Identification

Document Sample
Identification Powered By Docstoc
					Current Phase of the Part 11 Proposed
        Amendment Process
George R. Smith Jr.
FDA Consumer Safety Officer
CDER, Office of Compliance
6/5/2007
Disclaimer


The views presented do not necessarily
   reflect those of the Food and Drug
              Administration
Agenda

 • History of part 11
 • Current approach and concerns
 • The amendment process and what
   remains
 • Summary/Key points
History of part 11

  21 CFR 11 (part 11) was Promulgated in
     August, 1997

  1. Allowed for electronic records and
     signatures

  2. Required additional controls to computer
     systems that maintained electronic
     records – INCLUDING VALIDATION of
     COMPUTER SYSTEMS
History of part 11
                     Part 11 Controls

     Accurate and               Policies for
      complete copies of          accountability
      records                    Systems
     Protection of records       documentation
     Limiting system            Integrity of electronic
      access                      records
     Operational system         Electronic signature
      checks                      controls
     Authority checks           Password controls
     Device checks              Training
History of part 11


  Part 11 Issues

   Broadly interpreted

   Not risk based

   Didn‟t grandfather legacy systems
History of part 11


  Broadly Interpreted:

     All automated systems running in an
      FDA regulated environment require
      Part 11 compliance, and therefore,
      Validation
History of part 11


   Not Risk Based:

     All systems that require Part 11
      compliance need to be fully
      validated
History of part 11


  Didn‟t Grandfather Part 11
   Legacy Systems

     All automated systems that were
      operational prior to part 11must
      comply with part 11 and be fully
      validated
History of part 11

    21ST CENTURY cGMP INITIATIVE & PART 11




              PHARMACEUTICAL CGMPS
              FOR THE 21ST CENTURY —
              A RISK-BASED APPROACH

        Department of Health and Human Services
           U.S Food and Drug Administration
                    September 2002
History of part 11

  Objective: “Encourage implementation of risk-
   based approaches that focus both industry
   and Agency attention on critical areas”

  “Our primary focus will remain the same: to
    minimize the risks to the public health...”
History of part 11

  „Troublesome Areas‟ of Part 11 to be
      Addressed as part of the Initiative.

  1. Part 11 Lead Moved to CDER OC
  2. Working Group with Representatives of
     All FDA Centers Formed
  3. Decision made to generate new guidance
     prior to amending the regulation
History of part 11
  Part 11 Scope & Application Guidance
  • Draft - February 2003
  • Final – August 2003
  • All previous Part 11 guides withdrawn including
    CPG 7153.17
     • Validation
     • Glossary of terms
     • Time stamps
     • Maintenance of electronic records
     • Electronic copies of electronic records
History of part 11

 I.   Using Enforcement Discretion FDA will
      Narrow the Scope of Part 11. Part 11 ONLY
      applies to:

      o  electronic records required to be
         maintained to meet the requirements of,
         or essential to demonstrate compliance
         with, FDA Predicate Rules
                          AND
       o electronic records submitted to the FDA
History of part 11

  Under the Narrow Scope:


     1. The predicate rule identifies what records
        must be maintained


     2. Part 11 addresses how those electronic
        records must be maintained
History of part 11
    Examples of Systems that Are Now Outside of
      the Scope of Part 11:


       • Systems used to generate paper printouts of
         electronic records when the paper records are used
         to meet all the requirements of applicable predicate
         rules


       • Systems that do not generate electronic records (e.g.
         Programmable Logic Controllers (PLCs))
History of part 11

    II. FDA Will Apply enforcement discretion
       for the following areas:

      o Validation
      o Audit trails
      o Copies of records
      o Record retention
      o All Part 11 requirements for legacy systems
        (pre 8/20/97)
Current approach and concerns

                       Validation

  “Establishing documented evidence which provides a
    high degree of assurance that a specific process
    will consistently produce a product meeting its
    predetermined specifications and quality
    attributes.”

    FDA‟s „GLOSSARY OF COMPUTERIZED SYSTEM AND SOFTWARE
                  DEVELOPMENT TERMINOLOGY‟
Current approach and concerns

                   Software Validation

  Determination of the correctness of the final program
    or software produced from a development project
    with respect to the user needs and requirements.
      Validation is usually accomplished by verifying
    each stage of the software development life cycle.

