Electronic Records Management Practices and Part 11Tamar M. June

Pharmaceutical firms have every reason to feel confused and even a bit bewildered by what the US Food and Drug Administration expects from them when it comes to controlling electronic records. At times over the past nine years it has been a bit like riding a roller coaster that you weren't allowed to get off.

Figure 1: In a survey of 350 individuals involved in records management, only 5% of respondents indicated they were "very confident" in their electronic records management system, while an overwhelming 38% responded they were "not at all confident" (1). (Source: Cohasset Associates)

Since it was unveiled in 1997, the 21 CFR Part 11 rule has been consistently controversial. Unfortunately, the agency's expectations—whether officially stated in guidances or more informally explained at industry gatherings—have not always been so consistent. In 1997, FDA used a heavy-handed approach to electronic records that it now admits actually slowed the adoption of the very technologies the agency wanted to promote.

But that was then and this is now. Today, FDA is taking a "kinder, gentler" approach to electronic records management. In effect, the agency is advising firms to develop any method that makes sense as long as the electronic records are accurate and have integrity. That's a better, real-world approach for industry, but it also shifts the responsibility for compliance squarely to the shoulders of the companies themselves.

Most current and former FDA inspectors agree that it is up to pharmaceutical companies to develop and implement a program that passes the "smell test." As one former inspector explained it, imagine that an FDA inspector is touring your site. Are you able to retrieve quickly and efficiently any records the inspector seeks? Can you describe how and why you discard some records, why you save others, and for how long? Can you produce records that demonstrate your employees have been trained on these procedures? In other words, if you can show an FDA inspector a well-conceived and well-executed records management program with effective Part 11 controls, you'll most likely be fine. Even if the FDA inspector disagrees with aspects of your approach, the inspector will be far more likely to work with you in a cooperative fashion if you show that you have made a good faith effort to comply with the rules.

The future is now

In 2005, any pharmaceutical firm that delays controlling its electronic records risks much more than regulatory ire. By dodging Part 11 compliance, firms in today's competitive marketplace risk being exposed to increasing legal problems and being left behind by more nimble, aggressive companies that are harnessing new technologies and best practices to make their data safer even as the data works harder and faster for them. For example, innovative firms already are using electronic data capture technology to speed drug testing and clinical trials. It isn't much of a stretch to see how such methods will get product to market faster and improve the bottom line.

Frankly, it's no longer a question of waiting for FDA to enforce Part 11 and electronic record requirements. Companies should ask themselves, How valuable is the data to advancing the bottom line? and, What would happen if the data were abused?

Ultimately, too many pharmaceutical firms are missing tremendous opportunities to streamline their operations, increase efficiencies, and position themselves for increased market success.

Consultants out in the field, including many former FDA officials, say that many of their clients remain stubbornly on the fence about how to control their electronic records. Because FDA arguably overreacted in 1997 with stringent Part 11 requirements, only to significantly back off in 2003, many pharmaceutical firms are making the mistake of thinking that FDA doesn't care that much about record integrity anymore and neither should they.

That's wrong on both counts.

Even if FDA continues its hands off enforcement of Part 11—in the past year and a half just one warning letter centered on Part 11—the agency is unlikely to lose interest in how well firms handle electronic records. If drug recalls continue to appear in the headlines, FDA will be under pressure to be tougher in its scrutiny of drug firms. It is common sense that as the public and politicians call for safer drugs, regulators and others will increase demands for electronic records that are accurate and protected. Think back again to that FDA inspector walking around your facility. If the prospect makes your guts churn, maybe your record retention program is not what it should be.

If that's not incentive enough, looming legal realities also should encourage companies to devote more time and attention to developing best practices and identifying the best tools for electronic record control. Put simply, the bar is getting higher every day when it comes to data security and the privacy of records. A company that stumbles badly over that bar could see a big lawsuit in its future.

When to let go?

Unfortunately, many pharmaceutical firms overreact to Part 11 record requirements, thinking they will be safe if they keep everything.

Pharmaceutical companies know that many effective tools, technologies, and tactics are available to help them retain and manage records. Unfortunately, too many firms become trapped by their own processes or technology, and save far too many records because it makes them feel safer. Unfortunately, by keeping everything, they are probably exposing themselves to greater risk because among other problems, they won't be able to find and obtain records when they need them.

As noted previously, FDA's sometimes inconsistent statements about its Part 11 expectations have not made matters any easier for firms struggling to comply. Further complicating the issue is the simple fact that FDA inspectors are human, and they can get impatient if they are kept waiting for records during an inspection or visit. And although the agency has relaxed its Part 11 electronic record retention demands, industry has sometimes struggled to interpret FDA's new expectations.

In fact, some firms are balking at accepting the responsibility. As one industry consultant commented, "Many of my clients are still waiting for the FDA to tell them what to do instead of seizing this opportunity to set their own smart policy for electronic record retention."

Firms that have a clear record retention policy backed with tools and technologies to implement and even enhance that policy, are happy to seize the initiative on record retention. But for other firms, it becomes such a daunting task that they default to trying to keep all their records by archiving them. "That's a huge and all-too-common mistake," says one consultant.

