User:Shawndouglas/sandbox/sublevel22 - Revision history

Shawndouglas: Replaced content with "
TOC
{{ombox | type = notice | style = width: 960px; | text = This is sublevel22 of my sandbox, where I play with features and..."

2023-08-16T20:19:10Z

Replaced content with "<div class="nonumtoc">__TOC__</div> {{ombox | type = notice | style = width: 960px; | text = This is sublevel22 of my sandbox, where I play with features and..."

← Older revision		Revision as of 20:19, 16 August 2023
Line 1:		Line 1:
	===~~4.2 Regulatory considerations===~~		<div class="nonumtoc">__TOC__</div>
	~~[[File:Workshop GDPR compliance at the 2019 Global Entrepreneurship Summit.jpg~~\|~~right\|500px]]In Chapter 2, we examined standards and regulations influencing cloud computing. We also noted that there's an "elephant in the room" in the guise~~ of ~~data privacy and protection considerations in the cloud. Many of the regulations and data security considerations mentioned there apply not only to financial firms, manufacturers~~, and ~~software developers, but also laboratories of all shapes and sizes~~. ~~At the heart of it all is keeping client, customer, and organizational data out of the hands of people who shouldn't have access~~ to it, ~~a significant regulatory hurdle~~.		{{ombox
			\| type = notice
			\| style = width: 960px;
			\| text = This is sublevel22 of my sandbox, where I play with features and test MediaWiki code. If you wish to leave a comment for me, please see [[User_talk:Shawndouglas\|my discussion page]] instead.<p></p>
			}}

	Most regulation of data and information in an enterprise, including laboratories, is based on several aspects of the data and information: its sensitivity, its location or geography, and its ownership.<ref name=~~"SimorjayData14">{{cite web \|url~~=~~https://download.microsoft.com/download/0/A/3/0A3BE969-85C5-4DD2-83B6-366AA71D1FE3/Data-Classification-for-Cloud-Readiness.pdf \|format~~=~~PDF \|title~~=Data classification for cloud readiness \|author=Simorjay, F.; Chainier, K.A.; Dillard, K. et al. \|publisher=Microsoft Corporation \|date=2014 \|accessdate=28 July 2023}}</ref><ref name="TolsmaGDPR18">{{cite web \|url=https://www2.deloitte.com/nl/nl/pages/risk/articles/cyber-security-privacy-gdpr-update-the-impact-on-cloud-computing.html \|title=GDPR and the impact on cloud computing: The effect on agreements between enterprises and cloud service providers \|author=Tolsma, A. \|publisher=Deloitte \|date=2018 \|accessdate=28 July 2023}}</ref><ref name="EusticeUnder18">{{cite web \|url=https://legal.thomsonreuters.com/en/insights/articles/understanding-data-privacy-and-cloud-computing \|title=Understand the intersection between data privacy laws and cloud computing \|author=Eustice, J.C. \|work=Legal Technology, Products, and Services \|publisher=Thomson Reuters \|date=2018 \|accessdate=28 July 2023}}</ref> Not coincidentally, these same aspects are often applied to data classification efforts of an organization, which attempt to determine and assign relative values to the data and information managed and communicated by the organization. This classification in turn allows the organization to better discover the risks associated with those classifications, and allow data owners to realize that all data shouldn't be treated the same way.<ref name="SimorjayData14" /> And well-researched regulatory efforts recognize this as well.		==Sandbox begins below==

