By Mark A. Heller & Stephanie Philbin
April 15, 2003 | Now that the FDA is drafting new, simplified guidance for complying with 21 CFR Part 11 while it considers revising the regulations, the time is right to examine the agency's implementation and enforcement, and what actions firms can take when their attempts to comply fall short. Part 11 establishes the criteria under which the FDA considers electronic records and signatures "to be trustworthy, reliable, and generally equivalent to paper records and handwritten signatures." Importantly, it permits the use of electronic records and signatures — but does not require them. Nor does it create new record-keeping obligations.
Part 11's criteria apply to paper records and handwritten signatures already required under the Federal Food, Drug, and Cosmetic Act, the Public Health Service Act, and agency regulations relating to, for example, records of preclinical and clinical research. Additionally, Part 11 applies to certain submissions that the agency will accept in electronic form, such as New Drug Applications (NDAs) and Abbreviated NDAs. Again, however, a firm can still meet its legal obligations by using paper records and handwritten signatures, and is not required to adopt an electronic system.
If an organization does employ electronic records and signatures, but fails to comply with Part 11's requirements, the FDA will identify the Part 11 failures and cite the firm for violating the underlying regulation, because that underlying requirement would not have been met. For example, if a drug company maintains its written complaint records, required by 21 CFR 211.198(b), in electronic form, but the agency finds for some reason that these records are unacceptable substitutes for paper records, then the FDA would charge the firm with violating 211.198(b) in addition to not meeting Part 11. Indeed, in some cases the actual citation won't even mention Part 11. Instead, it might read: "Master production records are generated from a computer as electronic records without any apparent controls to assure authenticity and integrity [21 CFR 211.186(a) ... ]."
New Enforcement Plan
Although Part 11 went into effect in August 1997, the FDA was slow to enforce it; most warning letters for electronic record and signature failures have gone out in the past three years. Indeed, it wasn't until July 1999 that the agency identified factors — such as the "nature and extent of Part 11 deviation(s)" and the "effect on product quality and data integrity" — it would consider in determining whether or not to pursue regulatory action.
Now the FDA has withdrawn its July 1999 guidance and published new, non-binding enforcement plans. While the agency continues to enforce some Part 11 rules for open and closed systems and electronic signatures, it doesn't plan to take regulatory action to enforce Part 11's validation, audit trail, record retention, and record-copying requirements. The agency also won't take regulatory action against legacy systems (i.e., computer systems operational before Part 11's effective date).
The agency's new enforcement plan marks a substantial departure. For example, under the prior enforcement plan, two device firms that used electronic records to meet requirements under the Quality System Regulation (specifically, design output and complaint files) received warning letters that cited a lack of documentation to support their electronic records systems.
The FDA informed the firms that only electronic record and signature systems that met Part 11 could satisfy the requirements of 21 CFR 820.30(d) Design Output and 21 CFR 820.198 Complaint Files, respectively. Were the agency to inspect these same firms today under its new enforcement plan, any warning letters, if issued, would identify a considerably shorter list of deviations.
While the agency may be cutting back on its Part 11 enforcement plan, firms are not getting carte blanche to ignore these regulations. Compliance problems identified in the past continue to serve as red flags.
For example, the FDA was highly concerned about a medical gas transfilling firm that attempted to use electronic records to satisfy its manufacturing practices requirements, but the electronic record system was so unreliable that the firm could not reconstruct the history of a lot's production. Besides audit trail problems and a lack of documentation showing the system's ability to generate accurate copies, the agency found the firm lacked written procedures to hold individuals accountable for actions taken under their electronic signatures, lacked documentation or testing of the system's ability to identify invalid or altered records, and lacked safeguards to prevent the unauthorized use of electronic signatures. Under the agency's new enforcement policy, many of these shortcomings still would be cited today.
If an organization is cited for Part 11 failures, how does it effectively address the FDA's concerns? As with any violation, the company needs to objectively assess the agency's observations and deal with the issues directly. For a company to say that it relies on paper records when its standard operating procedure instructs employees to use electronic records will not be a winning strategy. Claiming that an electronic data and signature policy will be formalized, but not providing that policy to the FDA, also won't cut it.
It's best to respond with a follow-up meeting or a written copy of revised procedures that satisfy Part 11 and demonstrate the firm's commitment to change and compliance. This will result in a substantially greater chance of making the inspection ancient history. Moreover, a company should be aware — and the FDA often points this out — that an evaluation of an electronic records system should extend beyond the particular instance cited by the agency. Hiring an outside consultant may be a smart option if a company lacks adequate internal resources to fully audit its electronic records system.
However, if an organization decides that complying with Part 11 is simply too demanding, nothing prohibits reverting to paper records and handwritten signatures.
Call Them Before They Call You
What lies ahead for the FDA's enforcement of Part 11? Unfortunately, the answer remains murky. The agency recently shifted the lead in implementing Part 11 from the Office of Regulatory Affairs to the Center for Drug Evaluation and Research (CDER). The agency has also offered recommendations to industry, some of which cover the very areas where the FDA now declines oversight through reliance on enforcement discretion.
Thus, not only must life science firms ensure that they're complying with the requirements the FDA is actively enforcing, they also need to be cognizant of the agency's recommendations in other areas. If a company has questions about its obligations under Part 11, it's best to be proactive and call the agency to seek answers — before an inspector comes knocking at the door.
Mark A. Heller is vice chair of the government and regulatory affairs department and chair of the FDA Group at Hale and Dorr, in Washington, D.C. He may be reached at mark.heller@haledorr.com.
Stephanie Philbin is a junior partner in the FDA Group at Hale and Dorr, in Washington, D.C. She may be reached at stephanie.philbin@haledorr.com.
ILLUSTRATION BY ALEX NABAUM