FDA Issues Draft Guidance On Electronic Records

By Ed Miseta, Chief Editor, Clinical Leader

The FDA has issued draft guidance for industry titled, “Use of Electronic Records and Electronic Signatures in Clinical Investigations Under 21 CFR Part 11 – Questions and Answers.” The draft guidance provides information to sponsors, IRBs, clinical investigators, and CROs on the use of electronic records and signatures in trials. The guidance, released in June 2017, expands upon recommendations issued in August 2003 by the FDA.

In 2003, FDA’s approach was to provide a practical interpretation of Part 11 requirements. In the new guidance, FDA continues to promote a narrow and practical interpretation while reminding sponsors that records must still be maintained or submitted in accordance with underlying predicate rules. FDA can take regulatory action for non-compliance with those predicate rules. Additionally, FDA is continuing to encourage sponsors to use a risk-based approach when deciding to validate electronic systems, implement audit trails, or archive required records for clinical investigations.

Below is a summary of some of the key questions and answers presented in the guidance:

What should sponsors consider when using a risk-based approach for validation of electronic systems?

Consistent with the policy announced in the 2003 Part 11 guidance, FDA believes sponsors should use a risk-based approach for validating electronic systems owned or managed by sponsors. Validation is critical to ensuring an electronic system is correctly performing its intended function. That validation may include demonstrating correct installation of the system and testing to ensure it functions in the manner intended.  

When using a risk-based approach to evaluate electronic systems, FDA recommends sponsors consider the following:

• The purpose and significance of the record, as well as the extent of error that can be tolerated without compromising the reliability of the record.
• The attributes and intended use of the electronic system used to produce the record. Systems should be validated if they process critical records submitted to FDA. The extent of validation should be tailored to the nature of the system and its intended use.
• Validation for commercial off-the-shelf (COTS) office utilities software such as word processing, spreedsheets, and PDF tools, the extent of validation should be guided by the organization’s business practices and needs.
• For COTS systems that perform functions beyond office utilities, such as EDC systems, validation should include a description of standard operating procedures and documentation from the vendor.
• For COTS systems that are integrated with other systems or for customized systems,  sponsors should develop and document a validation plan, conduct the validation in accordance with the plan, and document the results. The documentation may be reviewed during an FDA inspection.

What will be FDA’s focus during inspections of electronic systems?

For electronic systems that fall under the scope of Part 11, an FDA inspection will focus on the implementation of the electronic system, including changes made to the system once in use and documentation of validation to test system functionality after implementation. During the inspection, FDA will focus on any source data that are transferred to another data format or system to ensure that checks are in place and that critical data are not altered in value or meaning during. FDA will also review standard operating procedures and support mechanisms in place, such as training, technical support, and auditing to ensure that the system is functioning and is being used in the manner intended.

Should sponsors perform audits of the vendor’s electronic systems and product?

To reduce the time and cost burden, sponsors should consider periodic but shared audits conducted by trusted third parties. The decision to perform vendor audits should be based on a risk-based approach.

What are FDA’s expectations regarding the use of internal and external security safeguards?

Sponsors must ensure that procedures and processes are in place to safeguard the authenticity, integrity, and confidentiality of electronic records. Logical and physical access controls must be employed for electronic systems that are used in clinical investigations, particularly for systems that provide access to multiple users or that reside on networks. 

Under what circumstances are Part 11 requirements not applicable for electronic copies of paper records?

Part 11 requirements are not intended to apply to electronic systems that are merely incidental to creating paper records that are subsequently maintained in traditional paper-based systems.

Can sponsors and other regulated entities use and retain electronic copies of source documents in place of the original paper source documents?

Yes. FDA permits the interchangeable use of electronic records and paper records for the archiving and protection of records provided that recordkeeping and retention requirements are met.

Can electronic copies be used as accurate reproductions of electronic records?

Yes.  True copies of electronic records may be made and maintained in the format of the original records or in a compatible format if the content and meaning of the original records are preserved and if

a suitable reader and copying equipment are readily available.

Can sponsors and other regulated entities use durable electronic storage devices to archive required records from a clinical investigation?

Yes. Using an electronic means, such as a durable electronic storage device, is an acceptable method to archive study-related record at the end of the study.  Sponsors and other regulated entities should ensure the integrity of the original data and the content and meaning of the record are preserved. 

If the electronic records are archived in such a way that the records can be searched, sorted, or analyzed, sponsors should provide electronic copies with the same capability to FDA during inspection if it is reasonable and technically feasible.

Does FDA provide preliminary audit service to inspect an electronic system used in a clinical investigation to ensure compliance with Part 11 controls?

No.

If a site outside the U.S. is conducting a clinical investigation, are records required by FDA regulations subject to Part 11 requirements?

If a non-U.S. site is conducting a clinical investigation under an investigational new drug application (IND), the clinical investigator and the sponsor must follow FDA regulations, including Part 11.  If required records are kept in electronic format, Part 11 requirements will apply. 

Additional questions and answers on topics relating to 21 CFR Part 11 can be seen in the draft guidance.

The FDA welcomes industry comments on the draft guidance and will consider those comments when it begins work on the final version of the guidance. Comments should be submitted at www.Regulations.gov by August 21, 2017.