FDA Public Meeting on Electronic Records and Signatures June 11, 2004

1. FDA Public Meeting on Electronic Records and SignaturesJune 11, 2004 Presentation of the Industry Coalition on 21CFR Part 11 Alan Goldhammer, PhD Chair of the Coalition

2. Industry Coalition on 21 CFR Part 11 Advanced Medical Technology Association America’s Blood Centers Animal Health Institute Biotechnology Industry Organization Consumer Healthcare Products Association Cosmetic, Toiletry, and Fragrance Association Council for Responsible Nutrition Council on Radionuclides and Radiopharmaceuticals Generic Pharmaceutical Association Medical Device Manufacturers Association National Electrical Manufacturers Association National Food Processors Association National Grain and Feed Association Pharmaceutical Research and Manufacturers of America

3. Coalition Background • Formed in mid-2000 • Goal: Provide a Broad Industry Perspective on the Regulation to FDA • Actions: Provided Comments to FDA on a Variety of Issues including: • Scope • Validation • Time Stamps

4. Effect of the Regulation on Business Processes • It is intended toenable electronic submission – without paper copies, and review of components of marketing applications,and related documents • It is intended tofacilitate industry and FDA use of more efficient and effective business processes: e-Records and e-Signatures replace many paper-based processes. • It is intended toaid in avoiding mistakes and fraud, preserving and protecting electronic GxP records, and maintaining product quality and data integrity.

5. Effect of the Regulation (cont’d) • Leads to harmonization of e-Records and e-Signatures within and across agencies and the regulated industries • Has served as a general set of requirements to software vendors. • Has advanced awareness of this issue

6. Problems with the Regulation • Too Prescriptive in Terms of Technology • Difficult to Interpret • Uncertain Cost (> $2 billion estimated by the pharmaceutical industry)

7. Other Federal Approaches • Government Paperwork Elimination Act (GPEA), Pub. L. No. 105-277, §§1701-1710 (1998) • OMB Guidance on GPEA, agency considerations of cost, risk, and benefit, as well as any measures taken to minimize risks, should be commensurate with the level of sensitivity of the transaction • "Electronic Records and Signatures in Global and National Commerce Act" (E-SIGN) (Pub.L. 106-229, § 1 (2000)

8. LEGAL CONSIDERATIONS IN DESIGNING ANDIMPLEMENTING ELECTRONIC PROCESSES:A GUIDE FOR FEDERAL AGENCIES http://www.usdoj.gov/criminal/cybercrime/eprocess.htm

9. Where Should We Head?? In accordance with the OMB Guidance on GPEA, agency considerations of cost, risk, and benefit, as well as any measures taken to minimize risks, should be commensurate with the level of sensitivity of the transaction.  Low-risk information processes may need only minimal safeguards, while high-risk processes may need more.  In the context of legal and litigation risks, "low-risk information processes" are those that have a small chance of generating significant liability, financial impact, or litigation that would have a significant effect on the agency.

10. Some Industries Already Have Moved in this Direction • Foods – Hazard Analysis and Critical Control Point (HACCP http://www.cfsan.fda.gov/~lrd/bghaccp.html) • Medical Devices – Quality Systems ("Each manufacturer shall establish and maintain a quality system that is appropriate for the specific device(s) designed or manufactured, and that meets the requirements of this part." ) • Process Analytical Technology (PAT) – emerging standard for the pharmaceutical industry.

11. Risk/Benefit Driven Approach Apply control mechanisms for e-Records proportional to potential impact on public health. Use hierarchical approach to implementation for applications, data and reports, similar to SUPAC. Developbenefit-driven approach acceptable to FDA and regulated industries.

12. New Scope and Application - 2003 • More Realistic Risk Based Approach • Withdrawal of Compliance Policy Guide • Recognition of the Need to Search for Practical Solutions

13. Risk Based Approach in Part 11 Final Guidance • Current Part 11 Final Guidance emphasizes role of risk assessment for some Part 11 controls • validation • audit trails • record retention

14. Risk Based Approach in Part 11 Final Guidance • “We (FDA) recommend that you base your approach on a justified and documented risk assessment and a determination of the potential of the system to affect product quality and safety, and record integrity “ [Lines 207-209]

15. What is a Risk Based Approach to Part 11 • Don’t limit use of risk based approach. • Organizations should be allowed to apply their risk based approach to any area of electronic records • There are a multitude of risk-based approaches and tools • FDA should not specify any particular approach or tools to be used. • If a risk based approach is used then it should be defined and documented.

16. Key Issues with E-Records • Record Security • Authenticity • Authority/Accountability

17. E-Record Regulatory Paradigm • Build Upon Existing Predicate Regulations • Use Hardware, Software, & Best Business Practices • Reconsider the Need for the Current Part 11 Regulationfrom the practical and enforcement points of view and in light of the lessons learned to date.