1 / 46

Current Phase of the Part 11 Proposed Amendment Process

Current Phase of the Part 11 Proposed Amendment Process. George R. Smith Jr. FDA Consumer Safety Officer CDER, Office of Compliance 6/5/2007 . Disclaimer. The views presented do not necessarily reflect those of the Food and Drug Administration. Agenda. History of part 11

oshin
Download Presentation

Current Phase of the Part 11 Proposed Amendment Process

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Current Phase of the Part 11 Proposed Amendment Process George R. Smith Jr. FDA Consumer Safety Officer CDER, Office of Compliance 6/5/2007

  2. Disclaimer The views presented do not necessarily reflect those of the Food and Drug Administration

  3. Agenda • History of part 11 • Current approach and concerns • The amendment process and what remains • Summary/Key points

  4. History of part 11 21 CFR 11 (part 11) was Promulgated in August, 1997 • Allowed for electronic records and signatures • Required additional controls to computer systems that maintained electronic records – INCLUDING VALIDATION of COMPUTER SYSTEMS

  5. Accurate and complete copies of records Protection of records Limiting system access Operational system checks Authority checks Device checks Policies for accountability Systems documentation Integrity of electronic records Electronic signature controls Password controls Training History of part 11 Part 11 Controls

  6. History of part 11 Part 11 Issues • Broadly interpreted • Not risk based • Didn’t grandfather legacy systems

  7. History of part 11 • Broadly Interpreted: All automated systems running in an FDA regulated environment require Part 11 compliance, and therefore, Validation

  8. History of part 11 • Not Risk Based: All systems that require Part 11 compliance need to be fully validated

  9. History of part 11 • Didn’t Grandfather Part 11 Legacy Systems All automated systems that were operational prior to part 11must comply with part 11 and be fully validated

  10. History of part 11 21ST CENTURY cGMP INITIATIVE & PART 11 PHARMACEUTICAL CGMPS FOR THE 21ST CENTURY — A RISK-BASED APPROACH Department of Health and Human Services U.S Food and Drug Administration September 2002

  11. History of part 11 Objective: “Encourage implementation of risk-based approaches that focus both industry and Agency attention on critical areas” “Our primary focus will remain the same: to minimize the risks to the public health...”

  12. History of part 11 ‘Troublesome Areas’ of Part 11 to be Addressed as part of the Initiative. • Part 11 Lead Moved to CDER OC • Working Group with Representatives of All FDA Centers Formed • Decision made to generate new guidance prior to amending the regulation

  13. History of part 11 Part 11 Scope & Application Guidance • Draft - February 2003 • Final – August 2003 • All previous Part 11 guides withdrawn including CPG 7153.17 • Validation • Glossary of terms • Time stamps • Maintenance of electronic records • Electronic copies of electronic records

  14. History of part 11 • Using Enforcement Discretion FDA will Narrow the Scope of Part 11. Part 11 ONLY applies to: • electronic records required to be maintained to meet the requirements of, or essential to demonstrate compliance with, FDA Predicate Rules AND • electronic records submitted to the FDA

  15. History of part 11 Under the Narrow Scope: • The predicate rule identifies what records must be maintained • Part 11 addresses how those electronic records must be maintained

  16. History of part 11 Examples of Systems that Are Now Outside of the Scope of Part 11: • Systems used to generate paper printouts of electronic records when the paper records are used to meet all the requirements of applicable predicate rules • Systems that do not generate electronic records (e.g. Programmable Logic Controllers (PLCs))

  17. History of part 11 II. FDA Will Apply enforcement discretion for the following areas: • Validation • Audit trails • Copies of records • Record retention • All Part 11 requirements for legacy systems (pre 8/20/97)

  18. Current approach and concerns Validation “Establishing documented evidence which provides a high degree of assurance that a specific process will consistently produce a product meeting its predetermined specifications and quality attributes.” FDA’s ‘GLOSSARY OF COMPUTERIZED SYSTEM AND SOFTWARE DEVELOPMENT TERMINOLOGY’

  19. Current approach and concerns Software Validation Determination of the correctness of the final program or software produced from a development project with respect to the user needs and requirements. Validation is usually accomplished by verifying each stage of the software development life cycle. FDA’s ‘GLOSSARY OF COMPUTERIZED SYSTEM AND SOFTWARE DEVELOPMENT TERMINOLOGY’

  20. Current approach and concerns Software Validation is a component of CSV, not the whole effort!

  21. Current approach and concerns Where does it State that Computer Systems Require Validation in an FDA Environment?

  22. Current approach and concerns Computer System Validation (CSV) Requirements come from: • Predicate Rules And when predicate rules do not exist • 21 CFR 11 (Part 11)

  23. Current approach and concerns Predicate rules are: • Federal Food, Drug, and Cosmetic Act • Public Health Service Act • Any other statute FDA enforce • Any rules implementing those statutes

  24. Current approach and concerns GMP Predicate rule Requirement for Validation 21 CFR 211.68 (a) ‘Automatic, mechanical, or electronic equipment or other types of equipment, including computers, or related systems that will perform a function satisfactorily, may be used in the manufacture, processing, packing, and holding of a drug product. If such equipment is so used, it shall be routinely calibrated, inspected, or checked according to a written program designed to assure proper performance. Written records of those calibration checks and inspections shall be maintained

  25. Current approach and concerns Medical Device Predicate rule Requirement for Validation 21 CFR 820.70 (i): ‘When computers or automated data processing systems are used as part of production or the quality system, the manufacturer shall validate computer software for its intended use according to an established protocol. All software changes shall be validated before approval and issuance. These validation activities and results shall be documented

  26. Current approach and concerns Part 11 Requirement for Validation 21CDR 11.10(a) ‘Validation of systems to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records.’

