Intranets: Using Web Technologies in a Regulated Environment

Medical Device & Diagnostic Industry Magazine
MDDI Article Index

Originally published November 1996

Morteza Minaee

Managing the documentation necessary to comply with FDA's good manufacturing practices (GMP) regulation and the ISO 9000 series of quality systems standards can place a heavy burden on device manufacturers.^1–6 It's no wonder that companies are constantly on the lookout for a system that will simplify this task.

Now, the emergence of web-based intranets is promising to resolve many of the issues that have concerned manufacturers. In terms of the features most often needed by device manufacturers, intranet technologies compare favorably to both traditional, paper-based systems and other electronic alternatives. In addition, intranet systems hold the potential for doing much more than merely managing documentation.

BACKGROUND

FDA views extensive documentation—as required in the revised GMP regulation and elsewhere—as an essential tool for enabling the agency to fulfill its mandate for protecting the public health and safety. Recently, the documentation requirements of the GMP regulation have been reinforced by a number of trends that affect manufacturers and suppliers in many industries, but have particular application to such regulated environments as the medical device industry. Among these trends are the following:

Collectively, these trends are creating information needs that add up to a requirement for a large, complex network or system consisting of numerous interrelated subsystems. In consequence, many manufacturers are looking to expand their information systems with respect to documentation and configuration management, and to develop a comprehensive design of documentation that can meet all needs.

DOCUMENT CONTROL SYSTEM FEATURES

Although the GMP regulation and ISO 9000 standards require manufacturers to document many aspects of their product development processes, neither is prescriptive about how such documentation should be carried out. In deciding what type of documentation system is right for it, therefore, the first task of the device manufacturer is to define the basic features that its system should possess. These features may vary according to the complexity of the company's design process, manufacturing systems, finished product, or other variables. Once the basic set of desirable features has been established, the manufacturer can then meaningfully compare and contrast various alternatives for creating and maintaining a document control system.

Some characteristics of document control systems are almost universally desirable and can be used to provide a starting point for defining the basic features of a company's system. In any organization where personnel have diverse backgrounds and education levels, for instance, the acceptance and subsequent success of a documentation control system hinges on how easy it is to use. Thus, first and foremost, such a system must permit natural and easy retrieval of information. At the same time, it should provide a quick and simple update mechanism for those who create and revise these documents. Other basic features that manufacturers might expect to find in a document control system include the following:

PAPER-BASED SYSTEMS

In paper-based document control systems, procedures and instructions are created and controlled using traditional methods of preparing and distributing hard copy. One advantage of such systems is that, for most people, the natural form of retrieving information is to read printed manuals and procedures. Searching is performed in the traditional manner of reading a table of contents or index. Another advantage is that paper documents allow easy integration of text and graphic images.

Among the disadvantages inherent in paper-based systems are the problems of updating and obsolescence. As information contained in the documents changes over time, organizations can incur significant expense to input corrections, output and print new documents, and distribute them. To avoid reprinting entire documents, minor changes are often printed on separate pages and attached to the original document. But even if the new pages clearly note the part of the original that was revised and superseded, there is no way of ensuring that users will take note of the changed sections. Moreover, as changes accumulate over time, it becomes increasingly difficult for users of the document to keep track of them. Therefore, the eventual reprinting and reissuance of the entire document is inevitable.

To minimize the risk of providing inaccurate information, a paper-based document control system must include policies to ensure that outdated documents are recalled and replaced with their updated versions. In some organizations, it is customary to designate a custodian for each document. Responsibility for generating, revising, and distributing a document is vested in its custodian, who typically maintains a checklist detailing the points of use for each document. Whenever a document is revised or reprinted, the custodian uses this checklist to replace all copies of the old version with the revised one. Further, to avoid unauthorized copying and to validate the authenticity of a document, a stamp or seal is placed on each legitimate copy.

Although such a system can work well for small companies or those whose product development processes are relatively simple, for medium-sized to large companies a paper-based update and reissuance process can become extremely time-consuming, costly, and difficult to manage. This is especially true for companies that must compile and maintain a large amount of documentation in order to comply with the GMP regulation or ISO 9000 standards. Such difficulties can become the biggest obstacles to implementing a paper-based document control system.

ELECTRONIC ALTERNATIVES

Over the past decade, there has been a growing acceptance of computer technology in the workplace. This can be attributed to the increased sophistication of computing hardware, the reduced price of both hardware and software, and the increased computer literacy of today's workforce. In turn, these developments have made it possible for many companies to consider computerized storage and retrieval a realistic alternative to paper-based document control systems.

An electronic document control system is one in which procedures and work instructions are created, stored, distributed, and retrieved using computerized media. Thus, mere use of a word processor to create and print manuals is not considered an electronic alternative. The primary infrastructure for an electronic document control system is the existence of an electronic network comprising dumb terminals connected to a central computer, personal computers connected via a local area network (LAN), or a combination of the two. A growing number of organizations have already established some form of computer network to enhance communication among employees and facilitate the sharing of data and expensive computer peripherals.^7–9 An electronic document control system extends the uses of such networks.

