December 19, 2019
With more modern-day compliance enforcement, life science manufacturers and distributors are opting to digitize manual, paper processes with electronic transactions. Electronic records and signatures help simplify the process by replacing paper documentation and ensuring better accuracy of all records. The result is more efficient documentation and process traceability.
This article explores 21 CFR Part 11 best practices and how an Enterprise Quality Management System (EQMS) can help modernize compliance.
An Overview of 21 CFR Part 11
21 CFR Part 11 is the section within the Code of Federal Regulations (CFR) that sets the FDA’s guidelines for using electronic signatures and records for regulated life science companies. Part 11 establishes the criteria in which electronic records and signatures are deemed reliable and equal to paper documentation and allows electronic signatures to take the place of handwritten ones.
Organizations are required to safely and securely maintain data, ensure that all changes to data are traceable and that records cannot be falsified. In addition, Part 11 mandates that only authorized individuals can access electronic records, that electronic signatures aren’t transferred or copied, and that these signatures are certified with the FDA to be used in place of handwritten signatures. The regulation was published in 1996 and has since undergone several iterations to keep up with evolving technology.
Part 11 reinforces a secure foundation for managing records distribution, retrieval, and storage. FDA-regulated organizations that keep any records on a computer system, even partial records, must comply with the regulation. Global regulations are also closely aligned to 21 CFR Part 11, such as EU Annex 11 that describes the areas of compliance requiring documentation.
Companies that implement a Part 11 compliant system have an immediate advantage of having good data integrity practices in a global environment.
Streamlining Compliance with 21 CFR Part 11 Best Practices
While electronic record-keeping and signatures are convenient, there are requisite steps to ensure compliance. First, it’s important to recognize that 21 CFR Part 11 applies to all digitized records, regardless of the format. Regardless of the record type—text, images or audio files—all records that are saved electronically must meet compliance with the regulation.
EQMS helps streamline compliance and ensures that your company aligns with Part 11 best practices. The rest of this article details the components of an enterprise QMS and strong compliance practices.
Password Management
Good password management adds another layer of security to your documents. Password best practices should be followed including changing passwords regularly and creating strong passwords that include a mix of numerals, upper and lower letters, and special characters.
An EQMS provides a training management tool that enables you to train employees on password management and other security best practices. Employees should know what types of password formats are acceptable and should practice password best practices such as not sharing passwords, not writing them down and changing them regularly.
Audit Trail
If your system was reviewed by a regulatory agency, such as the FDA, they would want the history of your document system that shows proof of every single event that happened. This includes when records were created, changed or deleted, and by whom.
Automated audit management ensures that all processes are documented, traceable and show a complete audit history. The EQMS enables you to access this information quickly and easily, so you have the documentation you need, as soon as you need it.
Electronic Signatures
An electronic signature is a username and password combination assigned to an individual (never a group) that represents the individual’s handwritten authorization. This helps ensure transparency as well as the integrity of the signature. Before using electronic signatures, the organization must first inform the FDA that they are doing so.
The EQMS provides complete visibility into the use of electronic signatures. A good EQMS will provide a time-stamped archive of all signatures, prevent electronic signatures from being modified, duplicated, transferred or removed and will accommodate the use of signature comments.
Security
Data security is an essential component in 21 CFR Part 11 compliance. Organizations that work with sensitive data must ensure the security of those records. To do so you must control the access of these documents.
Document management software gives you full control over who has access to the system by enabling configurable permission and security settings. This means that you know who has accessed each document and if any changes were made, you’ll know who made them.
Employee Training
Employees must be properly trained to maintain and use the electronic system and perform all tasks, as dictated by Part 11. An EQMS provides a training management tool that ensures your personnel is fully trained on 21 CFR Part 11 compliance requirements and that all training is documented and auditable.
If any changes are made to personnel, training management tools allow you to identify which employees need new or additional training. Automatic tracking of due dates promotes predictability of training compliance and can help ensure that all training is completed on time.
Conduct Compliance Checks
Compliance isn’t a one-off thing, it’s an ongoing process that requires agility and patience to operate with an ever-changing landscape. To ensure that you’re meeting FDA compliance you’ll need to check that your processes are working as intended.
If there’s a discrepancy, utilize the EQMS’s corrective action system to document and manage any noncompliance and track corrective actions. Integrate with other processes such as audits and document management to create a closed-loop system. A robust EQMS can also help identify any areas that require additional employee training.
Validation
Installation Qualification (IQ), Operational Qualification (OQ) and Process Qualification (PQ) are critical aspects of 21 CFR Part 11. Before using an electronic system for record-keeping, the system must be properly installed, validated and able to handle minimum and maximum usage levels.
21 CFR Part 11 requires that the system be validated to demonstrate compliance with the regulation. In order to use an electronic system for regulated activities, you must first document that the system is doing what it is intended to do. Controls must be in place help you identify if a system is not functioning as it’s meant to.
The EQMS can automate this process of validation, so you don’t have to do it manually, which can be time-intensive and costly. It allows you to automate and execute IQ and OQ test scripts and make configuration changes to meet regulatory requirements. After system customization, all system requirements are tested in the PQ.
Conclusion
Technology has changed the way FDA-regulated industries ensure the safety of medical devices and drug products. 21 CFR Part 11 has enabled FDA-regulated companies to reduce the risk of human error, lower operational costs and reduce turnaround time through the use of electronic records and signatures.
However, when using electronic systems in regulated industries, care must be taken to ensure the integrity of electronic signatures and records. The EQMS helps to ensure that compliance with Part 11 best practices is met while saving time, reducing the risk of errors and ensuring documented audit trails and electronic signature compliance.
