Ten years after the FDA issued 21 CFR Part 11, the agency is expected to issue a new guidance for compliance, even as it considers revising the regulation.
Hailed as a landmark rule back in 1997, FDA 21 CFR Part 11 (also commonly known as 21 CFR 11 or Part 11) made electronic records and signatures as valid as paper records and handwritten signatures. It allowed the use of electronic record-keeping systems in complying with predicate rules. However, it did not take long before the praises for 21 CFR 11 turned into criticisms. The regulation was causing so much confusion, especially on what it covered and how the FDA should enforce it.
After much discussion from all sides and endless speculation all these years, this much is certain: Part 11 is here to stay. ?The regulation won't go away. However, while we won't rescind it, we may revise it,? said Janet Woodcock, FDA deputy commissioner for operations, in an interview with BIO-IT World.
Regardless of what the new, much-anticipated FDA guidance will say, there is one thing you have to keep in mind about FDA 21 CFR Part 11 ? it always works in tandem with predicate rules. Understanding the predicate rules that apply to your company is key to being compliant with 21 CFR 11 because those rules will determine the corresponding Part 11 controls that apply to your company.
This article is related to the White Paper:
21 CFR Part 11 Risk of Non-compliance.
To get the full details, please download your free white paper.
So, whether you are new to the industry, or simply uncertain about 21 CFR 11, here are a couple of things to note:
Predicate Rules: Definition
A predicate rule is any FDA regulation that requires companies to maintain certain records and submit information to the agency as part of compliance. Examples can be found in in GxP regulations such as GLP (Good Laboratory Practices), GCP (Good Clinical Practices), and CGMP (Current Good Manufacturing Practices).
Although predicate rules were originally meant to apply to paper records (which required handwritten signatures), these rules remain applicable even when you use electronic records and signatures. In this case, 21 CFR 11 then becomes an additional requirement for e-records and signatures. Part 11 requirements are not meant to replace or override other FDA (GxP, GLP, GCP, CGMP) regulations pertaining to signatures and records.
Sample Predicate Rules
For pharmaceutical, biotech, biologics, and other companies involved in drug manufacturing: 21 CFR 211.180 (b) requires ?Records shall be maintained for all components, drug product containers, closures, and labeling for at least one year after the expiration date or, in the case of certain OTC drug products lacking expiration dating because they meet the criteria for exemption under § 211.137, three years after distribution of the last lot of drug product incorporating the component or using the container, closure, or labeling.?
If your company maintains such records electronically per CGMP rules, then Part 11 applies to those records. This also means that the computer system that controls such records must be validated according to FDA 21 CFR Part 11 requirements.
For companies involved in medical device manufacturing : 21 CFR 820.40 (b) provides that ?Changes to documents shall be reviewed and approved by individual(s) in the same function or organization that approved the original review and approval?Each manufacturer shall maintain records of changes to documents. Change records shall include a description of the change, identification of the affected documents, the signature of the approving individual(s), the approval date, and when the change becomes effective.?
Similarly, if your company maintains an electronic system for document and change control as described by the CGMP rule above, Part 11 applies to those records, and the system must be validated.
In a nut shell: for companies that maintain electronic records, understanding the predicate rules found in GxP, GLP, GCP, CGMP, and other FDA regulations that require record retention and submission is key to 21 CFR 11 compliance efforts.
About the Author
David Ade, a product manager at MasterControl Inc., specializes on FDA computer validation and other software-related requirements.
Learn More About 21 CFR Part 11