  27. Current approach and concerns Typical High Level Computer System Validation (CSV) Phases • Design • Specifications • Development (software creation & testing) • Implementation (IQ, OQ, PQ, User Acceptance Testing) • Maintenance, Support, & Training (SOPs, change control, archival) • System Termination (retrieval of data, system dismantle)

  28. Current approach and concerns COTS Versus Internally Developed Systems • Design • Specifications • Development (software creation & testing) ======================================== • Implementation (IQ, OQ, PQ, User Acceptance Testing) • Maintenance, Support, & Training (SOPs, change control, archival) • System Termination (retrieval of data, system dismantle)

  29. Current approach and concerns Validation • Must satisfy predicate rule requirements • Base your validation approach on a justified and documented risk assessment, and a determination of the potential of the system to affect product quality and safety, and record integrity • When validation is not covered in specific predicate rules, a risk assessment should be performed to determine the level of validation that is required to ensure record integrity

  30. Current approach and concerns Legacy Systems FDA will apply enforcement discretion for all Part 11 controls for all Part 11 legacy systems IF: • System has been operational prior to 8/20/97 (Part 11 effective date) • System complied with existing predicate rules as of 8/20/97 • System complies with current predicate rule(s). • System has documented evidence and justification that it isfit for its intended use (validation)

  31. Current approach and concerns For Legacy Systems changed since August 20, 1997 you should determine if the changes introduce possible risks to record security and/or integrity and apply Part 11 controls appropriately as per the scope and application guidance

  32. Current approach and concerns Legacy Systems Changes that may invalidate Part 11 Legacy System status (Higher Risk Changes): • Change in intended use • Change in functionality • Changes in the use of collected data

  33. Current approach and concerns Legacy Systems Generally, the following types of changes will not effect Part 11 Legacy System Status (Lower Risk Changes): • Hardware maintenance actions such as upgrades or replacements • Some software maintenance actions such as upgrades to an operating system or DBMS (DOS to windows, ORACLE upgrade, … • Software maintenance to resolve originally intended use issues and functionality [software problem resolution] • Relocation or redistribution of a system

  34. Current approach and concerns Part 11 Controls • Identify electronic records that require controls • Access the risk to those records (Product Quality & Public Safety) • Implement the appropriate controls

  35. Current approach and concerns Part 11 Controls - Audit Trails • May not always be necessary • Satisfy predicate rules requirements (if required by predicate rules then they must be present) • When audit trails are not covered in specific predicate rules a risk assessment should be performed to determine whether they are needed to ensure record integrity based on product quality and safety, or if other appropriate controls should be put in place

  36. Current approach and concerns Audit Trail Examples Key Words (not limited to): ‘shall include complete…’ ’must be complete’ 211.194 (a) - Laboratory records shall include complete data derived from all tests necessary to assure compliance with established specifications and standards 812.145 (a) & (b) - Records must be Accurate & Complete

  37. Current approach and concerns Part 11 Controls - Electronic Signature Controls Needed when required by predicate rule AND they are maintained electronically

  38. Current approach and concerns Electronic Signature Examples Key Words (not limited to): ‘shall be signed’, ‘records shall include identification’ 211.186(a) – master production and control records for each drug product, including each batch size thereof, shall be prepared, dated, and signed (full signature, handwritten) by one person and independently checked, dated, and signed by a second person 211.188(b)(11) - records shall include: …Identification of the persons performing and directly supervising or checking each significant step in the operation

  39. Current approach and concerns Part 11 Controls - Copies of Records • Records can be migrated to other formats (paper, microfiche, …) with appropriate controls (verification, …) • Copying process should produce copies that preserve the content and meaning of the record • You must allow inspection, review and copying of records in a human readable form at your site using your hardware and following your established procedures and techniques for accessing records (PDF, XML, …)

  40. Current approach and concerns Part 11 Controls - Record Retention • Satisfy predicate rule requirements for record retention • Archived copies preserve the content and meaning of the original records • ‘True copies’ of electronic records may be archived in other formats (paper, microfiche, …)

  41. Current approach and concerns Retention Period Example Key Words (not limited to): ‘retention period’ 211.180 (b), and ( c) – Records shall be maintained for all components, drug product containers, closures and labeling for at least 1 year after the expiration date …

  42. The amendment process Federal Register (FR) Notice of Intention (NOI) to Amend Part 11 - April 8, 2004: • FR NOI to Amend Part 11 posted Comment Period was through July 9, 2004 • Review/analysis of comments for consideration in drafting the proposed amendment to the regulation

  43. The amendment process

  44. Summary/Key Points • Part 11 did not go away • Scope & Application guidance is still in effect, and will remain in effect until an amended Part 11 regulation is finalized (not just proposed) • Some level of validation is still necessary, but may be risk based • Once a final regulation is promulgated the Scope and Application Guidance will no longer be needed and that guidance will be withdrawn • Citations may be made to the Predicate Rule, not specifically to Part 11 (e.g. Validation)

  45. Information Sources General Principles of Software Validation; Final Guidance for Industry and FDA Staff: http://www.fda.gov/cdrh/comp/guidance/938.html Guideline on General Principles of process Validation http://www.fda.gov/cdrh/ode/425.pdf Glossary of Computerized System and Software Development Terminology http://www.fda.gov/ora/inspect_ref/igs/gloss.html Computerized Systems Used in Clinical Investigations – Draft http://www.fda.gov/cder/guidance/6032dft.htm

  46. Questions? George.Smith@FDA.HHS.Gov OR Part11@CDER.FDA.GOV

More Related