Transcript 21 CFR Part 11 Electronic Records & Electronic Signatures

21 CFR Part 11
Electronic Records & Electronic
Signatures
Svend Martin Fransen
Principal Scientist,
QS CRS Quality Services
Novo Nordisk A/S
Contents
•
•
•
•
21CFR11 history
The important aspects of 21CFR11
Equivalent requirements in EU legislation
The Novo Nordisk 21 CFR11 compliance
project
• Examples
• Experiences learned
Slide No. 2 • QS CRS Quality Services / Svend Martin Fransen • 03.Oct.2002
Contents
•
•
•
•
21CFR11 history
The important aspects of 21CFR11
Equivalent requirements in EU legislation
The Novo Nordisk 21 CFR11 compliance
project
• Examples
• Experiences learned
Slide No. 3 • QS CRS Quality Services / Svend Martin Fransen • 03.Oct.2002
Why do we have computers?
It has gradually become common knowledge that knowledge is the most important
resource in the business of the future.
It is the ability to create new knowledge and the ability to utilize and organize
existing knowledge that will be the primary source for obtaining lasting competitive
advantages.
Peter Holdt Christensen: ”Viden om” – ledelse, viden og virksomheden
Slide No. 4 • QS CRS Quality Services / Svend Martin Fransen • 03.Oct.2002
What is 21CFR11?
•
•
•
•
•
•
•
•
•
•
21CFR
= FDA, Code of Federal Regulations
21CFR58
= GLP
21CFR210 = GMP, Drugs (General)
21CFR211 = GMP, Drugs (Finished Pharmaceuticals)
21CFR312 = Inv. New drug Application (GCP)
21CFR314 = FDA Approval of new drug (GCP)
21CFR6xx = GMP, biologics
21CFR820 = GMP, Devices
21CFR…… = Food, nutrients and cosmetics
21CFR11
= Electronic Records; Electronic Signatures
Slide No. 5 • QS CRS Quality Services / Svend Martin Fransen • 03.Oct.2002
Historic overview
• A wish from the Industry (use of ES)
• FDA:
• Final Draft i 1994
• Final Rule 20.March.1997, effective from 20.Aug.1997
• 4 draft guidelines, ’Glossary of Terms’, ’Validation’, ’Time
stamps’ and ’Maintenance of ER’
• GAMP Part 11 guide, published Nov. 2001 (part 2)
• PDA ”GERM” guide, published Sep. 2002 (part 1)
• PDA ”GERM” guide ’Models’, expected 2003 (part 3)
Slide No. 6 • QS CRS Quality Services / Svend Martin Fransen • 03.Oct.2002
Contents
•
•
•
•
21CFR11 history
The important aspects of 21CFR11
Equivalent requirements in EU legislation
The Novo Nordisk 21 CFR11 compliance
project
• Examples
• Experiences learned
Slide No. 7 • QS CRS Quality Services / Svend Martin Fransen • 03.Oct.2002
21CFR11, Overview
• Substantive rule from 20 August 1997
• Applies to any e-record in any FDA regulated
work including legacy systems
• Criteria for e-records and e-signatures:
• Trustworthy and reliable
• E-signatures = hand-written signatures
• Minimum requirements / fraud prevention
Slide No. 8 • QS CRS Quality Services / Svend Martin Fransen • 03.Oct.2002
Systems not Applications
• All definitions and clauses in
Application
-software
Platform
- hardware
- system SW
Computer system
Instructions,
Manuals, etc.
Equipment
Controlled function
Computer based system
Working environment
COMPUTER RELATED SYSTEM
Slide No. 9 • QS CRS Quality Services / Svend Martin Fransen • 03.Oct.2002
21 CFR 11 refer to systems
• Application is not mentioned
• IT part of the GXP
environment.
• Do they know?
21 CFR Part 11, Basics
• Electronic records equivalent with paper records
• Storage, retrieval and copying in full retention period
• Submitting to FDA
• Protection of electronic records
• Security (physical and logical)
• Validation
• Audit trail (who did what, when including reason where req.)
