Part 11: New Guidance Provides Little Guidance

FDA has scrapped the majority of its guidances on the Part 11 regulation, 21 CFR Part 11, Electronic Records, Electronic Signature, while keeping the rule in place.¹ In its most recent guidance on the scope and application of the rule, the agency states that it is reexamining the regulation, and that it intends to narrow the regulation's scope and to formally revise it.²

In the meantime, FDA intends to exercise “enforcement discretion” in certain (but not all) areas. The latest guidance is confusing and contradictory, and it is confounding quality assurance (QA) professionals tasked with compliance. This article reviews what this may mean to the medical device industry, and how it may change Part 11 compliance efforts.

Background

In March 1997, FDA published final Part 11 regulations on electronic records and electronic signatures. Part 11 applies to all FDA program areas (including medical devices, drugs, biologics, active pharmaceutical ingredients, foods, cosmetics, and veterinary medicines sold in the United States or available here during clinical trials). The original intent of the rule was to permit the widest possible use of electronic technology while still protecting public health. The rule became effective August 20, 1997.

In February 2003, FDA withdrew five draft guidance documents on Part 11, as well as its compliance policy guide on the rule (CPG 7153.17). At the same time it issued a new draft guidance narrowing the scope of the regulation. (The withdrawn guidances included ones on validation, glossary of terms, time stamps, maintenance of electronic records, and electronic copies of electronic records.) FDA states that it does not intend to reissue any of the withdrawn guidances or the CPG; its August 2003 scope and application—guidances discussed in this article—provides its current Part 11 enforcement policy.² 

Applicability

Part 11 applies to records in electronic form that are created, modified, maintained, archived, retrieved, or transmitted to meet records requirements in FDA regulations. Part 11 also applies to electronic records submitted to FDA, even if those records are not specifically identified in FDA regulations. Thus, if companies choose to keep any required records electronically or to submit records electronically to FDA, they must comply with Part 11. The underlying (or base) regulations are called the predicate rules. These rules cover good manufacturing practices (GMPs), good laboratory practices (GLPs), good clinical practices (GCPs), marketing and labeling requirements, and so on.

Rationale

Why did FDA change its approach? In its latest guidance, FDA notes that it felt that some interpretations of Part 11 would:

•Unnecessarily restrict the use of electronic technology in a manner inconsistent with FDA's stated intent in issuing the rule.
•Significantly increase the costs of compliance to an extent not contemplated at the time the rule was drafted.
•Discourage innovation and technological advances without providing a significant public health benefit.²

Records Now Subject to Part 11

One of the major changes in the new guidance is that Part 11 applies to the records and electronic signatures, not to the computer systems themselves. Under this narrower interpretation, FDA considers Part 11 to apply only to the following:

•Records required to be kept per predicate rules and kept in electronic form rather than in paper. Records not required by predicate rules but kept electronically are not Part 11 records. FDA recommends that manufacturers determine and document which records are Part 11 records. The starting place of a Part 11 assessment should be determining and documenting which electronic records are maintained for GxP GMP, GLP, or GCP purposes.
•Records required by predicate rules and kept electronically as well as in paper, and which are relied on to perform regulated tasks.
• Records sent to FDA in electronic format to meet predicate rules (even if those records are not identified in the predicate rules). If a record is not submitted but is used to generate the submission, it is not a Part 11 record unless the manufacturer must keep it per a predicate rule and it is being kept in an electronic form.
• Electronic signatures intended to be the equivalent of handwritten signatures, initials, and other signings required by predicate rules. So, if a company is using electronic signatures, it must comply with Part 11. The FDA guidance adds that Part 11 signatures include electronic signatures that the company uses to document certain events required by predicate rules (such as approval, review, verification, etc.) 

FDA adds that “actual business practices may dictate whether you are using electronic records instead of paper records.” It also adds that “when persons use computers to generate paper printouts of electronic records, and those paper records meet all the requirements of the applicable predicate rules and persons rely on the paper records to perform its regulated activities, FDA would generally not consider persons to be ‘using electronic records in lieu of paper records'” under 11.2(a) and 11.2(b). Per FDA, in these instances, the use of computer systems to generate paper records would not invoke Part 11.

However, if a device manufacturer or its employees rely on the electronic record to perform regulated activities, FDA may consider the manufacturer to be using the electronic record instead of the paper record. FDA recommends that for each record kept to meet predicate rules, the manufacturer determine in advance whether it plans to rely on either the electronic or the paper record to perform regulated tasks. It recommends that the manufacturer document its decision in a standard operating procedure or a specification.

