments. Although the meeting was cancelled, the docket remains open, and most regulated industries and the industry coalition have submitted their views. The discussions leading up to the development of the industry input brought up the question of whether Part 11 is truly needed.
Most of the medical device industry expressed the view that the QSR adequately covers record keeping. The regulation does not specify that records must be on paper, and the CDRH has not formally taken such a position. While some guidance would be useful, the industry consensus was that the rule does not serve a purpose sufficient to justify its existence.
After some intense discussion among the coalition members, it was decided that the industry preferences were withdrawal of the rule and its replacement with guidance documents, as appropriate, or a significantly limited rule to cover the basic concepts described in the scope guidance.
The primary problem with the second choice is that, when a rule is opened up for revision, all aspects of the rule become fair game. The industry may expect the rule to be contracted severely, but the result, after public comments and public discussion, could be entirely unexpected. After all, Part 11 itself became a much broader rule and issue than industry originally intended or expected. The surest approach for industry appeared to be the first choice: petition the FDA to rescind the rule.
Since the FDA promulgated Part 11, the US federal government has enacted two laws to facilitate the use of electronic transactions and minimise government paperwork. The Government Paperwork Elimination Act (GPEA), passed in 1998, requires federal agencies to accept electronic records and electronic signatures when practicable in the ‘maintenance’ and ‘submission’ of documents required by the federal government.
In addition, in 2000, Congress enacted the Electronic Signatures in Global and National Commerce Act (E-Sign), which makes electronic signatures equivalent to signatures on paper for documents generated in commercial, consumer or business transactions. The Office of Management and Budget issued guidance for implementing each of these laws.
The industry coalition based its citizen petition primarily on the parallels between the GPEA and Part 11. While the two are not an exact match, GPEA addresses most of the Part 11 requirements.
The coalition believes that, where that match is incomplete or inexact, the FDA can address the issues with guidance rather than regulation. E-Sign is not as pertinent, although it does demonstrate that there is some desire in the Congress to regularise the use of electronic signatures.
Currently, the FDA is evaluating the citizen petition, and Advamed understands that they are taking it seriously. The idea of rescinding Part 11 has not been dismissed out of hand, and may yet be realised, closing the regulatory circle that began over a decade ago with a different industry request.