	Take for example the European Union's [[General Data Protection Regulation]] (GDPR). The GDPR stipulates how personal data is collected, used, and stored by organizations in the E.U., as well as by organizations providing services to individuals and organizations in the E.U.<ref name="GoogleGDPR">{{cite web \|url=https://cloud.google.com/privacy/gdpr \|title=Google Cloud & the General Data Protection Regulation (GDPR) \|publisher=Google Cloud \|accessdate=28 July 2023}}</ref> The GDPR appears to classify "personal data" as sensitive "in relation to fundamental rights and freedoms," formally defined as "any information relating to an identified or identifiable natural person."<ref name="EUR-LexGDPR16">{{cite web \|url=https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679 \|title=Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Text with EEA relevance) \|work=EUR-Lex \|publisher=European Union \|date=27 April 2016 \|accessdate=28 July 2023}}</ref> This is the sensitivity aspect of the regulation. GDPR also addresses location at many points, from data transfers outside the E.U. to the location of the "main establishment" of a data owner or "controller."<ref name="EUR-LexGDPR16" /> As for ownership, GDPR refers to this aspect of data as the "controller," defined as "the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data."<ref name="EUR-LexGDPR16" /> The word "controller" appears more than 500 times in the regulation, emphasizing the importance of ownership or control of data.<ref name="EUR-LexGDPR16" /> However, cloud providers using hybrid or multicloud approaches pose a challenge to labs, as verifying GDPR compliance in these deployments gets even more complicated. The lab would likely have to turn to key documents such as the CSP's SOC 2 audit report (discussed later) to get a fuller picture of GDPR compliance.<ref name="TellingHowCloud19">{{cite web \|url=https://cloudcomputing-news.net/news/2019/jun/03/how-cloud-computing-changing-laboratory-ecosystem/ \|title=How cloud computing is changing the laboratory ecosystem \|author=Telling, C. \|work=CloudTech \|date=03 June 2019 \|accessdate=28 July 2023}}</ref>

	While data privacy and protection regulations like GDPR, the Personal Data Protection Law (KVKK), and California Consumer Privacy Act (CCPA) take a broad approach, affecting most any organization doing cloud- or non-cloud business while handling sensitive and protected data, some regulations are more focused. The U.S.' [[Health Insurance Portability and Accountability Act]] (HIPAA) is huge for any laboratory handling electronic protected health information (ePHI), including in the cloud. The regulation is so significant that the U.S. Department of Health & Human Services (HHS) has released its own guidance on HIPAA and cloud computing.<ref name="HHSGuidance20">{{cite web \|url=https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html \|title=Guidance on HIPAA & Cloud Computing \|author=Office for Civil Rights \|work=Health Information Privacy \|publisher=U.S. Department of Health & Human Services \|date=23 December 2022 \|accessdate=28 July 2023}}</ref> That guidance highlights the sensitivity (ePHI), location (whether inside or outside the U.S.), and ownership (HIPAA covered entities and business associates) of data. That ownership part is important, as it addresses the role a CSP takes in this regard<ref name="HHSGuidance20" />:

	<blockquote>When a covered entity engages the services of a CSP to create, receive, maintain, or transmit ePHI (such as to process and/or store ePHI), on its behalf, the CSP is a business associate under HIPAA. Further, when a business associate subcontracts with a CSP to create, receive, maintain, or transmit ePHI on its behalf, the CSP subcontractor itself is a business associate. This is true even if the CSP processes or stores only encrypted ePHI and lacks an encryption key for the data. Lacking an encryption key does not exempt a CSP from business associate status and obligations under the HIPAA Rules. As a result, the covered entity (or business associate) and the CSP must enter into a HIPAA-compliant business associate agreement (BAA), and the CSP is both contractually liable for meeting the terms of the BAA and directly liable for compliance with the applicable requirements of the HIPAA Rules.</blockquote>

	Clinical and public health laboratories are already affected by HIPAA, but understanding how moving to the cloud affects those HIPAA requirements is vital and not always clear.<ref name="HHSGuidance20" /> In particular, the idea of a CSP as a business associate must be taken seriously, in conjunction with its shared responsibility policy and compliance products. Laboratories that need to be HIPAA-compliant should be prepared to do their research on HIPAA and the cloud by reading [https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html the HHS guide] and other reference material, as well consulting with experts on the topic when in-house expertise isn't available.

	Another area of concern for laboratories is GxP or "good practice" quality guidelines and regulations. Take for example the pharmaceutical manufacturer and their laboratories, which must take sufficient precautions to ensure that any manufacturing documentation (data, information, etc.) related to [[good manufacturing practice]] (GMP) requirements (e.g., via E.U. GMP Annex 11, U.S. 21 CFR Part 211, or Germany's AMWHV) is securely stored yet available for a specific retention period "in the event of closure of the manufacturing or testing site where the documentation is stored."<ref name="ECACloud20">{{cite web \|url=https://www.gmp-compliance.org/gmp-news/cloud-computing-regulations-for-the-return-transmission-of-data-in-the-event-of-business-discontinuation \|title=Cloud Computing: Regulations for the Return Transmission of Data in the Event of Business Discontinuation \|work-ECA Academy \|date=16 December 2020 \|accessdate=28 July 2023}}</ref> As the ECA Academy notes, in the cloud computing realm, it would be up to the laboratory to get provisions added into the CSP's service-level agreement (SLA) to address the GMP's necessity for data availability, and to decide whether maintaining a local backup of the data would be appropriate (as in, perhaps, a hybrid cloud scenario).

