No one would call the U.S. Food and Drug Administration a trendsetter. However, the agency was ahead of the times in 1997 when it released 21 CFR Part 11 regulations on electronic records and electronic signatures.
At the time, records were mostly on paper, and the idea of a binding signature always meant pen and ink. The FDA accurately foresaw how important tech advances would be to the life sciences, however, and decided to officially recognize that digital records and signatures could be just as binding as their physical counterparts. Not only that, but the agency was also wise enough to provide the backbone requirements of an electronic system without hampering industry from innovating with new technologies and approaches.
Part 11 came out over 25 years ago, but electronic signatures and records have never been more ubiquitous — because of this, the guidance continues to be relevant. It is the only reason life sciences companies can use software to create, update and store records, as long as that software is Part 11 compliant.
Part 11 rolled out the red carpet for digital systems in regulated industries. This is the broadest, most dramatic effect that it’s had. Technology would have progressed regardless, but by releasing this regulation, the FDA indicated that digital tools aren’t just acceptable — they’re preferable.
Today, pharma manufacturers that have fully committed to digitizing have seen the benefits of Part 11 in multiple areas of their business and those that haven’t will likely find it increasingly difficult to stay compliant.
Data integrity for better product development
Per Part 11, “Persons who use closed systems to create, modify, maintain or transmit electronic records shall employ procedures and controls designed to ensure authenticity, integrity, and when appropriate, the confidentiality of electronic records.” This aligns with good data practices and ensures data integrity.
Data has always been vital to developing and manufacturing pharmaceuticals. In 2020, then-FDA Commissioner Stephen M. Hahn, while speaking about developing treatments for rare diseases, emphasized the role of data in the drug development process.
Hahn said, “Ensuring the availability and high quality of data allows us to maximize the extraordinary potential of science, better support the development of new medical treatments and cures, and increase the knowledge patients and consumers have to make informed decisions about FDA-regulated products.” That data would be much harder to access and analyze if it were still on physical paper because regulations didn’t allow electronic signatures. Part 11 essentially granted permission to pharma companies to use the technology they need to ensure data integrity and make drug discoveries faster.
Audit trails
Part of good data management is ensuring you can track who entered or changed data. That’s why Part 11 also requires “secure, computer-generated, time-stamped audit trails to independently record the date and time of operator entries and actions that create, modify or delete electronic records.” Any change to data needs to be trackable. According to an FDA guidance document on data integrity, “FDA expects processes to be designed so that data required to be created and maintained cannot be modified without a record of the modification.”
This requirement doesn’t mean pharma companies have to use digital systems for their records. But digital systems that are designed with this in mind do happen to make it much easier to provide an audit trail. When pharma companies use software that is Part 11 compliant, this information is created automatically and can be pulled whenever necessary.
Not only does having an audit trail keep companies regulatory compliant, it also prepares them for data-driven decision making when formatted appropriately. If all of the data, corrections and change reasons are defined and understood within a company’s systems, it puts the company that much closer to being able to infer insights and make data-driven decisions about products.
Since Part 11 was released, document management systems have become more commonplace in pharmaceutical manufacturing environments. These systems fulfill the requirements for data integrity and audit trails while relieving quality and regulatory professionals from the stress of having to ensure these requirements are being met through a manual system — at least, that is the case when the system does what it is designed to do.
How pharma can improve validation
Ensuring software works the way you need it to work is the whole point of computer system validation (CSV). After all, if software plays a part in compliance, pharma manufacturers need assurance that it performs as advertised. The key to not becoming overwhelmed by validation is to determine the part it plays in your organization. Not every single system used by a pharma manufacturer needs CSV.
An FDA guidance document suggests that businesses “take into account the impact the systems have on your ability to meet predicate rule requirements. You should also consider the impact those systems might have on the accuracy, reliability, integrity, availability and authenticity of required records and signatures.”
Unfortunately, CSV is commonly seen as a burden that can take months of time. This doesn’t have to be the case if companies use the approach recommended by the FDA. When pharma companies use risk to determine where to focus their validation efforts on their intended usage, valida- tion can be done in a matter of hours or even minutes. This more efficient version of CSV still ensures compliance with Part 11 and other regulatory requirements and aligns with what the FDA has been asking for over the last twenty years. It also means manufacturers can update with every software release instead of continuing to use a much older version for fear of the validation burden — putting them at risk for data integrity concerns and security breaches.
Document retention and retrieval
Part 11 had the potential to revolutionize how pharma manufacturers store batch records, standard operating procedures (SOPs), work instructions and other documents. The FDA was trying to enable companies in regulated industry to use digital systems in the widest sense possible, but this isn’t
the reality that played out. In theory, a pharma company that has completely digitized its systems should be able to immediately pull up any document the FDA needs to see. And with file sharing, sending a document to the FDA should also be an easy task.
Twenty years ago, this is the future that Pharma Manufacturing magazine had in mind. In the brand’s inaugural issue, one article noted, “But these electronic records have even bigger benefits — they allow manufacturers to share information quickly and easily, store and analyze information in ways not possible with paper, and improve documentation quality and security by decreasing human access and error.”
Unfortunately, while this is technologically feasible, it isn’t always how the industry operates. This was very apparent during the COVID-19 pandemic when the FDA had to resort to using remote tools for inspections in lieu of showing up on-site. Records requests were not optional when it came to the pharma industry. Under Section 704(a)(4) of the Federal Food, Drug and Cosmetic Act, refusing a records request carries the same weight as refusing an inspection.
Paper-based pharma companies that received a records request during the pandemic found themselves hunting down physical paper and scanning those documents to send to the FDA electronically. While this did fulfill the needs of the FDA and the pharma companies were complying by providing records in this manner, it took considerably longer than if those records had been electronic. Just as with the original Part 11, the FDA is not forcing companies to digitize, but compliance is easier by digitizing.
Part 11: More relevant than ever
Part 11 is a signed permission slip from the FDA to embrace technology that encourages innovation while allowing firms to remain compliant. The agency is embracing digital solutions and moving into the future. This trend is obvious in the FDA’s attitude toward the remote inspection tools previously mentioned.
One of those tools is remote regulatory assessments (RRAs). RRAs were a side effect of the pandemic, but not one that will disappear when the pandemic is over. According to the FDA, RRAs are to be “incorporated consistently across all FDA-regulated products beyond the current COVID-19 public health emergency.” By nature, an RRA runs smoother when the company in question is using electronic systems.
Apart from the FDA, the industry itself is steadily moving in this direction, although it’s clear that not every organization has fully embraced Part 11-compliant digital systems. Recent research from Cicero and MasterControl indicates that in life sciences as a whole, 64% of organizations prioritize digitizing their manufacturing departments.
This is definitely an ongoing process for most life sciences companies. Respondents indicate that 52% consider their companies to be digital, and 35% say they are connected, meaning they have multiple systems communicating with each other.
Part 11 deserves a place of honor alongside every software that allows pharma manufacturers to move faster and be more innovative because of compliant electronic signatures and records. There is certainly no obligation for these companies to use digital systems, but as those systems become more common, the FDA will likely continue to produce guidance and regulations on the assumption that pharma manufacturers have digital capabilities. The FDA’s attitude toward electronic systems and increased pressure from competing pharma companies that have digitized indicates that this needs to be a priority for pharmaceutical decision-makers.
