Title 21 CFR Part 11
Encyclopedia
Title 21 CFR
Part 11 of the Code of Federal Regulations
deals with the Food and Drug Administration (FDA) guidelines on electronic records and electronic signature
s in the United States
. Part 11, as it is commonly called, defines the criteria under which electronic records and electronic signatures are considered to be trustworthy, reliable and equivalent to paper records (Title 21 CFR Part 11 Section 11.1 (a)).
Practically speaking, Part 11 requires drug makers
, medical device
manufacturers, biotech
companies, biologics developers, CROs
, and other FDA-regulated industries, with some specific exceptions, to implement controls, including audits, system validations, audit trails, electronic signatures, and documentation for software and systems involved in processing electronic data that are (a) required to be maintained by the FDA predicate rules or (b) used to demonstrate compliance to a predicate rule. A predicate rule is any requirement set forth in the Federal Food, Drug and Cosmetic Act, the Public Health Service Act, or any FDA regulation other than Part 11. http://www.fda.gov/regulatoryinformation/guidances/ucm125067.htm
The rule also applies to submissions made to the FDA in electronic format (e.g., a New Drug Application
) but not to paper submissions by electronic methods (i.e., fax
es). It specifically does not require the 21CFR11 requirement for record retention for tracebacks by food manufacturers. Most food manufacturers are not otherwise explicitly required to keep detailed records, but electronic documentation kept for HACCP and similar requirements must meet these requirements.
As of 2007, broad sections of the regulation have been challenged as excessive, and the FDA has stated in guidance that it will exercise enforcement discretion on many parts of the rule. This has led to confusion on exactly what is required, and the rule is being revised. (An update was posted on April 1, 2010 on the FDA Website). In practice, the requirements on access controls are the only part routinely enforced. The "predicate rules" which required the records to be kept in the first place are still in effect. If electronic records are illegible, inaccessible, or corrupted the manufacturers are still subject to those requirements.
If a regulated firm keeps "hard copies" of all required records, the paper documents can be considered to be the authoritative document for regulatory purposes and the computer system need not meet these requirements. Firms should be careful to make a claim that "hard copies" of required records are authoritative document. In order for the "hard copy" produced from its electronic source be considered as the authoritative document, the "hard copy" must (a) be a complete and accurate copy of its electronic source and (b) be used exclusively for regulated activities. The current technical architecture of computer systems increasingly makes the burden of proof for the complete and accurate copy requirement extremely high.
Various keynote speeches by FDA insiders early in the 21st century (in addition to high-profile audit findings focusing on computer system compliance) resulted in many companies scrambling to mount a defense against rule enforcement that they were procedurally and technologically unprepared for. Many vendors of software and instrumentation released Part 11 "compliant" updates, which proved to be either incomplete or insufficient to fully comply with the rule. Complaints about the wasting of critical resources, non-value added aspects, in addition to confusion within the drug, medical device, biotech/biologic and other industries about the true scope and enforcement aspects of Part 11 resulted in the FDA release of:
This document was intended to clarify how Part 11 should be implemented and would be enforced. But, as with all FDA guidances, it was not intended to convey the full force of law—rather, it expressed the FDA's "current thinking" on Part 11 compliance. Many within the industry, while pleased with the more limited scope defined in the guidance, complained that, in some areas, the 2003 guidance contradicted requirements in the 1997 Final Rule.
In May 2007, the FDA issued the final version of their guidance on computerized systems in clinical investigations. This guidance supersedes the guidance of the same name dated April 1999; and supplements the guidance for industry on Part 11, Electronic Records; Electronic Signatures — Scope and Application and the Agency’s international harmonization efforts when applying these guidances to source data generated at clinical study sites.
FDA had previously announced that a new Part 11 would be released late 2006. The Agency has since pushed that release date back. The FDA has not announced a revised time of release. John Murray, member of the Part 11 Working Group (the team at FDA developing the new Part 11), has publicly stated that the timetable for release is "flexible."
Title 21 of the Code of Federal Regulations
Title 21 is the portion of the Code of Federal Regulations that governs food and drugs within the United States for the Food and Drug Administration , the Drug Enforcement Administration , and the Office of National Drug Control Policy ....
Part 11 of the Code of Federal Regulations
Code of Federal Regulations
The Code of Federal Regulations is the codification of the general and permanent rules and regulations published in the Federal Register by the executive departments and agencies of the Federal Government of the United States.The CFR is published by the Office of the Federal Register, an agency...
deals with the Food and Drug Administration (FDA) guidelines on electronic records and electronic signature
Electronic signature
An electronic signature, or e-signature, is any electronic means that indicates either that a person adopts the contents of an electronic message, or more broadly that the person who claims to have written a message is the one who wrote it . By comparison, a signature is a stylized script...
s in the United States
United States
The United States of America is a federal constitutional republic comprising fifty states and a federal district...
. Part 11, as it is commonly called, defines the criteria under which electronic records and electronic signatures are considered to be trustworthy, reliable and equivalent to paper records (Title 21 CFR Part 11 Section 11.1 (a)).
Practically speaking, Part 11 requires drug makers
Pharmaceutical company
The pharmaceutical industry develops, produces, and markets drugs licensed for use as medications. Pharmaceutical companies are allowed to deal in generic and/or brand medications and medical devices...
