An Introduction to FDA 21 CFR Part 11

Every week that goes by, I talk to several medical device companies all over the world who have established quality management and document management systems that are 100% paper-based. It seems staggering that in this age of technology that paper-based systems are still a common fixture in the medical device industry. Yet it’s true.

Why?

I believe one of the reason paper is still king for managing documentation for medical device companies is quite clear: FDA 21 CFR Part 11.

You may know everything you need to know about Part 11. Or if you are like most, you know a little about Part 11 but enough to be dangerous.

Chances are what you believe to be true about Part 11 is significant and challenging enough to keep you ordering reams of paper and away from transitioning to electronic document management.

Chances are you believe that continuing with that paper-based document management system is easiest in the end, even though you know how challenging, inefficient, and risky managing piles of paper can be.

Free eBook Download: Click here to download a PDF version of the Complete Guide to 21 CFR Part 11.

Is it the Part 11 regulations that keeps you from pursuing a better way to manage documents and records? The need to conduct an exhaustive validation of software can be daunting and involve a significant amount of testing.

Yes, it is ultimately a decision that involves weighing the pros and cons of improving efficiency of document management versus increased burden of validation testing to comply with Part 11.

Is it worth it?

In my experiences with electronic document management and electronic signatures, there is often a great deal of confusion and ambiguity when it comes to understanding and addressing FDA 21 CFR Part 11.

There are often (at least) two very different opinions about how and what to do in order to address Part 11.

To give you some perspectives from my own experiences, I once participated in a 4 hour seminar with a software validation and Part 11 expert who managed to scare the hell out of me with respect to all that is required to address electronic document management and electronic signatures requirements.

I also had another experience with a expert on FDA regulations who laughed about Part 11 and said that it is no big deal and to not even worry about it.

To make matters more confusing, FDA position and enforcement of Part 11 has not always been clear.

Regardless of the opinions on the topic, the facts remain that 21 CFR Part 11 is still officially in effect.

Let me provide a very brief overview of what Part 11 contains and covers. 

What does FDA 21 CFR Part 11 include?

The scope of FDA 21 CFR Part 11 pertains to electronic records, electronic signatures, audit trail, and computer systems.

The scope is defined in detail in section 11.1. FDA also has a guidance document for Part 11 that provides more insights and details regarding application of the regulations.

Electronic Records

An electronic record is any quality or production record that is maintained electronically. Quality and production records are legal documents.

Electronic records may include quality management system, design history files (DHF), device master records (DMR), device history records (DHR) / production batch and/or lot records, training records, complaints, CAPAs, and so on.

Electronic Signatures

An electronic signature is any approval of a quality or production record done so electronically.

An electronic signature is comprised of two parts which is unique and ties to a specific person. The first part of an electronic signature may be well known, such as a username or email address. The second part is known only by the specific owner or user. Often times this is a password or maybe a biometric, such as a fingerprint.

An electronic signature is the equivalent of a handwritten signature.

Audit Trail

An audit trail of an electronic record system provides evidence as to the generation of electronic records, when electronic records were signed electronically, who signed the electronic records, and history.

All electronic records and electronic signatures shall be date and time stamped. All electronic records require an audit trail.

Closed System versus Open System

A closed system is an environment where system access is controlled by the company using it. The company can confirm the identity of all users prior to providing access to the electronic record system and only electronic signatures are required.

An open system is an environment where system access is not controlled by the company using it. The company cannot confirm the identity of all users prior to providing access to the electronic record system. In addition to electronic signatures, digital signatures are also required to verify the identity of the person signing the document.

Replacements for paper

One of the advantages of electronic records and electronic signatures is to replace paper records with handwritten signatures.

While it may seem as though FDA has extra requirements for electronic records as defined in Part 11, the reality is that FDA has similar expectations and regulations for paper-based documentation systems as well.

The burden of proof--whether paper or electronic--is clearly up to the company to demonstrate and prove records are generated, maintained, and approved by appropriate personnel.

Paper-based approaches may seem more straightforward and simpler to implement. You have procedures that define requirements and records needed. You generate the records and send around for applicable hand-written signatures. You store the records in a controlled location (i.e. file cabinet).

However, I’ve written plenty previously about the disadvantages of using a paper-based system.

Scanning of paper records

Often times, a company will implement a paper-based approach for initial records, including handwritten signature approvals and then employ a process to scan and store the records electronically.

Realize that if you take this approach, Part 11 may apply since you are converting paper records to electronic records.

General purpose cloud document storage systems

Another common approach today is to leverage use of “cloud” document storage systems to maintain documents and records. Of course cloud systems like Dropbox and Google Drive are very convenient and allow ease of use and access to documentation.

Realize that using these general purpose cloud document storage tools also means that Part 11 is likely to apply. Realize that ensuring Part 11 compliance with these general purpose tools may be very, very difficult, time consuming, and involve significant amount of testing.

Medical device specific cloud document storage systems

Part 11 compliance when it comes to eQMS solutions is a tricky thing. Unless you are educated and informed about what being Part 11 compliant truly means, there is a good chance you will be misled and misinformed by many of the software options available.

At Greenlight Guru, we only focus on the medical device industry. This means that everything about the Greenlight Guru software aligns with the regulations and requirements that affect and impact you--a medical device professional. Yes, this is also the case regarding Part 11 compliance. The entire Greenlight Guru platform has been rigorously designed, tested, and scrutinized to ensure you are in alignment with the true requirements of 21 CFR Part 11.

Since you’ve made it this far, I’m guessing you care and/or have questions about Part 11.

If you’d like to learn more about how Greenlight Guru can help your company get up and running with an electronic document storage system that will allow you to easily comply with part 11 while giving hundreds of hours back to your project team, click here to learn more.