	That part about the SLA is important. Although a formal contract will address agreed-upon services, it's usually in vague terms; the SLA, on the other hand, defines all the responsibility the cloud provider holds, as well as your laboratory, for the supply and use of the CSP's services.<ref name="CaldwellContracts19">{{cite web \|url=https://www.asgnational.com/miscellaneous/contracts-vs-service-level-agreements/ \|archiveurl=https://web.archive.org/web/20200930063443/https://www.asgnational.com/miscellaneous/contracts-vs-service-level-agreements/ \|title=Contracts vs. Service Level Agreements \|author=Caldwell, D. \|work=ASG Blog \|date=16 February 2019 \|archivedate=30 September 2020 \|accessdate=28 July 2023}}</ref> These are your primary protections, along with vetting the CSP you use. This may be difficult, however, particularly in a public cloud, where auditing the security controls and protections of the CSP will be limited at best. To ensure GxP compliance in the cloud, your lab will have to examine the various certifications and compliance offerings of the CSP and hope that the CSP staff handling your GxP data are trained on the requirements of GxP in the cloud.<ref name="McDowallClouds20">{{cite web \|url=https://www.csolsinc.com/blog/clouds-or-clods-software-as-a-service-in-gxp-regulated-laboratories/ \|title=Clouds or Clods? Software as a Service in GxP Regulated Laboratories \|author=McDowall, B. \|work=CSols Blog \|publisher=CSols, Inc \|date=27 August 2020 \|accessdate=28 July 2023}}</ref> However, public cloud providers like Microsoft<ref name="MazzoliGood20">{{cite web \|url=https://learn.microsoft.com/en-us/compliance/regulatory/offering-gxp \|title=Good Clinical, Laboratory, and Manufacturing Practices (GxP) \|author=Mazzoli, R. \|work=Microsoft Documentation \|publisher=Microsoft, Inc \|date=26 January 2023 \|accessdate=28 July 2023}}</ref> and Google<ref name="GoogleUsing20">{{cite web \|url=https://cloud.google.com/security/compliance/cloud-gxp-whitepaper \|title=Using Google Cloud in GxP Systems \|publisher=Google Cloud \|date=May 2020 \|accessdate=28 July 2023}}</ref> provide their own documentation and guidance on using their services in GxP environments. As Microsoft notes, however, "there is no GxP certification for cloud service providers."<ref name="MazzoliGood20" /> Instead, the CSPs focus on meeting [[Quality management system\|quality management]] and information security standards and employing their own best practices that match up with GxP requirements. Finally, they may also have an independent third party conduct GxP qualification reviews, with the resulting qualification guidelines detailing GxP responsibility between the CSP and the laboratory.<ref name="MazzoliGood20" /><ref name="GoogleUsing20" />