• Permission to use of electronic signature
•
•
•
•
Equivalent with handwritten signatures
Name, date and meaning
Linking of signature to record
Unique for an individual
Slide No. 10 • QS CRS Quality Services / Svend Martin Fransen • 03.Oct.2002
ORA, Compliance Policy Guide
CPG 7153.17 (May 1999)
• Acknowledging ‘not all older systems fully
compliant by Aug 20, 1997’
• ‘firms must take steps to achieve full compliance’
• ‘Regulatory actions based on case by case evaluation’
• ‘FDA auditors should intensify their scrutiny of e-recs’
• Calls for firms to
•
•
•
•
have a ‘reasonable timetable’
‘promptly modify’ any system not in compliance
‘be able to demonstrate progress’
‘have procedural controls in place by now’
Slide No. 11 • QS CRS Quality Services / Svend Martin Fransen • 03.Oct.2002
FDA 21CFR11 inspection questions
(source: : 21CFR11 Compliance Report, Vol.2, No. 4).
•
•
•
•
•
•
•
•
•
Who is allowed to input data?
Who is allowed to change data?
How can you tell who entered the data?
How do you know which data had been changed?
When do you lock down the data input?
Can you do the following actions?
“Show me some data, show me you can see the history of the data,
show me you control the data life cycle.”
Is the system validated and are the requirements met?
Can you show me the results of the validation activities?
Does the validation include: “Pass/fail, signature, date/time stamp”;
and “objective evidence - screen prints or page printouts with a link
to the direction that generated the output.”?
Slide No. 12 • QS CRS Quality Services / Svend Martin Fransen • 03.Oct.2002
Earlham College, Warning Letter
• In addition to the above listed violations, our Investigator
noted that the laboratory is using an electronic record
system for processing and storage of data from the
atomic absorption and HPLC instruments that is
• not set up to control the security and data integrity in that the
system is not password controlled,
• there is no systematic back-up provision, and
• there is no audit trail of the system capabilities.
• The system does not appear to be designed and controlled in
compliance with the requirements of 21 CFR, Part 11,
Electronic Records.
Slide No. 13 • QS CRS Quality Services / Svend Martin Fransen • 03.Oct.2002
Contents
•
•
•
•
21CFR11 history
The important aspects of 21CFR11
Equivalent requirements in EU legislation
The Novo Nordisk 21 CFR11 compliance
project
• Examples
• Experiences learned
Slide No. 14 • QS CRS Quality Services / Svend Martin Fransen • 03.Oct.2002
EU
• Annex 11, Computerised Systems
• Personnel
• Validation
• System
•
•
•
•
•
•
Descriptions and SOP’s
Change control and configuration management
Records; entry, storage, retrieval
Audit trail
Security and Disaster recovery
etc.
Slide No. 15 • QS CRS Quality Services / Svend Martin Fransen • 03.Oct.2002
PIC/S Draft Guidance
Good Practices for Computerised Systems in
regulated ”GXP” environment
• Computer System Life cycle, incl.
• Electronic Records and Signatures
• Security, and
• Audit trail
• Checklists for Inspection
• Links ISO and IEEE standards, 21CFR11, APV guides,
PDA Technical Reports together
Slide No. 16 • QS CRS Quality Services / Svend Martin Fransen • 03.Oct.2002
Quote from PIC/S Guide
21. ELECTRONIC RECORDS AND ELECTRONIC SIGNATURES
• 21.1 EC Directive 91/356 sets out the legal requirements for EU
GMP. The GMP obligations include a requirement to maintain a
system of documentation, (Article 9). The main requirements in
Article 9.1 are that documents are clear, legible and up to date, that
the system of documentation makes it possible to trace the history
of manufacture (and testing) of each batch and that the records are
retained for the required time. Article 9.2 envisages that this
documentation may be electronic, photographic or in the form of
another data processing system, rather than written. The main
requirements here being that the regulated user has validated the
system by proving that the system is able to store the data for the
required time, that the data is made readily available in legible form
and that the data is protected against loss or damage.
