Compliance with 21 CFR Part 11

Clinical Trials

What is 21 CFR Part 11?

The United States Code of Federal Regulations (CFR) includes regulations for electronic records and electronic signatures (21 CFR Part 11). This regulation ensures that electronic records and signatures are equivalent to and as trustworthy and reliable as paper records and handwritten signatures. The main aspects of this regulation are access controls, audit trails, and system validation.

To help interpret these regulations the FDA released a guidance that contains nonbinding recommendations on how to comply with the regulations in 21 CFR Part 11. The FDA also has a draft guidance that clarifies the implementation of 21 CFR Part 11 in medical product clinical investigations (IND/IDE). Although this second guidance is still under review and not yet implemented, it provides FDA’s current thinking on the application of this regulation in clinical investigations.

Does 21 CFR Part 11 apply to my clinical study?

This regulation applies to any electronic record or signature submitted to the FDA. The FDA defines electronic record as “any combination of text, graphics, data, audio, pictorial, or other information representation in digital form that is created, modified, maintained, archived, retrieved, or distributed by a computer system” (21 CFR 11.3(b)(6)).

Here are some examples of electronic records under 21 CFR Part 11:

This regulation does not apply to paper records and handwritten signatures transmitted electronically. For example, if you are scanning or faxing documents and storing hardcopies with no other digital modification, then 21 CFR Part 11 does not apply.

What are the electronic records requirements of 21 CFR Part 11?

The requirements of 21 CFR Part 11 focus on access controls, audit trails, and system validation. The following are the requirements for electronic records in closed systems (“an environment in which system access is controlled by persons who are responsible for the content of electronic records that are on the system”). If your company uses an open system (“an environment in which system access is not controlled by persons who are responsible for the content of electronic records that are on the system”), then additional documentation is necessary.

How can I comply with 21 CFR Part 11?

Many vendors who provide services that involve electronic records and signatures such as electronic data capture systems may have records documenting that their system meets the technical requirements of 21 CFR Part 11. However, validation must be completed in the context of user-specific processes. For example, popular electronic signature programs such as DocuSign and Adobe Acrobat provide “validation packages” of template documents that users can modify according to their internal procedures.

If you are already familiar with a certain system, you can perform a gap analysis and create your own validation documents.

Glossary:

Closed system – an environment in which system access is controlled by persons who are responsible for the content of electronic records that are on the system (21 CFR 11.3(b)(4))

Electronic record – any combination of text, graphics, data, audio, pictorial, or other information representation in digital form that is created, modified, maintained, archived, retrieved, or distributed by a computer system (21 CFR 11.3(b)(6))

Electronic signature – a computer data compilation of any symbol or series of symbols executed, adopted, or authorized by an individual to be the legally binding equivalent of the individual’s handwritten signature (21 CFR 11.3(b)(7))

Open system – an environment in which system access is not controlled by persons who are responsible for the content of electronic records that are on the system (21 CFR 11.3(b)(9))

Process validation – establishing by objective evidence that a process consistently produces a result or product meeting its predetermined specifications (21 CFR 820.3(z)(i))

Systems documentation – Such documentation should provide an overall description of computerized systems and the relationship of hardware, software, and physical environment… Measures should be in place to ensure that versions of software used to generate, collect, maintain, and transmit data are the versions that are stated in the systems documentation… readily available at the site where clinical trials are conducted. (FDA Guidance for Industry – Computerized Systems Used in Clinical Trials)

Validation – confirmation by examination and provision of objective evidence that the particular requirements for a specific intended use can be consistently fulfilled (21 CFR 820.3(z))

Verification – confirmation by examination and provision of objective evidence that specified requirements have been fulfilled (21 CFR 820.3(aa))

We offer a variety of clinical trial services and are a full-service CRO. We have over 40 years of experience designing and executing clinical trials, ranging from early feasibility studies to multinational, controlled pivotal trials to post-market registries.

Contact us today to start your project discussion. 855.463.1633 | askmed@medinstitute.com | medinstitute.com.