	Ultimately, navigating the challenge of ensuring your laboratory's move to the cloud complies with necessary regulations is a tricky matter. Ensuring the CSP you choose actually meets HIPAA, GxP, and other requirements isn't always a guaranteed proposition by simply auditing the CSPs whitepapers and other associated compliance documents. However, experts such as Linford & Co.'s Nicole Hemmer and IDBS' Damien Tiller emphasize that the most comprehensive CSP documentation to examine towards gaining a more complete picture of the CSP's security is the SOC 2 (SOC for Service Organizations: Trust Services
	Criteria) report.<ref name="HemmerTrust19">{{cite web \|url=https://linfordco.com/blog/trust-services-critieria-principles-soc-2/ \|title=2023 Trust Services Criteria (TSCs) for SOC 2 Reports \|author=Colby, L. \|work=Linford & Company IT Audit & Compliance Blog \|publisher=Linford and Co. LLP \|date=01 February 2023 \|accessdate=28 July 2023}}</ref><ref name="TillerIsThe19">{{cite web \|url=https://storage.pardot.com/468401/1614781936jHqdU6H6/Whitepaper_Is_the_cloud_a_safe_place_for_your_data.pdf \|archiveurl=https://web.archive.org/web/20210308231558/https://storage.pardot.com/468401/1614781936jHqdU6H6/Whitepaper_Is_the_cloud_a_safe_place_for_your_data.pdf \|format=PDF \|title=Is the Cloud a Safe Place for Your Data?: How Life Science Organizations Can Ensure Integrity and Security in a SaaS Environment \|author=Tiller, D. \|publisher=IDBS \|date=2019 \|archivedate=08 March 2023 \|accessdate=28 July 2023}}</ref> A CSP's SOC 2 audit results outline nearly 200 information security, data integrity, data availability, and data retention controls and any non-conformities with those controls (the CSP must show those controls have been effectively in place over a six- to 12-month period). The SOC 2 report has other useful aspects, including a full service description and audit observations, making it the best tool for a laboratory to judge a CSP's ability to assist with regulatory compliance.<ref name="TillerIsThe19" />

Shawndouglas at 20:27, 15 August 2023

2023-08-15T20:27:43Z

← Older revision		Revision as of 20:27, 15 August 2023
Line 14:		Line 14:
	Another area of concern for laboratories is GxP or "good practice" quality guidelines and regulations. Take for example the pharmaceutical manufacturer and their laboratories, which must take sufficient precautions to ensure that any manufacturing documentation (data, information, etc.) related to [[good manufacturing practice]] (GMP) requirements (e.g., via E.U. GMP Annex 11, U.S. 21 CFR Part 211, or Germany's AMWHV) is securely stored yet available for a specific retention period "in the event of closure of the manufacturing or testing site where the documentation is stored."<ref name="ECACloud20">{{cite web \|url=https://www.gmp-compliance.org/gmp-news/cloud-computing-regulations-for-the-return-transmission-of-data-in-the-event-of-business-discontinuation \|title=Cloud Computing: Regulations for the Return Transmission of Data in the Event of Business Discontinuation \|work-ECA Academy \|date=16 December 2020 \|accessdate=28 July 2023}}</ref> As the ECA Academy notes, in the cloud computing realm, it would be up to the laboratory to get provisions added into the CSP's service-level agreement (SLA) to address the GMP's necessity for data availability, and to decide whether maintaining a local backup of the data would be appropriate (as in, perhaps, a hybrid cloud scenario).		Another area of concern for laboratories is GxP or "good practice" quality guidelines and regulations. Take for example the pharmaceutical manufacturer and their laboratories, which must take sufficient precautions to ensure that any manufacturing documentation (data, information, etc.) related to [[good manufacturing practice]] (GMP) requirements (e.g., via E.U. GMP Annex 11, U.S. 21 CFR Part 211, or Germany's AMWHV) is securely stored yet available for a specific retention period "in the event of closure of the manufacturing or testing site where the documentation is stored."<ref name="ECACloud20">{{cite web \|url=https://www.gmp-compliance.org/gmp-news/cloud-computing-regulations-for-the-return-transmission-of-data-in-the-event-of-business-discontinuation \|title=Cloud Computing: Regulations for the Return Transmission of Data in the Event of Business Discontinuation \|work-ECA Academy \|date=16 December 2020 \|accessdate=28 July 2023}}</ref> As the ECA Academy notes, in the cloud computing realm, it would be up to the laboratory to get provisions added into the CSP's service-level agreement (SLA) to address the GMP's necessity for data availability, and to decide whether maintaining a local backup of the data would be appropriate (as in, perhaps, a hybrid cloud scenario).