  FDA‟s „GLOSSARY OF COMPUTERIZED SYSTEM AND SOFTWARE DEVELOPMENT
                            TERMINOLOGY‟
Current approach and concerns




 Software Validation is a component of
       CSV, not the whole effort!
Current approach and concerns


    Where does it State that
      Computer Systems
    Require Validation in an
      FDA Environment?
Current approach and concerns

    Computer System Validation (CSV)
        Requirements come from:

              1. Predicate Rules

     And when predicate rules do not exist

            2. 21 CFR 11 (Part 11)
Current approach and concerns

 Predicate rules are:

 •   Federal Food, Drug, and Cosmetic Act
 •   Public Health Service Act
 •   Any other statute FDA enforce
 •   Any rules implementing those statutes
Current approach and concerns
  GMP Predicate rule Requirement for Validation

  21 CFR 211.68 (a)
  „Automatic, mechanical, or electronic equipment or other
     types of equipment, including computers, or related
     systems that will perform a function satisfactorily, may
     be used in the manufacture, processing, packing, and
     holding of a drug product. If such equipment is so
     used, it shall be routinely calibrated, inspected, or
     checked according to a written program designed to
     assure proper performance. Written records of those
     calibration checks and inspections shall be maintained
Current approach and concerns
  Medical Device Predicate rule Requirement for Validation

  21 CFR 820.70 (i):
  „When computers or automated data processing
    systems are used as part of production or the quality
    system, the manufacturer shall validate computer
    software for its intended use according to an
    established protocol. All software changes shall be
    validated before approval and issuance. These
    validation activities and results shall be documented
Current approach and concerns
  Part 11 Requirement for Validation

  21CDR 11.10(a)

    „Validation of systems to ensure accuracy, reliability,
     consistent intended performance, and the ability to
    discern invalid or altered records.‟
Current approach and concerns

               Typical High Level
     Computer System Validation (CSV) Phases

    1. Design
    2. Specifications
    3. Development (software creation & testing)
    4. Implementation (IQ, OQ, PQ, User Acceptance
       Testing)
    5. Maintenance, Support, & Training (SOPs, change
       control, archival)
    6. System Termination (retrieval of data, system
       dismantle)
Current approach and concerns
        COTS Versus Internally Developed Systems

   1.    Design
   2.    Specifications
   3.    Development (software creation & testing)

   ========================================

   4.    Implementation (IQ, OQ, PQ, User Acceptance Testing)
   5.    Maintenance, Support, & Training (SOPs, change control,
         archival)
   6.    System Termination (retrieval of data, system dismantle)
Current approach and concerns
                             Validation

    o Must satisfy predicate rule requirements

    o Base your validation approach on a justified and
      documented risk assessment, and a determination of the
      potential of the system to affect product quality and
      safety, and record integrity

    o When validation is not covered in specific predicate rules,
      a risk assessment should be performed to determine the
      level of validation that is required to ensure record
      integrity
Current approach and concerns
                   Legacy Systems

   FDA will apply enforcement discretion for all Part 11
        controls for all Part 11 legacy systems IF:

     1. System has been operational prior to 8/20/97
        (Part 11 effective date)
     2. System complied with existing predicate rules
        as of 8/20/97
     3. System complies with current predicate rule(s).
     4. System has documented evidence and
        justification that it is fit for its intended use
        (validation)
Current approach and concerns

  For Legacy Systems changed since
   August 20, 1997 you should
   determine if the changes introduce
   possible risks to record security
   and/or integrity and apply Part 11
   controls appropriately as per the
   scope and application guidance
Current approach and concerns
                      Legacy Systems

  Changes that may invalidate Part 11 Legacy System status
    (Higher Risk Changes):

     o Change in intended use

     o Change in functionality

     o Changes in the use of collected data
Current approach and concerns

                   Legacy Systems
  Generally, the following types of changes will not effect Part 11
    Legacy System Status (Lower Risk Changes):

      o Hardware maintenance actions such as upgrades or
        replacements
      o Some software maintenance actions such as upgrades to
        an operating system or DBMS (DOS to windows,
        ORACLE upgrade, …
      o Software maintenance to resolve originally intended use
        issues and functionality [software problem resolution]
      o Relocation or redistribution of a system
Current approach and concerns
                 Part 11 Controls