, medical device
Medical device
A medical device is a product which is used for medical purposes in patients, in diagnosis, therapy or surgery . Whereas medicinal products achieve their principal action by pharmacological, metabolic or immunological means. Medical devices act by other means like physical, mechanical, thermal,...
manufacturers, biotech
Biotechnology
Biotechnology is a field of applied biology that involves the use of living organisms and bioprocesses in engineering, technology, medicine and other fields requiring bioproducts. Biotechnology also utilizes these products for manufacturing purpose...
companies, biologics developers, CROs
Contract research organization
A contract research organization, also called a clinical research organization, is a service organization that provides support to the pharmaceutical and biotechnology industries in the form of outsourced pharmaceutical research services...
, and other FDA-regulated industries, with some specific exceptions, to implement controls, including audits, system validations, audit trails, electronic signatures, and documentation for software and systems involved in processing electronic data that are (a) required to be maintained by the FDA predicate rules or (b) used to demonstrate compliance to a predicate rule. A predicate rule is any requirement set forth in the Federal Food, Drug and Cosmetic Act, the Public Health Service Act, or any FDA regulation other than Part 11. http://www.fda.gov/regulatoryinformation/guidances/ucm125067.htm
The rule also applies to submissions made to the FDA in electronic format (e.g., a New Drug Application
New drug application
The New Drug Application is the vehicle in the United States through which drug sponsors formally propose that the Food and Drug Administration approve a new pharmaceutical for sale and marketing...
) but not to paper submissions by electronic methods (i.e., fax
Fax
Fax , sometimes called telecopying, is the telephonic transmission of scanned printed material , normally to a telephone number connected to a printer or other output device...
es). It specifically does not require the 21CFR11 requirement for record retention for tracebacks by food manufacturers. Most food manufacturers are not otherwise explicitly required to keep detailed records, but electronic documentation kept for HACCP and similar requirements must meet these requirements.
As of 2007, broad sections of the regulation have been challenged as excessive, and the FDA has stated in guidance that it will exercise enforcement discretion on many parts of the rule. This has led to confusion on exactly what is required, and the rule is being revised. (An update was posted on April 1, 2010 on the FDA Website). In practice, the requirements on access controls are the only part routinely enforced. The "predicate rules" which required the records to be kept in the first place are still in effect. If electronic records are illegible, inaccessible, or corrupted the manufacturers are still subject to those requirements.
If a regulated firm keeps "hard copies" of all required records, the paper documents can be considered to be the authoritative document for regulatory purposes and the computer system need not meet these requirements. Firms should be careful to make a claim that "hard copies" of required records are authoritative document. In order for the "hard copy" produced from its electronic source be considered as the authoritative document, the "hard copy" must (a) be a complete and accurate copy of its electronic source and (b) be used exclusively for regulated activities. The current technical architecture of computer systems increasingly makes the burden of proof for the complete and accurate copy requirement extremely high.
Content
- Subpart A – General Provisions
- Scope
- Implementation
- Definitions
- Subpart B – Electronic Records
- Controls for closed systems
- Controls for open systems
- Signature manifestations
- Signature/record linking
- Subpart C – Electronic Signatures
- General requirements
- Electronic signatures and controls
- Controls for identification codes/passwords
History
Various keynote speeches by FDA insiders early in the 21st century (in addition to high-profile audit findings focusing on computer system compliance) resulted in many companies scrambling to mount a defense against rule enforcement that they were procedurally and technologically unprepared for. Many vendors of software and instrumentation released Part 11 "compliant" updates, which proved to be either incomplete or insufficient to fully comply with the rule. Complaints about the wasting of critical resources, non-value added aspects, in addition to confusion within the drug, medical device, biotech/biologic and other industries about the true scope and enforcement aspects of Part 11 resulted in the FDA release of:
This document was intended to clarify how Part 11 should be implemented and would be enforced. But, as with all FDA guidances, it was not intended to convey the full force of law—rather, it expressed the FDA's "current thinking" on Part 11 compliance. Many within the industry, while pleased with the more limited scope defined in the guidance, complained that, in some areas, the 2003 guidance contradicted requirements in the 1997 Final Rule.
In May 2007, the FDA issued the final version of their guidance on computerized systems in clinical investigations. This guidance supersedes the guidance of the same name dated April 1999; and supplements the guidance for industry on Part 11, Electronic Records; Electronic Signatures — Scope and Application and the Agency’s international harmonization efforts when applying these guidances to source data generated at clinical study sites.
FDA had previously announced that a new Part 11 would be released late 2006. The Agency has since pushed that release date back. The FDA has not announced a revised time of release. John Murray, member of the Part 11 Working Group (the team at FDA developing the new Part 11), has publicly stated that the timetable for release is "flexible."
See also
- Computer system
- Electronic medical recordElectronic medical recordAn electronic medical record is a computerized medical record created in an organization that delivers care, such as a hospital or physician's office...
- Guidance for industry (regulatory compliance)
- Title 21 of the Code of Federal RegulationsTitle 21 of the Code of Federal RegulationsTitle 21 is the portion of the Code of Federal Regulations that governs food and drugs within the United States for the Food and Drug Administration , the Drug Enforcement Administration , and the Office of National Drug Control Policy ....
- Secure Access for Everyone (SAFE)
- Electronic Signatures in Global and National Commerce ActElectronic Signatures in Global and National Commerce ActThe Electronic Signatures in Global and National Commerce Act is a United States federal law passed by the U.S. Congress to facilitate the use of electronic records and electronic signatures in interstate and foreign commerce by ensuring the validity and legal effect of contracts entered into...
(ESIGN, United StatesUnited StatesThe United States of America is a federal constitutional republic comprising fifty states and a federal district...
)
Sources
- Title 21 Code of Federal Regulations (21 CFR Part 11)
- (European Annex 11)
- (Computerised Systems (revision January 2011))
- FDA announcement 08-July-2010(21 CFR Part 11)