View source for 21 CFR Part 11

The '''Title 21 Code of Federal Regulations Part 11''' ('''21 CFR Part 11''') provides [[Regulatory compliance|compliance]] [[information]] regarding the U.S. Food and Drug Administration's (FDA) guidelines on electronic records and [[Electronic signatures|electronic signatures]]. Within this part, requirements are created to help ensure security, integrity, and confidentially of electronic records and to ensure electronic signatures are as legally binding as hand-written signatures.<ref name="21CFR11@ecfr">{{cite web |url=https://www.ecfr.gov/current/title-21/part-11 |title=Electronic Code of Federal Regulations - Title 21: Food and Drugs - Part 11: Electronic Records; Electronic Signatures |publisher=U.S. Government Printing Office |date=13 April 2020 |accessdate=07 January 2022}}</ref>

Practically speaking, Part 11 requires drug makers, medical device manufacturers, biotech and biologics companies, contract research organizations, and other FDA-regulated industries, with some specific exceptions, to implement controls, including audits, system validations, audit trails, electronic signatures, and documentation for closed and open software and systems involved in processing specific electronic data. This primarily includes data to be maintained by the FDA predicate rules and data used to demonstrate compliance to a predicate rule. (A predicate rule is any requirement set forth in the Federal Food, Drug and Cosmetic Act, the Public Health Service Act, or any FDA regulation other than Part 11.<ref name="RegInfo_Part11_FDA">{{cite web |url=https://www.fda.gov/regulatory-information/search-fda-guidance-documents/part-11-electronic-records-electronic-signatures-scope-and-application |title=Part 11, Electronic Records; Electronic Signatures — Scope and Application |publisher=U.S. Food and Drug Administration |date=August 2003 |accessdate=15 April 2020}}</ref>) The rule also applies to submissions made to the FDA in electronic format, but not to paper submissions by electronic methods, though paper submissions may eventually be prohibited by the FDA.<ref name="Tut21CFR11">{{cite web |url=http://www.labcompliance.com/tutorial/part11/ |archiveurl=https://web.archive.org/web/20180103191244/http://www.labcompliance.com/tutorial/part11/ |title=Tutorial: 21 CFR Part 11 - Electronic Records and Electronic Signatures |author=Huber, L. |publisher=LabCompliance |date=15 November 2012 |archivedate=03 January 2020 |accessdate=15 April 2020}}</ref>

==History==

By the early 1990s, food and drug manufacturers approached the U.S. Food and Drug Administration (FDA) about the possibility of electronic submissions with electronic signatures. However, at that time the government did not allow for digital signatures. In July 1992, the FDA began soliciting comments about the process of using electronic signatures.<ref name="GCN00Art">{{cite web |url=https://gcn.com/2000/06/fda-offers-electronic-option/276201/ |title=FDA offers electronic option |author=Jackson, W. |publisher=GCN |date=01 June 2000 |accessdate=07 January 2022}}</ref>

In March 1997, the FDA issued Part 11 regulations which, in the words of the FDA, were "intended to permit the widest possible use of electronic technology, compatible with FDA's responsibility to protect the [[Public health informatics|public health]]."<ref name="RegInfo_Part11_FDA" /> Various keynote speeches by FDA insiders early in the 21st century (in addition to compliance guides and draft guidance documents)<ref name="RegInfo_Part11_FDA" /> as well as strong efforts by the FDA to motivate industry to move to e-filing<ref name="IWEfilingFDA">{{cite web |url=https://www.informationweek.com/it-life/fda-moving-to-e-filing |title=FDA Moving To E-Filing |author=Greenemeier, L. |publisher=InformationWeek |date=25 February 2002 |accessdate=07 January 2022}}</ref> resulted in many companies like Eli Lilly<ref name="IWLillyPart11">{{cite web |url=https://www.informationweek.com/it-life/lilly-cures-inefficiency-with-it |title=Lilly Cures Inefficiency With IT |author=Greenemeier, L. |publisher=InformationWeek |date=18 February 2002 |accessdate=07 January 2022}}</ref>, [[Vendor:Agilent Technologies, Inc.|Agilent Technologies]]<ref name="LabNetAgilent00">{{cite web |url=https://www.laboratorynetwork.com/doc/agilent-introduces-security-pack-for-analytic-0001 |title=Agilent Introduces Security Pack for Analytical Laboratories |publisher=Laboratory Network |date=20 June 2000 |accessdate=15 April 2020}}</ref>, and other businesses rapidly being forced to change their methods and systems to adapt to the new standards.<ref name="RegInfo_Part11_FDA" /><ref name="CEPart11Art">{{cite web |url=https://www.controleng.com/articles/im-from-the-government-and-im-here-to-help-you/ |title='I'm from the Government, and I'm Here to Help You!' |author=Harrold, D. |work=Control Engineering |date=01 April 2002 |accessdate=15 April 2020}}</ref>

