A 177 e Records Practice PDF

Electronic Signatures and Records
(21 CFR Part 11) in Practice
Revision 2.01
July, 2001
Supplied by
www.labcompliance.com
Global on-line resource for validation and compliance
Author: Ludwig Huber, Agilent Technologies
Orginal draft from Autumn 2000

published in Pharmaceutical Canada,
last update in July2001
Additional copies and other publications on validation and compliance can be ordered
from www.labcompliance.com
While every effort has been made to ensure the accuracy of information contained in this
document, Labcompliance accepts no responsibility for errors or omissions. No liability
can be accepted in any way.
1. Introduction
In 1997 the United States Food and Drug Administration (FDA) issued
a regulation that provides criteria for acceptance by the FDA of
electronic records, electronic signatures and handwritten signatures
(1). This was done in response to requests from the industry. With this
regulation, entitled Rule 21 CFR Part 11, electronic records can be
equivalent to paper records and handwritten signatures. The rule
applies to all industry segments regulated by the FDA that includes
Good Laboratory Practice (GLP), Good Clinical Practice (GCP) and
current Good Manufacturing Practice (cGMP).
The use of electronic records is expected to be more cost effective for

the industry and the FDA. The approval process is expected to be
shorter and access to documentation will be faster and more
productive.
The primary requirements of the new regulation are:

• Use of validated existing and new equipment and computer
systems
• Secure retention of electronic records to instantly reconstruct the
analysis
• User independent computer generated time-stamped audit trails
• System and data security, data integrity and confidentiality through
limited authorized system access
• Use of secure electronic signatures for closed and open systems
• Use of digital signatures for open systems
Although the rule is well documented and the FDA gave an

interpretation in their preamble to 130 industry comments, corporate IT
professionals and analysts in laboratories are often unsure when it
comes to implementation. Some of the rule's requirement are new,
some have already be existing before the rule has been released.
www.labcompliance.com Page 2
Huber and Winter (4-7) have published a series or articles on the
implementation of part 11 using analytical laboratories as an example.
This articles gives a summary and focuses on recommendations for
implementation of new requirements of the rule to the pharmaceutical
industry. Interpretations of regulations are quite dynamic.
The content of this paper represents the status of when the draft was
written (September 2000). The discussions are going on. A new
compliance policy guide has already been released by the US FDA (2)
and other new guidelines may be published. On-going updates can be
found on the Internet www.labcompliance.com under e-signatures
(21CFR11).
2. System validation
All computer systems used to generate, maintain and archive
electronic records must be validated to ensure accuracy,
reliability, consistent independent performance and the ability to
discern invalid or altered records.
This holds true for new as well as existing systems. It is basically

nothing new for laboratories using computers in a regulated
environment. Validating computer systems has been very well
described (3) and most companies have developed strategies for
implementation. 21 CFR part 11 does not have any more specific
requirements for validation. Because of the scope of part 11 more
computer systems must be validated than before and more functions
should be validated, computer generated, time stamped audit trail, for
example. The problem lies less with new or fairly new systems but
with older systems. They require a formal evaluation and a statement
on their validation status. If they can not be validated they can not be
used under 21CFR Part 11.
3. Secure retention and ready retrieval of

accurate and complete copies
Procedures should be in place to generate accurate and complete
copies of records in both human readable and electronic form
suitable for inspection, review, and copying by the agency.
Records must be protected to enable their accurate and ready
retrieval throughout the records retention period.
The FDA expects that final results be kept together with the original
data and the procedures for processing the data (meta data). The
FDA wants to be able to trace the final results back to the raw data
using the same software tools as the user had when the data were
generated. This is probably one of the most difficult to implement
requirements. Knowing that in some instances the records must be
kept for 10 or more years, and computer hardware and software have
a much shorter lifetime, one can anticipate problems with this
paragraph.
There are two basic considerations:

1. which storage media should we select, considering that the digital
information stored on them should last for 10 or ore years?
2. how can we read, re-evaluate and print the records when
software that has been used to generate the original result is
obsolete?
Possible solutions like storing meta data with the raw data and
validated file conversion routines have been discussed .in a paper by
Huber and Winter (7). The key recommendation of the authors is to
migrate raw data, meta data and final results to the new system
following these steps:
1) Develop a migration policy and strategy for your entity.