Electronic systems offer advantages such as reduced complexity and potential cost savings that may overcome many of the difficulties inherent in paper-based systems. In a computerized environment, for instance, it is sufficient to store a single copy of each document, which is then electronically accessed by multiple users. This not only simplifies distribution, but also facilitates the updating process. Since changes are limited to a single copy, they can be performed quickly and with ease.

However, adoption of a computerized system is not without risks and disadvantages. Although the costs of electronic equipment have dropped significantly in the past few years, for instance, equipping a large company with appropriate hardware and software can still be expensive. Similarly, training employees to use the company's system can be time-consuming and costly, and can be made even more difficult if the system itself must undergo significant upgrades. Before deciding to implement an electronic document control system, therefore, companies should take careful stock of their requirements and explore all of the alternatives that might meet those requirements.

The sections that follow compare four electronic alternatives: word processing software; desktop publishing software; database management systems; and hypertext, the language of the World Wide Web.

Word Processing and Desktop Publishing. Intuitively, the alternative that appears to be most apt for use in a document control system is word processing software. Though document creation and updating is simplest with word processing software, in general such software does not possess the ability to merge text and graphic images effectively. Consequently, organizations have considered either the exclusive use of desktop publishing software, or the use of desktop publishing software together with a word processor. Familiarity with both these alternatives (especially word processing) is relatively high, and hence training time and costs are usually low.

However, these two types of software have similar weaknesses. First, neither handles unplanned key word searches efficiently. Although such software typically provides text search capabilities, the searching process is slow and limited to the document being viewed. This limitation can be overcome by storing all procedures, plans, and policies as a single document, but the document would then become unmanageably large, further reducing search speed. In practice, procedures are often separated into distinct electronic files. When a combination of word processing and desktop publishing software is used, searching for related information in separate files is, at best, cumbersome.

A second drawback of word processing and desktop publishing software relates to the integrity and security of documents. In general, such software packages do not, on their own, permit document retrieval in a purely read-only mode. Some word processors (e.g., WordPerfect) have a look option, but special document formatting is generally lost when the document is viewed via this option. More importantly, the menu from which the look option is selected can be used for retrieving and editing the document. Most word processing and desktop publishing software allows passwords to be used to prevent unauthorized access to documents, but once a document is retrieved it can be both viewed and edited. As a result, it is difficult to prevent a user from changing a document, whether intentionally or unintentionally. It should be noted that both FDA and accreditation agencies for ISO 9000 certification explicitly prohibit alterations to certain specific controlled documents without notifying them.

Database Management Systems. The key advantage of a database management system is its ability to search efficiently for key words or other user-specified search strings. In light of the documentation requirements of the GMP regulation and ISO 9000 standards, efficient search capabilities are considered critical. Thus, an attractive document control system alternative would be a user-friendly, page-oriented database management system that would allow integration of text and graphics.

Unfortunately, such features are difficult to implement using existing database management systems. Unlike most other kinds of organizational data, manuals and procedures tend to incorporate graphic images alongside text. Furthermore, unlike inventory, sales, or employee data, the information under consideration tends to involve multiple pages of information. Traditional database management systems are record oriented and prove to be ineffective for variable-length documents.

Hypertext Systems. In its most primitive form, a hypertext system can be viewed as a textual database with a simple user interface. The tool used to create such a system is hypertext markup language (html), the language of the World Wide Web, which is designed to make it easy to combine text, graphics, and other media onto screen pages.

A web-based document control system is one based upon Internet technology, but placed on private computer servers within a company and designed to permit access only to company employees. Formally, it can be defined as a computerized network of database objects connected by links. An object may be a section of text or a graphic image that is presented to the user in the form of a screen window.

The term intranet has recently come into use to describe the application of Internet technologies to internal corporate networks.¹⁰ This practice enables manufacturers to seamlessly integrate desktops, LANs, client/server applications, legacy systems, and the public Internet to create highly effective corporate information systems. Web technology is ideal for implementing an electronic document control system because it offers several useful capabilities, including the following:

The following subsections provide further information about the advantages of these features.

User Interface. A key feature of any hypertext system is the simplicity of its user interface. As a result, the technology is particularly attractive for situations where the system is to be used by a variety of users with different levels of computer skills.

Merging Media In a hypertext web document, each procedure or work instruction can be stored as a distinct text object. Similarly, forms, figures, and engineering drawings can be stored as distinct graphic objects. To satisfy the training requirements of a GMP- or ISO 9000–compliant quality management system, the manufacturer can even add sound and video to the system. Because such sites typically run on internal networks, bandwidth doesn't affect performance as much as it does on the Internet, so sound and video can be added without resulting in painfully slow file loading.

Minimal Redundancy. Each object belonging to the document control system—whether a procedure, figure, form, or other type of recorded information—needs to be stored just once. This nonredundancy of stored objects greatly simplifies the updating process and ensures information consistency. Unlike paper-based systems, in which a change to a form referenced in multiple procedures would require it to be updated and copied for inclusion in every copy of those procedures, a web-based system requires only an update to the changed item. Other objects and links remain unchanged.

