Business Case Should Drive Part 11 Compliance Efforts, Experts Argue
Regardless of when, how or if the FDA ever strenuously enforces 21 CFR Part 11, regulated life sciences companies would be well-served to proactively approach compliance efforts with an eye on the business case, experts stress.
“Validation still makes good business sense and has predicate regulation requirements,” said Harry Huss, director of Compliance Policy at Charles River Laboratories, at the recent DIA conference in Philadelphia. “Protecting electronic records [also] makes good business sense and has predicate reg requirements.”
But any company waiting to be spurred by FDA enforcement of Part 11 is probably in for a long wait, experts told PIR.
“I don’t think we’ll see specific Part 11 enforcement” for a long time, Lisa Olson, principal compliance consultant, SEC Associates, told PIR June 28. That said, Olson pointed out that the agency has already enforced erecords policies perhaps without mentioning Part 11 by name.
She said FDA inspectors have much more leeway when they go after broad erecord issues. If they want to specifically cite Part 11, they have to go through FDA centers, get more people at the agency involved, and generally slow down and complicate the process. Many inspectors would prefer to address the issues without calling it Part 11, Olson said.
Part 11 Revision Coming?
Many FDA-regulated life sciences companies are in something of a holding pattern waiting for the agency to issue its revised Part 11 guidance. That’s been on tap for more than a year and the FDA has missed several self-imposed deadlines. However, sources in and around the agency indicate the delay probably has more to do with FDA personnel and budget issues than the number and depth of revisions.
The departure of FDA Acting Chief Information Officer Fred Farmer effective July 22 is just the latest public evidence that the FDA is struggling with some of its own ehealth initiatives, consultants and former FDA staff have told PIR.
But even without a Part 11 revision, the agency has shown in some warning letters and its Part 11 Scope and Application guidance that it remains interested in erecord integrity, Huss said.
The FDA’s Part 11 Scope and Application guidance notes, for example, that “Part 11 will be interpreted narrowly” while the agency will “exercise enforcement discretion” and enforce “predicate rule requirements.”
That narrower interpretation of Part 11’s scope means that regulated life sciences companies should still anticipate an FDA focus on erecords that are required by predicate rules. They should also expect a focus on those that are maintained in electronic format in place of paper and those maintained in eformat in addition to paper if they are relied on to perform regulated activities.
That interpretation means fewer records are subject to Part 11, Huss noted. When companies choose to use paper records in eformat in place of paper, Part 11 would apply. But if companies use computers to generate paper printouts and those same records meet predicate rules and the company relies on paper records, the use of computer systems in the generation of those paper records would not generally trigger Part 11, he added.
Focus on Predicate Rule
Bottom-line: From a regulatory standpoint, Part 11 compliance decisions should be based on predicate rule requirements and justified and documented risk assessments, Huss said.
However, even if there is no predicate rule component, it may still be important to validate the computer system to ensure the accuracy and reliability of the Part 11 records, FDA regulations state. It may also be necessary to have audit trails or other physical, logical or procedural security measures in place to ensure trustworthiness and reliability of the records.
Part 11’s validation requirements include validation of systems to ensure accuracy, reliability, consistent intended performance and the ability to discern invalid or altered records.
It is also important for regulated life sciences firms not to become fixated on Part 11 requirements and then fail to address related ones in areas such as Part 58, Huss noted. That rule states that equipment used in the generation, measurement or assessment of data and equipment used for facility environmental control should be of appropriate design and adequate capacity. Further, the equipment must be adequately tested, calibrated and/or stabilized.
And FDA’s Part 211 requires that “input to and output from the computer or related systems or formulas or other records or data…be checked for accuracy…with appropriate validation data.”
Part 820 adds that “design validation shall include software validation and risk analysis where appropriate,” Huss pointed out. — Michael Causey