It is advisable that the company implement a thorough training program: The company should audit and monitor to make sure that everyone is not only using the current version of the record, but also the version that the company wants used (i.e., electronic or paper).

An interesting note is that even though FDA recently withdrew its previous guidance on time stamps, the agency still believes one of the key points presented in that guidance: that when a manufacturer uses time stamps for systems spanning different time zones, it does not have to record the signer's local time. Instead, FDA recommends that the company implement time stamps with a clear understanding of the time zone used. Systems documentation should explain the time zone references as well as the acronyms or other naming conventions.²

New Approach

FDA has narrowed its current approach down to three main points:

•Part 11 will be interpreted narrowly. FDA is now clarifying that fewer records will be considered subject to Part 11.
•For those records subject to Part 11, FDA intends to exercise enforcement discretion regarding Part 11 requirements for validation, audit trails, record retention, and record copying, and with regard to all Part 11 requirements for systems operational before the effective date of Part 11 (also known as legacy systems).
•FDA will continue to enforce all predicate rule requirements, including predicate rule record and recordkeeping requirements.

Ongoing Enforcement

FDA adds that it is using “enforcement discretion” only in certain areas. It intends to enforce all other parts of Part 11 including, but not limited to, certain controls for closed systems (11.10). FDA will continue to enforce the following:

•Limiting system access to authorized individuals.
•Use of operational system checks.
•Use of authority checks.
•Use of device checks.
•Determination that persons who develop, maintain, or use electronic systems have the education, training, and experience to perform their assigned tasks.
•Establishment of and adherence
to written policies that hold individuals accountable for actions 
initiated under their electronic 
signatures.
•Appropriate controls over systems documentation.
•Controls for open systems corresponding to the controls for closed systems listed above (11.30).
•Requirements related to electronic signatures (11.50, 11.70, 11.100, 11.200, and 11.300).

Obviously, companies must comply with all applicable predicate rules. Required records, including those submitted to FDA, must remain secure and reliable and be maintained per the predicate rules.²

A Word on Enforcement Discretion

Enforcement discretion basically means that FDA is selectively enforcing its rules. Obviously, if FDA were to find any problem that puts patients at serious risk—in either a device with a software component or with a computer system used in the clinical trials, manufacturing, QA, and distribution of a product—it would take immediate action, regardless of what it says in any guidance document.

It is important to remember that the agency's policy on enforcement discretion can be easily revoked, as can guidance documents. Although the agency frequently uses guidance documents to state policy, guidance documents do not have the force of law. It is essential to base a company's Part 11 compliance policy and plan on the regulation, not on the guidance. 

In the recent past, FDA has been exercising enforcement discretion by not taking legal action against individuals who buy FDA-regulated products over the Internet, even though those products may be illegal, unapproved version(s) of the product (such as adulterated or counterfeit) or come from an unapproved manufacturing plant, for example.

However, FDA is taking legal action against the firms that are selling illegal or unapproved products in the United States. FDA found, in a recent sting operation, that 88% of a sampling of packages destined for consumers who purchased prescription drugs on-line contained contraband such as unauthorized versions, controlled substances such as codeine and anabolic steroids, animal drugs not approved for human use, and even one medicine that was pulled from the U.S. market for safety reasons. More than half of the imports came from Canada, India, Thailand, and the Philippines.³

And in a recent, deadly device case, 28 patients undergoing radiation therapy for colon, prostrate, and cervical cancer were overexposed to deleterious levels of the therapeutic radiation. The overexposures ranged from 20% to 100% over the prescribed dose. Nine patients died, with five deaths directly attributed to radiation overexposure. The surviving patients are expected to develop serious, radiation-related complications. The product itself was manufactured by a Canadian company; the radiation-treatment planning software was made by a U.S. company, and the patients were all treated in Panama.⁴ The U.S. company that made the software just signed a consent decree.⁵

Approach to Specific Part 11 Requirements

FDA has said that it intends to exercise enforcement discretion regarding certain Part 11 requirements, following the guidance given in its newest guidance document on scope and applicability. However, there are many caveats in this section of the guidance, and all members of a manufacturer's Part 11 team are advised to read it carefully. This section likely means that FDA is not giving industry much leeway. The gist of this section is that in all areas in which FDA is currently exercising enforcement discretion, the agency recommends that manufacturers base wording decisions on the predicate rules following a justified and documented risk assessment. This risk assessment documents the importance of any particular set of records in ensuring product quality and safety, and the accuracy and reliability of records on the systems. Please see the sidebar “Enforcement Discretion” for further detail.