The truth is out there

Instead of archiving absolutely every electronic record, firms struggling to comply with FDA's electronic recordkeeping regulations should take a deep breath, followed by a long, careful look at FDA's good manufacturing practice (GMP) and Part 11 rules. A careful reading of the admittedly long and sometimes dry rules will show that the agency is, in fact, quite clear about what it expects from firms regarding what types of electronic records to maintain and for how long.

In fact, the regulations are specific in helpful ways, notes Keith Benze, a consultant and compliance expert with SEC Associates and a coauthor of "The 'New' Part 11 and Drug Development: A Q&A Reference Guide." The good news is that FDA focuses on maintaining records for a certain period of time after an event. For example, for drug products, most records must be kept for one year past the expiration of the product. That's pretty clear, right?

In other cases, that period is usually a year or two after an event such as the last distribution of the product or approval of the investigational new drug application (even if the drug is never launched), which can require keeping the record for much longer than two years. For example, Part 11's section 820.140 states, "All records required by this part shall be retained for a period of time equivalent to the design and expected life of the device, but in no case less than 2 years from the date of release for commercial distribution by the manufacturer." (2)

Many consultants and software experts agree that firms can operate more efficiently, speed delivery of their products to market, and be more responsive to inspectors if they have a clear plan for record retention. In addition, the right software can make it easy to prioritize records and set up parameters that automatically keep what's necessary and remove the excess.

Upon closer examination of the FDA's kinder, gentler Part 11 requirements, it becomes clear that the agency has eased the burden on industry in many important ways. For example, in a discussion of the August 2003 Part 11 Scope and Application guidance, David Horowitz, Office of Compliance Director at FDA's Center for Drug Evaluation and Research, specifically cited record retention as an area in which FDA does not "intend to devote enforcement resources." (3)

That means firms have greater flexibility when it comes to converting electronic records into other forms to meet retention requirements—as long as they satisfy the underlying predicate rules, Benze points out. If the record is not required by predicate rules, there are no restrictions on how it can be archived.

But for records that must be retained under predicate rules, the Part 11 "Scope and Application" guidance spells it out:

"FDA does not intend to object if you decide to archive required records in electronic format to nonelectronic media such as microfilm, microfiche, and paper, or to a standard electronic file format (examples of such formats include, but are not limited to, PDF, XML, or SGML). Persons must still comply with all predicate rule requirements, and the records themselves and any copies of the requirements should preserve their content and meaning." (4)

But it's not always easy to determine which records fall under the predicate rules. If you don't understand clearly what the predicate rules are or how to determine whether a given record falls under the jurisdiction of the predicate rules, documents available on the agency's Web site can help (5).

In case of disaster...

Another important consideration for any record retention policy is disaster recovery. Valuable records must be protected against power interruptions or other natural disasters such as flooding. That's not just an FDA requirement, it's plain old good business sense. "Disaster-recovery planning comprises a key component of record protection," notes Benze in his Part 11 reference guide. A disaster recovery plan should require the off-site storage of backup data even if local backups are maintained.

Benze also recommends considering another disaster-related scenario: data availability disruption. For example, a clinical trial sponsor may maintain a server with information related to patient randomization. In the event of a medical emergency involving a subject enrolled in the trial, the clinical investigator or medical monitor can call into an interactive voice system to learn whether the patient received a placebo or the actual drug. Losing such data, even temporarily, puts many people at risk. A disaster-recovery plan should have procedures in place for ensuring that Part 11 and predicate record requirements are met while the disaster recovery plan is in use. Those plans also should be tested and updated regularly.

You have the power

The good news is that pharmaceutical firms have control of their destinies. By leveraging best practices and outstanding technologies on the market today, they can effectively develop and implement electronic record and Part 11 compliant programs that will impress FDA regulators, speed their products to market, protect customers, and boost the bottom line.

Tamar M. June is vice-president of strategic marketing at AssurX, Inc., 305 Vineyard Town Center, Suite 374, Morgan Hill, CA 95037, tel. 408.778.1376, ext. 705, tamar@assurx.com.

References

1. R.F. Williams, "Realizing the Need and Putting the Key Components in Place to 'Getting in Right' in Records Management," Cohasset Associates, Inc. Chicago, IL, 2002 (posted at www.cohasset.com).

2. Code of Federal Regulations, Title 21, Food and Drugs (General Services Administration, Washington, DC, 1997), Part 11, section 820.140.

3. J.C. McKenney, L.A. Olsen, and K.C. Benze, "The 'New' Part 11 and Drug Development: A Q&A Reference Guide," SEC Associates, Morrisville, NC, March 2004 (posted at www.barnettinternational.com).

4. Food and Drug Administration, Guidance for Industry, Part 11, Electronic Records; Electronic Signatures—Scope and Application (FDA, Rockville, MD, 2003).

5. See documents posted at www.fda.gov/ora/compliance_ref/part11.