2) Develop an active implementation plan with time schedules and
check points.
3) Define data and meta-data for all system categories.
4) Try to reduce the amount of data to be archived to an absolute
minimum..
5) Define the type of data to be retained, for example, define if and
for how long raw data must be archived. This depends on the
predicate rule.
6) Save the processing parameters in the same directory as the data
(raw data and results).
7) Validate proper functioning of 6) by retrieving data, meta-data and
reprocessing the analysis.
8) Include backward compatibility of future revisions and platforms in
the user requirement specifications and functional specifications.
9) Select a proper storage media for long term archiving. Adhere to
the prescribed storage conditions (i.e. in the case of archives on
tapes, this includes regularly retensioning tapes).
10) Develop and implement a procedure to check the integrity of data
at regular intervals. For the tests, use the same procedure as
developed for step 6.
11) Before you retire a system, make sure that the data can be
accurately processed on the new systems. Results should be
within the limits as specified during the original analysis.
4. Limited access and binding signatures to

electronic records
Procedures should be in place to limit the access to authorized
users. Electronic signatures and handwritten signatures executed
to electronic records shall be linked to their respective electronic
records to ensure that the signatures cannot be excised, copied,
or otherwise transferred to falsify an electronic record by
ordinary mea
System access can be limited through physical and/or logical security

mechanisms. Most companies already have similar procedures in
place. Typically users have to log on to a system with user I.D. and
password. .Binding signatures to electronic records requires not only
passwords and User ID for a system but for each user using that
system. Alternative procedures have been discussed in details (5).
The following steps are recommended to be executed:
1. Use the security mechanisms of your data system to control

access. Ideally, the data system ties into the user account
database of the operating system.
2. Define, implement and use a password policy to ensure
confidentiality and authenticity of the individual user passwords.
Ideally, the data system either allows defining password policies or
ties into the password policies of the operating system.
3. To reduce the validation effort, delay the implementation of
identification mechanisms based on biometrics until they become
pervasive, i.e. an intrinsic or standard add-on to the operating
systems.
4. Define the measures to protect against “impersonation”. Ideally,
the data system includes possibilities to lock the current session
explicitly and automatically using an inactivity timeout.
5. Define the access rights according to the job role requirements of
your operation. For managing access rights for a large group of
users, we recommend defining access rights by job role rather
than individual users. Ideally, the data system allows configuring
access rights by user groups.
6. If your operation setup requires users to share the same desktop,
user authentication must be performed in the computer system
application itself, using the individual and unique combination of
user-id and password of each authorized user. Shared logons to
the data system negate the principle of “non-repudiation” of a
signed record.
7. Make sure that the security policies also cover user accounts for
the vendor’s service personnel. Create a dedicated service user
account that is only used for this purpose. If possible, disable tasks
that could impact confidentiality or security of the data stored in
the system.
8. Disable that service user account when it is not used for service
or maintenance activities. Consider whether additional procedural
controls for the use of the service account are necessary.
5. User independent computer generated time

stamped audit trails
Procedures should be available to use secure, computer-
generated, time-stamped audit trails to independently record the
date and time of operator entries and actions that create, modify,
or delete electronic records. Record changes shall not obscure
previously recorded information.
The audit trail itself is nothing new for regulated environments. What
is new is the requirement that the computer must electronically record
the audit trail. And, the audit trail must be independent from the
operator. Audit trails are required whenever records are created,
modified and deleted. Whenever a set of new results is generated, the
original raw data or any previously calculated result must not be
overwritten. Most systems lack an appropriate audit trail. Therefore it
is recommended to work with software vendors to build in this
functionality. One of the biggest concerns are commercial office
programs like spreadsheets and word processors. The suppliers may
not build part 11 compliant audit trail function into these programs.
However it is expected that add-on software packages will be offered
by 3rd parties.
6. Summary recommendations
Implementing the regulation on electronic signatures and records will
have major consequences. This situation is comparable with
implementing Good Laboratory Practices at the beginning of the
eighties and Validation in the first half of the nineties. It will take some
time until full implementation.
1. Define all work in your organization or laboratory that will fall