	That part about the SLA is important. Although a formal contract will address agreed-upon services, it's usually in vague terms; the SLA, on the other hand, defines all the responsibility the cloud provider holds, as well as your laboratory, for the supply and use of the CSP's services.<ref name="CaldwellContracts19">{{cite web \|url=https://www.asgnational.com/miscellaneous/contracts-vs-service-level-agreements/ \|archiveurl=https://web.archive.org/web/20200930063443/https://www.asgnational.com/miscellaneous/contracts-vs-service-level-agreements/ \|title=Contracts vs. Service Level Agreements \|author=Caldwell, D. \|work=ASG Blog \|date=16 February 2019 \|archivedate=30 September 2020 \|accessdate=28 July 2023}}</ref> These are your primary protections, along with vetting the CSP you use. This may be difficult, however, particularly in a public cloud, where auditing the security controls and protections of the CSP will be limited at best. To ensure GxP compliance in the cloud, your lab will have to examine the various certifications and compliance offerings of the CSP, and hope that the CSP staff handling your GxP data are trained on the requirements of GxP in the cloud.<ref name="McDowallClouds20">{{cite web \|url=https://www.csolsinc.com/blog/clouds-or-clods-software-as-a-service-in-gxp-regulated-laboratories/ \|title=Clouds or Clods? Software as a Service in GxP Regulated Laboratories \|author=McDowall, B. \|work=CSols Blog \|publisher=CSols, Inc \|date=27 August 2020 \|accessdate=28 July 2023}}</ref> However, public cloud providers like Microsoft<ref name="MazzoliGood20">{{cite web \|url=https://learn.microsoft.com/en-us/compliance/regulatory/offering-gxp \|title=Good Clinical, Laboratory, and Manufacturing Practices (GxP) \|author=Mazzoli, R. \|work=Microsoft Documentation \|publisher=Microsoft, Inc \|date=26 January 2023 \|accessdate=28 July 2023}}</ref> and Google<ref name="GoogleUsing20">{{cite web \|url=https://cloud.google.com/security/compliance/cloud-gxp-whitepaper \|title=Using Google Cloud in GxP Systems \|publisher=Google Cloud \|date=May 2020 \|accessdate=28 July 2023}}</ref> provide their own documentation and guidance on using their services in GxP environments. As Microsoft notes, however, "there is no GxP certification for cloud service providers."<ref name="MazzoliGood20" /> Instead, the CSPs focus on meeting [[Quality management system\|quality management]] and information security standards and employing their own best practices that match up with GxP requirements. Finally, they may also have an independent third party conduct GxP qualification reviews, with the resulting qualification guidelines detailing GxP responsibility between the CSP and the laboratory.<ref name="MazzoliGood20" /><ref name="GoogleUsing20" />		That part about the SLA is important. Although a formal contract will address agreed-upon services, it's usually in vague terms; the SLA, on the other hand, defines all the responsibility the cloud provider holds, as well as your laboratory, for the supply and use of the CSP's services.<ref name="CaldwellContracts19">{{cite web \|url=https://www.asgnational.com/miscellaneous/contracts-vs-service-level-agreements/ \|archiveurl=https://web.archive.org/web/20200930063443/https://www.asgnational.com/miscellaneous/contracts-vs-service-level-agreements/ \|title=Contracts vs. Service Level Agreements \|author=Caldwell, D. \|work=ASG Blog \|date=16 February 2019 \|archivedate=30 September 2020 \|accessdate=28 July 2023}}</ref> These are your primary protections, along with vetting the CSP you use. This may be difficult, however, particularly in a public cloud, where auditing the security controls and protections of the CSP will be limited at best. To ensure GxP compliance in the cloud, your lab will have to examine the various certifications and compliance offerings of the CSP and hope that the CSP staff handling your GxP data are trained on the requirements of GxP in the cloud.<ref name="McDowallClouds20">{{cite web \|url=https://www.csolsinc.com/blog/clouds-or-clods-software-as-a-service-in-gxp-regulated-laboratories/ \|title=Clouds or Clods? Software as a Service in GxP Regulated Laboratories \|author=McDowall, B. \|work=CSols Blog \|publisher=CSols, Inc \|date=27 August 2020 \|accessdate=28 July 2023}}</ref> However, public cloud providers like Microsoft<ref name="MazzoliGood20">{{cite web \|url=https://learn.microsoft.com/en-us/compliance/regulatory/offering-gxp \|title=Good Clinical, Laboratory, and Manufacturing Practices (GxP) \|author=Mazzoli, R. \|work=Microsoft Documentation \|publisher=Microsoft, Inc \|date=26 January 2023 \|accessdate=28 July 2023}}</ref> and Google<ref name="GoogleUsing20">{{cite web \|url=https://cloud.google.com/security/compliance/cloud-gxp-whitepaper \|title=Using Google Cloud in GxP Systems \|publisher=Google Cloud \|date=May 2020 \|accessdate=28 July 2023}}</ref> provide their own documentation and guidance on using their services in GxP environments. As Microsoft notes, however, "there is no GxP certification for cloud service providers."<ref name="MazzoliGood20" /> Instead, the CSPs focus on meeting [[Quality management system\|quality management]] and information security standards and employing their own best practices that match up with GxP requirements. Finally, they may also have an independent third party conduct GxP qualification reviews, with the resulting qualification guidelines detailing GxP responsibility between the CSP and the laboratory.<ref name="MazzoliGood20" /><ref name="GoogleUsing20" />