Slide No. 17 • QS CRS Quality Services / Svend Martin Fransen • 03.Oct.2002
Draft Proposal for a Commission Directive
(30.Apr.2002)
• Amending Commission Directive 91/356/EEC , Laying Down the
•
Principles and Guidelines of Good Manufacturing Practice for
Medicinal Products for Human Use
"When electronic, photographic or other data processing systems
are used instead of written documents, the manufacturer or
importer shall have validated the systems by proving that the data
will be appropriately stored during the anticipated period of storage.
Data stored by these systems shall be made readily available in
legible form and shall be provided on demand to the competent
authorities. For an investigational medicinal product when
electronic, photographic or other data processing systems are used
instead of written documents the manufacturer or importer shall
have validated the systems to maintain the data during the required
period of storage. Data stored by these systems shall be readily
available in legible form and shall be provided on demand to the
competent authorities."
Slide No. 18 • QS CRS Quality Services / Svend Martin Fransen • 03.Oct.2002
Contents
•
•
•
•
21CFR11 history
The important aspects of 21CFR11
Equivalent requirements in EU legislation
The Novo Nordisk 21 CFR11 compliance
project
• Examples
• Experiences learned
Slide No. 19 • QS CRS Quality Services / Svend Martin Fransen • 03.Oct.2002
21CFR11 Compliance Project
• Purpose
• Assist the units/system owners to prioritise the
activities necessary to get in compliance over a
limited period of time.
• Scope
• All Computer Systems within Novo Nordisk that
• generate electronic records covered by regulatory
•
requirements from FDA,
including the systems that utilise Electronic
Signatures
Slide No. 20 • QS CRS Quality Services / Svend Martin Fransen • 03.Oct.2002
Overview of the 21CFR11 compliance project
Development
Product
Supply
Staffs,
Quality, RA
and other
21CFR11 project
No. of systems today = 868 (PS) + 219 (Dev.) + 65 (others) = 1152 systems
(..and more to come)
Slide No. 21 • QS CRS Quality Services / Svend Martin Fransen • 03.Oct.2002
21CFR11 Compliance Project
• Tasks
•
•
•
•
•
Secure cGxP for 21CFR11 at Novo Nordisk
Maintain corporate policy and interpretations
Responsible for project QAP reporting
Participate in external groups as NN representatives
Distribute knowledge to organisation through
• Training (short courses and Site specific)
• Knowledge and guidance database
• Project web page
• Guidelines
Slide No. 22 • QS CRS Quality Services / Svend Martin Fransen • 03.Oct.2002
Guidance database -web-enabled
Slide No. 23 • QS CRS Quality Services / Svend Martin Fransen • 03.Oct.2002
Activities in relation to Part 11
1.
2.
3.
4.
5.
6.
Identify and register systems (overview)
Prioritise systems
Evaluate ”high-risk” systems
Evaluate ”medium- and low-risk” systems
Evaluate corrections/solutions
Prepare implementation plan
•
•
”Quick fixes”
”Full compliance, technical and procedural
7. Implement solutions
Slide No. 24 • QS CRS Quality Services / Svend Martin Fransen • 03.Oct.2002
Prioritisation of systems
Regulatory Risk
• GxP, support systems (20)
Medium risk
High risk
• Other GxP critical, systems (11)
Y
Low risk
Medium risk
• Non-GxP systems (17)
X
Factor, based on: No. of records generated by the system,
no. of users, frequency of use and system complexity
Slide No. 25 • QS CRS Quality Services / Svend Martin Fransen • 03.Oct.2002
Gradual achievement of compliance
120
100
80
20
60
20
40
20
20
Phase
1
50
40
Interim solutions
Phase
2
Technology
Procedures
60
20
0
Initial State
State 2
State 3
Phase 1: Implement Site and system procedures
Phase 2: Technology based solutions, etc.