Navigational Characteristics. The idea behind hypertext is that instead of reading text in a rigid, linear fashion (such as one reads a book), one can easily skip from one point to another, get more information, go back, jump to other topics, and navigate through the text based on one's interests at the time.

Links among objects are usually represented as on-screen icons, buttons, or underlined text. Since each link has an explicitly defined source and destination object, it is possible for the user to navigate easily from one object to another and then back to the original. Unlike conventional text that is structured sequentially, the links in hypertext documents encourage nonsequential navigation. Users can move within a hypertext document in one of three ways:

Access Control. Access control can be accomplished on web servers in at least two ways. To control write access to the intranet site, for instance, the manufacturer can restrict the number of people with authority to create pages for the server. This kind of control is usually handled in the same manner as assigning read/write permissions to computer network users.

Intranets also offer ways to control read access, so that unauthorized employees do not gain access to privileged information. One way is to use the password feature built into the web browser software. Another is to use Internet protocol (IP) or host-name filtering, which enables the system to be set up so that only specific IP addresses are allowed access to certain pages on the web server.

AN INTRANET DOCUMENT CONTROL SYSTEM

Assuming that a company can support the expense required to create a network of PCs or a centralized computer system, electronic media offer significant advantages over paper-based document control systems. Besides the cost savings that can accrue from not having to print, warehouse, and distribute paper documents at intervals, electronic media have the advantages of simple updating, significant reduction or elimination of the problems associated with obsolete documents, and easy dissemination of information. The following sections describe the use of an intranet-based document control system for key areas of concern to device manufacturers.

Storing Documents. One way to handle the documentation of a quality management system, as mandated by the GMP regulation and the ISO 9000 standards, is to treat the documentation as a two- or three-level hierarchical structure, with the amount of detail increasing with each successive level. At the highest level is the main directory, which can be used to provide an outline of the documentation system as a whole and a brief description of each document it contains. At the next level, the system would include a detailed description of each procedure or activity that is critical to quality management. Typically, entries at this level will answer the who, what, when, and where for each activity. In the third level, entries would include detailed work instructions. A web-based system facilitates structures such as this by making it possible to store each document, procedure, or work instruction as a distinct hypertext object. Similarly, forms, figures, and engineering drawings can be stored as distinct graphic objects.

Document Approvals. When using an intranet system, approvals for first-time issuance of documents—as well as for subsequent changes—are handled much the same as they are in paper-based or other electronic network–based systems. All such systems require manufacturers to have well-structured policies in place, and can make use of task segmentation to delineate responsibilities for documentation. A firm can define responsibilities such that the personnel who prepare documents, approve them, and actually bring them on-line are three distinct groups.

An intranet system can facilitate such distinct responsibilities by making the creation, transfer, and archiving of documents a seamless process. Once a document has been created in hypertext, together with appropriate graphics and links, the writing group can transfer the electronic file to the approval group for sign-off. Upon approval of the document, the approval group can then pass both electronic and paper versions to the uploading group. In turn, members of that group can place the electronic version on-line and keep the paper version with appropriate signatures on file.

Controlling Web Documents. To comply with the GMP regulation and ISO 9000 standards, manufacturers must be certain that their documentation is correct and up to date. Hypertext documents can be controlled in the same manner as nonhypertext documents. A needed change can be submitted as an engineering change request, and an approved change circulated as an engineering change notice. Once changes have been entered in the appropriate document, however, an intranet-based system can help control them by permitting them to be stored as read-only files, thus preventing accidental or unapproved changes.

Cross-Referencing. Even though the amount of cross-referencing among procedures, forms, and figures is dependent on the manner in which the procedures are constructed, some cross-referencing is inevitable. An intranet-based documentation system makes it easy by representing references as predefined links among documents. Therefore, if one procedure refers to another, or to illustrative material found elsewhere, predefined links enable users to retrieve the references by merely clicking on the link.

Printing Documents. One of the basic objectives of a document control system is to make up-to-date documents available. Creating printed copies of the on-line version of a document for subsequent use would defeat this objective. Instead, manufacturers can ensure that employees make use of the intranet's computer technology by disabling the system's printing feature.

However, there are situations in which printed copies are legitimately required—for instance, by regulatory agencies or certification bodies, by service personnel on field visits, or for a meeting that takes place in a conference room without computer display terminals. In such cases where a hypertext document must be printed, it is recommended that a footnote or stamp be used to validate each page of the printed document. Such a footnote might also state that the validity of the hard copy expires after a certain time.

Security. As more companies transmit sensitive materials over the Internet, the implementation of a corporate intranet can raise some worrisome issues. Most of the problems related to security have to do with use of the Internet and the interface between that external system and a company's own internal system. Among the issues raised by manufacturers are the possibility of transmitting software viruses, concern about the privacy of communications, and the need to safely encrypt data. One way to handle these concerns is to use an Internet service provider for the company's Internet connection. In this way, anyone accessing the company's web pages is actually connecting to a computer being operated by the Internet service provider and not one connected to the company's intranet system.