Information & Training. | Medical Devices.

21 CFR Part 11

The FDA provides guidance to organizations who maintain electronic records or submit information electronically to the FDA and as a result, have become subject to part 11 (FDA CFR Part 11).

Part 11 applies to records in electronic form that are created, modified, maintained, archived, retrieved, or transmitted under any records requirements set out in FDA regulations. Part 11 also applies to electronic records submitted to the FDA.

Since Part 11 became effective, the FDA have published a range of supporting documents, namely:

Compliance policy guide, CPG 7153.17 and a range of draft guidance documents including the following:

21 CFR Part 11; Electronic Records; Electronic Signatures, Validation

21 CFR Part 11; Electronic Records; Electronic Signatures, Glossary of Terms

21 CFR Part 11; Electronic Records; Electronic Signatures, Time Stamps

21 CFR Part 11; Electronic Records; Electronic Signatures, Maintenance of Electronic Records

21 CFR Part 11; Electronic Records; Electronic Signatures, Electronic Copies of Electronic Records

The approach being taken by the FDA in terms of the scope of Part 11

The FDA applies a “narrow interpretation of scope”
Under the “narrow interpretation” of the scope of part 11, with respect to records required to be maintained or submitted to FDA, when an organization chooses to use records in electronic format in place of paper format, part 11 applies. On the other hand, when using computers to generate paper printouts of electronic records, and those paper records meet all the requirements of the applicable compliance requirements and employees/users (organizational staff, product users, …) rely on the paper records to perform their regulated activities, FDA would generally not consider employees to be “using electronic records in lieu of paper records”. In these instances, the use of computer systems in the generation of paper records would not trigger part 11.

Medical Device Process Validation. Validation requirements. Protocol development. IQ. OQ. PQ.
Medical Device Software Validation.
Medical Device Design Validation.
Electronic Signature, Electronic Records.
Life Cycle Approach to Validation.
Risk Identification. Documentation. DHR’s. DMR’s.
Etc. Etc. …
Information & Training presentation >>>

Definition of Part 11 Records

Under this narrow interpretation, FDA considers part 11 to be applicable to the following records or signatures in electronic format (part 11 records or signatures):

“Records that are required to be maintained in electronic format in place of paper format. On the other hand, records (and any associated signatures) that are not required to be retained under compliance requirements, but that are nonetheless maintained in electronic format, are not part 11 records.”

The FDA recommends that you determine, whether specific records are part 11 records and that you document such decisions.

In some cases, actual business practices may dictate whether you are using electronic records instead of paper records. For example, if a record is required to be maintained and you use a computer to generate a paper printout of the electronic records, but you nonetheless rely on the electronic record to perform regulated activities, the FDA may consider you to be using the electronic record instead of the paper record. That is, the FDA may take your business practices into account in determining whether part 11 applies.

Accordingly, the FDA recommends that, for each record, you determine in advance whether you plan to rely on the electronic record or paper record to perform regulated activities. The FDA recommends that you document this decision (e.g., in a Standard Operating Procedure (SOP), or specification document).

“Records submitted to FDA, in electronic format would generally need to comply with Part 11. However, a record that is not itself submitted, but is used in generating a submission, is not a part 11 record unless it is otherwise required to be and it is maintained in electronic format.”

“Electronic signatures that are intended to be the equivalent of handwritten signatures, initials, and other general signing. Part 11 signatures include electronic signatures that are used, for example, to document the fact that certain events or actions occurred (e.g. approved, reviewed, and verified).”

Approach to Specific Part 11 Requirements

Validation

The FDA exercises enforcement discretion regarding specific part 11 requirements for validation of computerized systems.

A decision to validate computerized systems, and the extent of the validation, needs to take into account the impact the systems have on your ability to meet compliance requirements.

You need to base your approach on a justified and documented risk assessment and a determination of the potential of the system to affect product quality and safety, and record integrity. For instance, validation would not be important for a word processor used only to generate SOPs.

Audit Trail

The FDA exercises enforcement discretion regarding specific part 11 requirements related to computer-generated, time-stamped audit trails. Persons must still comply with all applicable compliance requirements, for example, date, time, or sequencing of events, as well as any requirements for ensuring that changes to records do not obscure previous entries.

Even if there are no requirements to document, for example, date, time, or sequence of events in a particular instance, it may nonetheless be important to have audit trails or other physical, logical, or procedural security measures in place to ensure the trustworthiness and reliability of the records. You need to base your decision on whether to apply audit trails, or other appropriate measures, on the need to comply with requirements, a justified and documented risk assessment, and a determination of the potential effect on product quality and safety and record integrity. You need to apply appropriate controls based on such an assessment. Audit trails can be particularly appropriate when users are expected to create, modify, or delete regulated records during normal operation.

Copies of Records

The FDA exercises enforcement discretion with regard to specific part 11 requirements for generating copies of records and any corresponding requirement in. You should provide an investigator with reasonable and useful access to records during an inspection. All records held by you are subject to inspection.

Record Retention

The FDA exercises enforcement discretion with regard to the part 11 requirements for the protection of records to enable their accurate and ready retrieval throughout the records retention period and any corresponding requirement.

A decision on how to maintain records needs to be based on compliance requirements and you need to base your decision on a justified and documented risk assessment and a determination of the value of the records over time..

Information & Training.

Medical Device:

- - Validation. Classification. Regulation. Requirements. Current best practices.
  - FDA cGMP’s. EU MDR’s / MDD’s.
  - FDA Medical Device Regulation. Outline of the FDA regulatory requirements.
  - FDA Medical Device Classification. The FDA approach to Medical Device Classification.
  - EU Medical Device Regulation and Classification (per MDD’s).
  - ^NewEuropean Medical Device Regulations (MDR’s). MDR Classification. MDR General Safety requirements.
  - Current Good Manufacturing Practices. QSR’s. General requirements of the QSR’s.
  - Quality System requirements to maintain compliant Validations.
  - Medical Device Process Validation. Validation requirements. Protocol development. IQ. OQ. PQ.
  - Medical Device Software Validation.
  - Medical Device Design Validation.
  - Electronic Signature, Electronic Records.
  - Life Cycle Approach to Validation.
  - Risk Identification. Documentation. DHR’s. DMR’s.
  - Etc. Etc. …
  - Information & Training presentation >>>