Slide No. 26 • QS CRS Quality Services / Svend Martin Fransen • 03.Oct.2002
Deliverables from common workgroups
• Evaluation of the system (gap-analysis) for technical
issues
• Evaluation of possible solutions
• Recommendations and other input from supplier(s)
• Recommended solutions, including
•
•
•
•
Draft or example of procedures
Description of technical solution
Estimated costs
Suggested implementation plan
Slide No. 27 • QS CRS Quality Services / Svend Martin Fransen • 03.Oct.2002
Progress Follow Up
Site
A
B
C
D
E
F
G
H
I
J
K
L
= On track
System registration QA
approved
System evaluation on
track
Implementation plan
preparation on track
LL
LL
J
J
J
J
J
J
J
J
LL
LL
K
J
J
J
K
K
LL
J
J
K
J
J
L
J
J
K
LLL
K
L
J
J
K
K
J
= Ensure no further delay
Slide No. 28 • QS CRS Quality Services / Svend Martin Fransen • 03.Oct.2002
= Take action to catch up
Examples of Pilot projects in production area
•
•
•
•
•
•
•
•
Kaye Validator
SCADA (Fix32)
Filter testing equipment (PALL)
Instron (replacement for..)
PE laboratory equipment (UV/VIS + ..) incl. replacements for..)
Usifroid freeze dryer
BMS (building monitoring systems)
...more to come (due to standardisation)
Slide No. 29 • QS CRS Quality Services / Svend Martin Fransen • 03.Oct.2002
Contents
•
•
•
•
21CFR11 history
The important aspects of 21CFR11
Equivalent requirements in EU legislation
The Novo Nordisk 21 CFR11 compliance
project
• Examples
• Experiences learned
Slide No. 30 • QS CRS Quality Services / Svend Martin Fransen • 03.Oct.2002
What can go wrong, will ...
• HPCE (High Pressure Capillary Electrophoresis)
Scenario: Replacement of chromatography software to Millennium and setting
up an archive installation
• 7 year old software
• HW requirements to PC
• Migration of ER from OS/2 to Win NT
• Indexation of migrated data
• ER on tape stored in safe
• Use of archive installation
• Training of users
• SOPs
Slide No. 31 • QS CRS Quality Services / Svend Martin Fransen • 03.Oct.2002
Example for remediation
A hardware solution:
•
•
Control power supply to individual physical
entities in a PC including keyboard and
mouse
Solution is OS independent
User access is controlled via Smart card:
•
•
Further information: http://www.zignx.dk/
Slide No. 32 • QS CRS Quality Services / Svend Martin Fransen • 03.Oct.2002
User profiles supported by pin code on the
ZignX keyboard.
Logging of access attempts
Contents
•
•
•
•
21CFR11 history
The important aspects of 21CFR11
Equivalent requirements in EU legislation
The Novo Nordisk 21 CFR11 compliance
project
• Examples
• Experiences learned
Slide No. 33 • QS CRS Quality Services / Svend Martin Fransen • 03.Oct.2002
Conclusions
•
•
•
•
•
•
•
Management commitment pivotal
Expensive and complex
Requires highly skilled project management
Risk-based prioritisation
FDA enforcement becomes tougher
and EU is on it’s way (DRAFT PIC/S Guidance)
Just do it..!
Slide No. 34 • QS CRS Quality Services / Svend Martin Fransen • 03.Oct.2002
Problem areas
• Lack of knowledge in the organisation on
• Computer Validation
• 21 CFR Part 11
• Maintenance of computer systems
• Purchase of non-compliant systems are ongoing
• ”Part 11 compliant systems” do not exist
• Administrative controls (= Company policies)
• Procedural controls (= Company SOP’s)
• Technical controls (= Supplier SW controls)
Slide No. 35 • QS CRS Quality Services / Svend Martin Fransen • 03.Oct.2002