	Ultimately, navigating the challenge of ensuring your laboratory's move to the cloud complies with necessary regulations is a tricky matter. Ensuring the CSP you choose actually meets HIPAA, GxP, and other requirements isn't always a guaranteed proposition by simply auditing the CSPs whitepapers and other associated compliance documents. However, experts such as Linford & Co.'s Nicole Hemmer and IDBS' Damien Tiller emphasize that the most comprehensive CSP documentation to examine towards gaining a more complete picture of the CSP's security is the SOC 2 (SOC for Service Organizations: Trust Services		Ultimately, navigating the challenge of ensuring your laboratory's move to the cloud complies with necessary regulations is a tricky matter. Ensuring the CSP you choose actually meets HIPAA, GxP, and other requirements isn't always a guaranteed proposition by simply auditing the CSPs whitepapers and other associated compliance documents. However, experts such as Linford & Co.'s Nicole Hemmer and IDBS' Damien Tiller emphasize that the most comprehensive CSP documentation to examine towards gaining a more complete picture of the CSP's security is the SOC 2 (SOC for Service Organizations: Trust Services
	Criteria) report.<ref name="HemmerTrust19">{{cite web \|url=https://linfordco.com/blog/trust-services-critieria-principles-soc-2/ \|title=2023 Trust Services Criteria (TSCs) for SOC 2 Reports \|author=Colby, L. \|work=Linford & Company IT Audit & Compliance Blog \|publisher=Linford and Co. LLP \|date=01 February 2023 \|accessdate=28 July 2023}}</ref><ref name="TillerIsThe19">{{cite web \|url=https://storage.pardot.com/468401/1614781936jHqdU6H6/Whitepaper_Is_the_cloud_a_safe_place_for_your_data.pdf \|archiveurl=https://web.archive.org/web/20210308231558/https://storage.pardot.com/468401/1614781936jHqdU6H6/Whitepaper_Is_the_cloud_a_safe_place_for_your_data.pdf \|format=PDF \|title=Is the Cloud a Safe Place for Your Data?: How Life Science Organizations Can Ensure Integrity and Security in a SaaS Environment \|author=Tiller, D. \|publisher=IDBS \|date=2019 \|archivedate=08 March 2023 \|accessdate=28 July 2023}}</ref> A CSP's SOC 2 audit results outline nearly 200 information security, data integrity, data availability, and data retention controls and any non-conformities with those controls (the CSP must show those controls have been effectively in place over a six- to 12-month period). The SOC 2 report has other useful aspects, including a full service description and audit observations, making it the best tool for a laboratory to judge a CSP's ability to assist with regulatory compliance.<ref name="TillerIsThe19" />		Criteria) report.<ref name="HemmerTrust19">{{cite web \|url=https://linfordco.com/blog/trust-services-critieria-principles-soc-2/ \|title=2023 Trust Services Criteria (TSCs) for SOC 2 Reports \|author=Colby, L. \|work=Linford & Company IT Audit & Compliance Blog \|publisher=Linford and Co. LLP \|date=01 February 2023 \|accessdate=28 July 2023}}</ref><ref name="TillerIsThe19">{{cite web \|url=https://storage.pardot.com/468401/1614781936jHqdU6H6/Whitepaper_Is_the_cloud_a_safe_place_for_your_data.pdf \|archiveurl=https://web.archive.org/web/20210308231558/https://storage.pardot.com/468401/1614781936jHqdU6H6/Whitepaper_Is_the_cloud_a_safe_place_for_your_data.pdf \|format=PDF \|title=Is the Cloud a Safe Place for Your Data?: How Life Science Organizations Can Ensure Integrity and Security in a SaaS Environment \|author=Tiller, D. \|publisher=IDBS \|date=2019 \|archivedate=08 March 2023 \|accessdate=28 July 2023}}</ref> A CSP's SOC 2 audit results outline nearly 200 information security, data integrity, data availability, and data retention controls and any non-conformities with those controls (the CSP must show those controls have been effectively in place over a six- to 12-month period). The SOC 2 report has other useful aspects, including a full service description and audit observations, making it the best tool for a laboratory to judge a CSP's ability to assist with regulatory compliance.<ref name="TillerIsThe19" />

