Cfr Refernce Number for Cant Read Drawings

21 CFR Office xi: You should know these requirements

In 21 CFR Part 11, the FDA establishes its requirements for electronic records and signatures, which likewise apply to medical device manufacturers.

A lot of companies impress everything out on paper and and so sign it past hand to circumvent the requirements of Part 11. Is this really necessary?

21 CFR Part xi: A source of fear?!

With Part 11 on Electronic Records; Electronic Signatures the FDA has given a lot of companies sleepless nights (and consultants good business), particularly in the pharmaceuticals sector.

Sometimes the requirements were interpreted in such an over-the-pinnacle manner that the FDA felt compelled to publish the Guidance document: "Part 11, Electronic Records; Electronic Signatures — Telescopic and Application" to provide clarification. In the terminate, it saw its ain objective, namely to use Function xi to provide a basis for the replacement of paper documents by electronic data, existence thwarted.

But what does 21 CFR Part xi really crave? And which documents are affected?

21 CFR Role 11: Which systems and documents are affected?

21 CFR Part eleven applies whenever information is to be electronically generated, amended, stored, transferred or accessed. This tin can involve very different types of information, such as:

Text
Images, videos or
Audio files

The requirements (for IT systems) must be met if the documents generated, stored, transmitted or amended are used to demonstrate compliance with regulatory requirements, such every bit:

Release and test protocols
Procedure and work instructions
Design drawings, software architecture documentation
Specifications, asking documents
Records, e.g. product records
Review protocols

Equally a rule of thumb, you can say that systems are subject area to21 CFR Part 11 if the documents "managed" with the systems are

Submitted to the FDA (eastward.k. for a 510(one thousand) submission) or
Relevant for an FDA inspection, i.due east. the testing of the QM organization to ensure it complies with 21 CFR Part 820.

The FDA does not require some systems to be "Office 11 compliant":

Old systems that were in operation before xx August 1997
Systems that generate paper printouts.

So 21 CFR Office xi is only applicable if electronic records are replacing newspaper records.

There is a gray area when a system can produce a paper printout but relies on electronic recording to generate it. For example, manufacturers often automatically generate thousands of pages of test reports, impress them out and sign them. In this case, you would accept to justify the conclusion not to apply Office 11.

Regulatory requirements

The FDA requires the It systems discussed above to be validated and in this context likewise refers to the "Full general Principals of Software Validation" guidance document. This leads to the discussion as to whether this is merely near validation or about the complete software life bicycle. Read more on the subject field of computer system validation here.

Open up and closed systems

The requirements for open and closed systems are different. A system is closed when the system is under the command of persons who are responsible for the electronic records managed by this organization. Otherwise it is an open up organization.

An case of a airtight arrangement would be a build and test organisation on the intranet that only the testers or developers responsible tin access.

A system that transmits information via the Internet is as well considered an open system.

Requirements for airtight systems

21 CFR Part xi.x defines the requirements for airtight systems. The idea behind the requirements is that the people who piece of work with these systems must ensure the actuality, integrity and, if necessary, confidentiality of the information. For this reason, the post-obit are obligatory:

System validation (performance, the ability to detect invalid or contradistinct records).
Generation (also) of human being readable records.
Ensuring the protection of records (must exist available).
Limiting arrangement access to authorized individuals.
Use of reckoner-generated, time-stampedaudit trails that show who changed what and when. But here the FDA is rowing back, equally you can read in the above mentioned Guidance Document.
Operational system checks to ensure that (merely) the permitted sequencing of steps and events is enforced - if necessary.
Authority checks to ensure that only authorized users can use the system (e.g. electronically generate and sign documents), and access the operating system, computer or peripherals.
Peripherals check to ensure that the inputs and outputs are correct.
Grooming of the people who work with the system or develop it.
Prevention of falsification and so that people are liable in writing for what they sign.
System documentatione.g. on who has access to the system, how this access is granted, whether it exist for the use or maintenance of the system, and on who changed what in the arrangement and when.

Requirements for open up systems

21 CFR Role xi.30 places additional requirements on open systems. These include measures such equally certificate encryption and the apply of digital signature standards to ensure the actuality, integrity and confidentiality of records.

Digital signature requirements

The requirements of 21 CFR Part 11 regarding digital signatures volition seem familiar to anyone who has dealt with this outcome before and, for example, the German Signature Act:

Content: A digital signature must contain:
- The name of the signatory
- The date and time of the signature and
- The meaning of the signature (e.yard. review, approval, author).
Protection confronting falsification: It must not be possible to falsify the digital signature (21 CFR establishes the aforementioned de facto requirements every bit are in identify for documents).
Link to certificate: The signature must be linked to the certificate in such a way that it cannot be used on other documents.
Uniqueness: Naturally, it must be possible to assign the signature to a specific individual.
Biometric and non-biometric methods:The identification must be based on biometric methods or two distinct identification components such as an identification lawmaking and password.

When using identification codes (e.g. user name, initials or number) and passwords, 21 CFR Part eleven establishes the following requirements in xi.200 (a) and 11.300:

4-eyes principle: The electronic signature must exist regulated in such a way that any attempted misuse of someone else's electronic signature requires the collaboration of two or more individuals.
Unique combinations: The duplicate assignment of codes and passwords must non be possible.
Updating: Both codes and passwords must exist regularly checked regularly to ensure that they are still sufficiently secure.
Loss management: In the event that codes, passwords, cards, etc. are lost, there must be a procedure that permits "deauthorization".
Security measures: Suitable measures must be in place to protect against and find unauthorized access attempts.
Testing: Input/output devices, including cards that deport or read authority information, must exist tested periodically to ensure that they are working correctly.

Frequently asked questions regarding 21 CFR Function 11

Are there any solutions that guarantee compliance with 21 CFR Part 11?

The unproblematic answer is no. This is because 21 CFR Part 11 doesn't just establish technical requirements; information technology also established organizational measures. And you lot tin't purchase those.
Notwithstanding, manufacturers such as our sister company Medsoto have produced the products in such a fashion that the technical requirements for creating (technical) documentation are met.
Yous can besides read whichhealthcare compliance rules y'all must comply with.

Exercise you take to comply with 21 CFR Role xi if you print everything out and then sign it?

The answer (in most cases) is no. However, there are exceptions, such as the example of examination documentation we described to a higher place.

Do I have to do without paper?

The FDA (increasingly) requires you to submit your documents electronically. Notwithstanding, you could also scan and submit printouts. This would allow yous to ignore Part 11, except for the in a higher place exception.

Do I as well have to document the signature in the audit trail?

Yes, you do. Only delight notation that the FDA has relaxed the requirements for the audit trial slightly. The protests were too big.

How can the electronic signature be linked to a document?

A commencement selection would be to browse a signature, insert it into the certificate and print it as a PDF. But that wouldn't meet the requirements of Part eleven.lxx. You lot could export this graphic every bit a screenshot and insert it into some other certificate.

In fact, a document check digit (hash code) is usually encrypted with the signer'south individual key. This encrypted hash value is the digital signature.

Applied implementation of 21 CFR Part 11

Most companies base their digital signatures on either a (certificate management) arrangement or the digital signing of PDF documents.

liggettwouldown.blogspot.com

Source: https://www.johner-institute.com/articles/regulatory-affairs/and-more/21-cfr-part-11/