However, many entities expressed concerns about the Title 11 conditions, including concerns the regulations would "unnecessarily restrict" the use of technology, add significant compliance costs beyond what was intended, and stifle technological innovation while reducing public health benefit.<ref name="RegInfo_Part11_FDA" /> In November 2002, the FDA released the guidance document "Guidance for Industry 21 CFR Part 11; Electronic Records; Electronic Signatures, Electronic Copies of Electronic Records" to the public for commenting.<ref name="CEGuideDocFDA1">{{cite web |url=https://www.controleng.com/articles/fda-releases-21-cfr-part-11-guidance-document/ |title=FDA releases 21 CFR Part 11 guidance document |author=Control Engineering Staff |work=Control Engineering |date=03 January 2003 |accessdate=15 April 2020}}</ref> On February 3, 2003, the FDA withdrew that document, stating "we wanted to minimize industry time spent reviewing and commenting on the draft guidance when that draft guidance may no longer represent our approach under the [current good manufacturing practice] initiative," adding it would afterwards "intend to exercise enforcement discretion with regard to certain Part 11 requirements."<ref name="RegInfo_Part11_FDA" /> Further guidance documents were withdrawn later that month, culminating in a final guidance document in August 2003 stating the government body would re-examine Part 11 and make necessary changes.<ref name="RegInfo_Part11_FDA" /><ref name="inPharmaFDAFinal03">{{cite web |url=https://www.outsourcing-pharma.com/Article/2003/09/05/FDA-plans-to-amend-21-CFR-Part-11-rules |title=FDA plans to amend 21 CFR Part 11 rules |work=Outsourcing-Pharma |date=04 September 2003 |accessdate=15 April 2020}}</ref> However, the FDA reiterated despite its retraction of the guidance documents "21 CFR Part 11 is not going away, and neither is the agency's demand for electronic record integrity."<ref name="QDPart11StillEnforced">{{cite web |url=https://www.qualitydigest.com/july03/articles/04_article.shtml |title=Quality Assurance, Safety and 21 CFR Part 11: These three old friends are here to stay |author=June, T.M. |work=Quality Digest |date=July 2003 |accessdate=15 April 2020}}</ref> The retraction of guidance and change in policy, however, led many IT members in the pharmaceutical and life sciences industry in late 2004 to state one of the key problems they face as the lack of clear guidelines from the FDA about what is required for compliance.<ref name="SNSSurveyUKIT">{{cite web |url=http://snseurope.info/article/12833/Complying-with-US-Food-and-Drug-Administration(FDA)-data-regulations-is-proving-a-struggle-for-IT-departments-in-pharmaceutical-and-life-science-companies |title=Complying with US Food and Drug Administration(FDA) data regulations is proving a struggle for IT departments in pharmaceutical and life science companies |publisher=Storage Networking Solutions |date=17 November 2004 |accessdate=06 April 2013}}{{Dead link|April 2020}}</ref>

The FDA had indicated it would produce a revised version of Part 11 by the end of 2006, after its Third Annual FDA [[Informatics (academic field)|Information Management]] Summit had concluded.<ref name="inPharmaFDA2006">{{cite web |url=https://www.outsourcing-pharma.com/Article/2006/10/24/FDA-to-review-electronic-signature-regulation |title=FDA to review electronic signature regulation |author=Reymond, E. |work=Outsourcing-Pharma |date=24 October 2006 |accessdate=15 April 2020}}</ref> Those revisions never arrived, and little in the way of updates on the topic arrived.<ref name="FBFDA09">{{cite web |url=http://www.fiercebiotechit.com/story/dont-sweat-part-11-stuff/2009-11-13 |archiveurl=https://web.archive.org/web/20100222094358/http://www.fiercebiotechit.com/story/dont-sweat-part-11-stuff/2009-11-13 |title=Don't sweat the Part 11 stuff |author=Miller, George |publisher=FierceBiotechIT |date=13 November 2009 |archivedate=22 February 2010 |accessdate=15 April 2020}}</ref> On July 8, 2010, the FDA announced it would begin to audit facilities working with drugs "in an effort to evaluate industry's compliance and understanding of Part 11 in light of the enforcement discretion,"<ref name="FDAAnnounceJul8">{{cite web |url=http://www.fda.gov/AboutFDA/CentersOffices/OfficeofMedicalProductsandTobacco/CDER/ucm204012.htm |archiveurl=https://web.archive.org/web/20171115154911/https://www.fda.gov/AboutFDA/CentersOffices/OfficeofMedicalProductsandTobacco/CDER/ucm204012.htm |title=FDA To Conduct Inspections Focusing on 21 CFR 11 (Part 11) requirements relating to human drugs |publisher=U.S. FDA |date=08 July 2010 |archivedate=15 November 2017 |accessdate=15 April 2020}}</ref> leaving some to wonder if this was an indicator the regulation and/or its guidance would finally see a revision.<ref name="GxPEnforce">{{cite web |url=http://gxpperspectives.com/2010/07/25/part-11-how-will-fda-enforce/ |title=Part 11: How Will FDA Enforce? |author=Barsky, Emma; Grunbaum, Len |publisher=GxP Perspectives |date=25 July 2010 |accessdate=06 April 2013}}{{Dead link}}</ref><ref name="PharmProcEnforce">{{cite web |url=http://www.pharmpro.com/blogs/2010/07/audit-alert-clarity-e-records-fda-re-evaluate-21-cfr-11 |title=Audit Alert! - Clarity on e-Records: FDA to Re-Evaluate 21 CFR 11 |author=Appel, Ken |publisher=Pharmaceutical Processing |date=28 July 2010 |accessdate=06 April 2013}}{{Dead link}}</ref>