under 21 CFR Part 11.
2. Form a task force with members from IT department, if existing,
QA personnel and laboratory staff.
3. Develop an implementation plan for your organization and
laboratory.
4. Develop an infrastructure that will allow smooth implementation.
5. Decide whether you will use full electronic records and signatures
or hybrid systems, e.g., records in electronic and paper format.
Report the decision to the FDA.
6. Create awareness for the rule among all employees, especially for
the accountability of electronic signatures.
7. Train the people in the organization and in the laboratory on other
contents and consequences.
8. Think about if all signatures done today are really needed from a
regulatory point of view.
9. Look at all computerized equipment, evaluate compliance with part
11, make a gap analysis and develop a plan on how to make the
computer systems 'part 11' compliant. Include vendors in the
planning process.
10. Develop functional specifications for computerized systems.
11. Validate new computer systems.
12. Evaluate existing systems using criteria as defined in 10. If the
criteria can not be met, try to upgrade the systems. If they can not
be upgraded, they should be replaced.
13. Develop procedures for limited system access to authorized
individuals.
14. Develop procedures for implementing audit trails, to ensure data
integrity and for long term archiving with data retrieval throughout
the entire retention period.
7. References
1. Code of Federal Regulations, Title 21, Food and Drugs, Part 11
"Electronic Records; Electronic Signatures; Final Rule; Federal
Register 62 (54), 13429-13466.
2. United States FDA, Compliance Policy Guide: 21 CFR Part 11;
Electronic records, Electronic Signatures (CPG 7153.17).
www.fda.gov/ora/compliance_ref/cpg/cpggenl/cpg160-850.htm
3. L. Huber, Validation of computerized analytical instruments,
Interpharm, Buffalo Grove, IL, USA, ISBN 0-935184-75-9, 267
pages, May 1995, Agilent Part Number: 5959-3879
4. L. Huber, Implementing 21CFR Part 11 - Electronic Signatures
and Records in Analytical Laboratories Part 1, Biopharm 12 (11),
28-34, 1999
5. W. Winter, L. Huber, Implementing 21CFR Part 11 - Electronic
Signatures and Records in Analytical Laboratories, Part 2 –
Security Aspects for Systems and Applications, BioPharm 13 (1),
44-50, 2000
6. W. Winter and L Huber: Implementing 21CFR Part 11 -
Electronic Signatures and Records in Analytical Laboratories, Part
3 –Data Security and Data Integrity BioPharm 13 (3), 2000, pages
45-49
7. L. Huber and W. Winter: Implementing 21CFR Part 11 -
Electronic Signatures and Records in Analytical Laboratories, Part
4 – Long Term Archiving and Ready Retrieval BioPharm 13 (6),
2000

A 177 e Records Practice PDF

Uploaded by

Copyright:

Available Formats

A 177 e Records Practice PDF

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

A 177 e Records Practice PDF

Uploaded by

Copyright:

Available Formats

Electronic Signatures and Records

(21 CFR Part 11) in Practice

Author: Ludwig Huber, Agilent Technologies

Orginal draft from Autumn 2000

The use of electronic records is expected to be more cost effective for

The primary requirements of the new regulation are:

Although the rule is well documented and the FDA gave an

This holds true for new as well as existing systems. It is basically

3. Secure retention and ready retrieval of

There are two basic considerations:

1) Develop a migration policy and strategy for your entity.

4. Limited access and binding signatures to

System access can be limited through physical and/or logical security

1. Use the security mechanisms of your data system to control

5. User independent computer generated time

1. Define all work in your organization or laboratory that will fall

You might also like