Concerns

FDA serves both as a check and a balance on industry. Thanks to the efforts of everyone working in industry, as well as everyone working in FDA, the United States has some of the safest products available in the world. There is no question that FDA's efforts have prevented untold tragedies from occurring, and that the agency is the leader among similar world agencies. However, there are some in the device industry who believe that FDA has “shot itself in the foot” with its new approach on Part 11, and in the process, has badly damaged its credibility.

This approach raises concerns about what appears to be the deregulation of the industry as inspections are reduced in length (first with the quality systems inspection technique [QSIT] in devices, and now with routine drug inspections). As the length of inspections and the number of warning letters have decreased, the number of total recalls in the healthcare industry (device, drug, biologic, food, cosmetic, and veterinary medical) has doubled in the past decade.⁶

A recall is not a normal part of business; it is a breakdown in the system. One of the disturbing trends is how many recalls are being initiated by industry, compared with the number being mandated or requested by FDA or state inspectors. (In some of FDA's program areas, approximately half of the necessary recalls are currently found, conducted, and reported by industry, and half are found and requested by FDA.)

At the same time FDA is backtracking on Part 11 (for cost and other reasons), it is actively promoting process analytical technology (PAT). PAT uses computer systems for real-time, on-line reporting and analysis of data. PAT is tremendously expensive, and it may very well be cost-prohibitive for many companies.

This is not intended as an indictment of the agency, its mission, or its people. However, it will be hard for FDA to get industry to take Part 11 very seriously after this. The sad thing is that the regulation is clearly necessary. 

The Latest Part 11 Guidance

The Good. FDA seems to be acknowledging that it has not consistently enforced the rule. Although some companies have received scathing warning letters or warning letter citations on Part 11, others have had only cursory evaluations of their Part 11 compliance. For years, members of FDA regional offices have stated in public meetings that they were not enforcing Part 11, despite the fact that the rule became effective in 1997.

The Bad. The new guidance allows “actual business practice” to determine whether someone is using an electronic record (rather than whether the record is stored electronically). For years, some people have maintained that the actual record was the signed hard copy, and therefore they did not need to validate the computer system or keep an electronic copy. The Part 11 regulation was designed to put that excuse to rest. If both an electronic and a paper copy of a record exist, everyone knows that employees will use the electronic version (it's easier than having to find the paper copy in the archives). Industry has spent millions of dollars coming into compliance with Part 11. FDA's narrowing six years after the fact of the scope of a regulation that has been very expensive for the industry mocks industry efforts to comply. 

The Ugly. Using a guidance document to suspend parts of an active regulation is allowing the tail to wag the dog. The regulation has the force of law, not the guidance document. An analogy would be a QA executive issuing a memo to all employees saying that the organization was thinking about revising an SOP, and that in the meantime, employees only needed to follow sections 1b, c, f, j, and q, and 2f, g, i, and j until further notice. I believe that FDA may have damaged its credibility with its recent behavior on Part 11, even though there are honestly mixed reactions (some positive and pleased, some deeply disturbed at what appears to be deregulation) among members of the industry and within FDA itself.

References

1.21 CFR Part 11: Electronic Records; Electronic Signatures; available from Internet: www.fda.gov. 
2.“Guidance for Industry, Part 11, Electronic Records; Electronic Signatures—Scope and Application,” (Rockville, MD; FDA, August 2003).
3.Lisa Richwine, “FDA Finds Hundreds of Unapproved Drug Imports,” Health-Reuters, Sept. 29, 2003.
4.FDA Statement on Radiation Overexposures in Panama, (Rockville, MD: FDA, Center for Device, Radiation and Health (CDRH), July 6, 2001,) available from Internet www.fda.gov. 
5.“FDA Seeks Injunction against Multidata Systems International” (Rockville, MD: FDA Press Release, May 7, 2003); available from Internet: www.fda.gov. 
6.“The Enforcement Story,” Appendices, (Rockville, MD: FDA, 2002–2003); available from Internet: www.fda.gov.  

Copyright ©2004 Medical Device & Diagnostic Industry