With an increase in violations of data integrity in current good manufacturing practice (CGMP) inspections in the mid-2010s, the U.S. Food and Drug Administration eventually issued draft guidance in April 2016 for implementing the data integrity requirements of 21 CFR Parts 210–212, as well as clarifying how electronic signature and record-keeping requirements in 21 CFR Part 11 apply.<ref name="FDAData16">{{cite web |url=https://www.fda.gov/files/drugs/published/Data-Integrity-and-Compliance-With-Current-Good-Manufacturing-Practice-Guidance-for-Industry.pdf |format=PDF |title=Data Integrity and Compliance with CGMP Guidance for Industry - Draft Guidance |author=U.S. Food and Drug Administration |publisher=U.S. Food and Drug Administration |date=April 2016 |accessdate=15 April 2020}}</ref> That guidance was finalized in December 2018, encouraging firms to "implement meaningful and effective strategies to manage their data integrity risks based on their process understanding and knowledge management of technologies and business models."<ref name="FDAData18">{{cite web |url=https://www.fda.gov/regulatory-information/search-fda-guidance-documents/data-integrity-and-compliance-drug-cgmp-questions-and-answers-guidance-industry |title=Data Integrity and Compliance With Drug CGMP Questions and Answers Guidance for Industry |author=U.S. Food and Drug Administration |publisher=U.S. Food and Drug Administration |date=December 2018 |accessdate=15 April 2020}}</ref>

==Structure==

The structure of Part 11 is as follows:

'''Subpart A — General Provisions'''
:§ 11.1 [https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfcfr/CFRSearch.cfm?fr=11.1 Scope]
:§ 11.2 [https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfcfr/CFRSearch.cfm?fr=11.2 Implementation]
:§ 11.3 [https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfcfr/CFRSearch.cfm?fr=11.3 Definitions]

'''Subpart B — Electronic Records'''
:§ 11.10 [https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfcfr/CFRSearch.cfm?fr=11.10 Controls for closed systems]
:§ 11.30 [https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfcfr/CFRSearch.cfm?fr=11.30 Controls for open systems]
:§ 11.50 [https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfcfr/CFRSearch.cfm?fr=11.50 Signature manifestations]
:§ 11.70 [https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfcfr/CFRSearch.cfm?fr=11.70 Signature/record linking]

'''Subpart C — Electronic Signatures'''
:§ 11.100 [https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfcfr/CFRSearch.cfm?fr=11.100 General requirements]
:§ 11.200 [https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfcfr/CFRSearch.cfm?fr=11.200 Electronic signature components and controls]
:§ 11.300 [https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfcfr/CFRSearch.cfm?fr=11.300 Controls for identification codes/passwords]

===Subpart A===

This is essentially the preamble of the regulations, explaining to what and who the regulations apply as well as how they'll apply. Definitions of common terms appearing in the regulations can also be found here, including a clarification in the difference between a digital and electronic signature.

===Subpart B===

This section covers the requirements applicable to electronic records and their management. Several requirements are addressed, including "how to ensure the authenticity, integrity, and, when appropriate, the confidentiality of electronic records"; what content a signature should contain; and how electronic records and their signatures should be linked. It also covers topics like system validation, data traceability, audit control, and version control. 

===Subpart C===

This final section addresses the requirements specific to electronic signatures and their use. General requirements for electronic signatures, their components and controls, and password controls are all addressed. Additionally, this section addresses requirements for more advanced biometric-based signatures.

==Audit guidelines and checklist==

{{Main|21 CFR Part 11/Audit guidelines and checklist}}

For those auditing computer systems and IT environments for their compliance with 21 CFR Part 11 and other regulations, a set of guidelines and checklist items may be useful. 
<br />

Click the link above for the full set of guidelines and checklist items.

==Further reading==
* {{cite web |url=https://www.ecfr.gov/current/title-21/part-11 |title=Electronic Code of Federal Regulations - Title 21: Food and Drugs - Part 11: Electronic Records; Electronic Signatures |publisher=U.S. Government Printing Office}}
* {{cite web |url=https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfcfr/cfrsearch.cfm?cfrpart=11 |title= CFR - Code of Federal Regulations - Title 21 - Part 11 Electronic Records; Electronic Signatures |publisher=U.S. Food and Drug Administration}}
* {{cite web |url=http://www.labcompliance.com/tutorial/part11/ |archiveurl=https://web.archive.org/web/20180103191244/http://www.labcompliance.com/tutorial/part11/ |title=Tutorial: 21 CFR Part 11 - Electronic Records and Electronic Signatures |author=Huber, L. |publisher=LabCompliance |date=15 November 2012 |archivedate=03 January 2020}}
==References==
{{Reflist|colwidth=30em}}

<!---Place all category tags here-->
[[Category:Regulatory information]]