  1. Identify electronic records that require
     controls

  2. Access the risk to those records (Product
     Quality & Public Safety)

  3. Implement the appropriate controls
Current approach and concerns
                Part 11 Controls - Audit Trails

     o May not always be necessary

     o Satisfy predicate rules requirements (if required by
       predicate rules then they must be present)

     o When audit trails are not covered in specific predicate
       rules a risk assessment should be performed to
       determine whether they are needed to ensure record
       integrity based on product quality and safety, or if
       other appropriate controls should be put in place
Current approach and concerns
                   Audit Trail Examples

  Key Words (not limited to): „shall include complete…‟ ‟must be
    complete‟

  211.194 (a) - Laboratory records shall include complete data
    derived from all tests necessary to assure compliance with
    established specifications and standards

  812.145 (a) & (b) - Records must be Accurate & Complete
Current approach and concerns

  Part 11 Controls - Electronic Signature
                  Controls


   Needed when required by predicate rule AND
        they are maintained electronically
Current approach and concerns
                Electronic Signature Examples

  Key Words (not limited to): „shall be signed‟, „records shall
    include identification‟

  211.186(a) – master production and control records for each
    drug product, including each batch size thereof, shall be
    prepared, dated, and signed (full signature, handwritten) by
    one person and independently checked, dated, and signed
    by a second person

  211.188(b)(11) - records shall include: …Identification of the
    persons performing and directly supervising or checking
    each significant step in the operation
Current approach and concerns
       Part 11 Controls - Copies of Records

     o Records can be migrated to other formats (paper,
       microfiche, …) with appropriate controls (verification, …)

     o Copying process should produce copies that preserve the
       content and meaning of the record

     o You must allow inspection, review and copying of records in
       a human readable form at your site using your hardware
       and following your established procedures and techniques
       for accessing records (PDF, XML, …)
Current approach and concerns
         Part 11 Controls - Record Retention

     o Satisfy predicate rule requirements for record
       retention

     o Archived copies preserve the content and meaning of
       the original records

     o „True copies‟ of electronic records may be archived in
       other formats (paper, microfiche, …)
Current approach and concerns

        Retention Period Example

  Key Words (not limited to): „retention period‟

  211.180 (b), and ( c) – Records shall be
    maintained for all components, drug
    product containers, closures and labeling
    for at least 1 year after the expiration date
    …
The amendment process
  Federal Register (FR) Notice of Intention
    (NOI) to Amend Part 11 - April 8, 2004:

    o FR NOI to Amend Part 11 posted
      Comment Period was through July 9,
      2004
    o Review/analysis of comments for
      consideration in drafting the proposed
      amendment to the regulation
The amendment process
  Publish Proposed Amended Regulation along with
  Draft Companion Guidance
  Analyze Comments Submitted during the Comment
  Period (90 days?)
  Prepare Final Regulation including:
                       •Preamble
                   •Economic Analysis
              •Final Companion Guidance
  Promulgate Final Regulation and Publish Final
  Companion Guidance (At the same time we will
  withdraw the current Scope and Application
  Guidance)
Summary/Key Points
  •   Part 11 did not go away

  •   Scope & Application guidance is still in effect, and will remain in
      effect until an amended Part 11 regulation is finalized (not just
      proposed)

  •   Some level of validation is still necessary, but may be risk based

  •   Once a final regulation is promulgated the Scope and Application
      Guidance will no longer be needed and that guidance will be
      withdrawn

  •   Citations may be made to the Predicate Rule, not specifically to
      Part 11 (e.g. Validation)
Information Sources
   General Principles of Software Validation; Final Guidance for
                       Industry and FDA Staff:
        http://www.fda.gov/cdrh/comp/guidance/938.html


      Guideline on General Principles of process Validation
              http://www.fda.gov/cdrh/ode/425.pdf

   Glossary of Computerized System and Software Development
                           Terminology
        http://www.fda.gov/ora/inspect_ref/igs/gloss.html

   Computerized Systems Used in Clinical Investigations – Draft
        http://www.fda.gov/cder/guidance/6032dft.htm
Questions?

  George.Smith@FDA.HHS.Gov

             OR

    Part11@CDER.FDA.GOV

				
DOCUMENT INFO