Shawndouglas at 18:01, 26 July 2023

2023-07-26T18:01:49Z

← Older revision	Revision as of 18:01, 26 July 2023
Line 1:	Line 1:
		===4.2 Regulatory considerations===
		[[File:Workshop GDPR compliance at the 2019 Global Entrepreneurship Summit.jpg\|right\|500px]]In Chapter 2, we examined standards and regulations influencing cloud computing. We also noted that there's an "elephant in the room" in the guise of data privacy and protection considerations in the cloud. Many of the regulations and data security considerations mentioned there apply not only to financial firms, manufacturers, and software developers, but also laboratories of all shapes and sizes. At the heart of it all is keeping client, customer, and organizational data out of the hands of people who shouldn't have access to it, a significant regulatory hurdle.

		Most regulation of data and information in an enterprise, including laboratories, is based on several aspects of the data and information: its sensitivity, its location or geography, and its ownership.<ref name="SimorjayData14">{{cite web \|url=https://download.microsoft.com/download/0/A/3/0A3BE969-85C5-4DD2-83B6-366AA71D1FE3/Data-Classification-for-Cloud-Readiness.pdf \|format=PDF \|title=Data classification for cloud readiness \|author=Simorjay, F.; Chainier, K.A.; Dillard, K. et al. \|publisher=Microsoft Corporation \|date=2014 \|accessdate=28 July 2023}}</ref><ref name="TolsmaGDPR18">{{cite web \|url=https://www2.deloitte.com/nl/nl/pages/risk/articles/cyber-security-privacy-gdpr-update-the-impact-on-cloud-computing.html \|title=GDPR and the impact on cloud computing: The effect on agreements between enterprises and cloud service providers \|author=Tolsma, A. \|publisher=Deloitte \|date=2018 \|accessdate=28 July 2023}}</ref><ref name="EusticeUnder18">{{cite web \|url=https://legal.thomsonreuters.com/en/insights/articles/understanding-data-privacy-and-cloud-computing \|title=Understand the intersection between data privacy laws and cloud computing \|author=Eustice, J.C. \|work=Legal Technology, Products, and Services \|publisher=Thomson Reuters \|date=2018 \|accessdate=28 July 2023}}</ref> Not coincidentally, these same aspects are often applied to data classification efforts of an organization, which attempt to determine and assign relative values to the data and information managed and communicated by the organization. This classification in turn allows the organization to better discover the risks associated with those classifications, and allow data owners to realize that all data shouldn't be treated the same way.<ref name="SimorjayData14" /> And well-researched regulatory efforts recognize this as well.

		Take for example the European Union's [[General Data Protection Regulation]] (GDPR). The GDPR stipulates how personal data is collected, used, and stored by organizations in the E.U., as well as by organizations providing services to individuals and organizations in the E.U.<ref name="GoogleGDPR">{{cite web \|url=https://cloud.google.com/privacy/gdpr \|title=Google Cloud & the General Data Protection Regulation (GDPR) \|publisher=Google Cloud \|accessdate=28 July 2023}}</ref> The GDPR appears to classify "personal data" as sensitive "in relation to fundamental rights and freedoms," formally defined as "any information relating to an identified or identifiable natural person."<ref name="EUR-LexGDPR16">{{cite web \|url=https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679 \|title=Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Text with EEA relevance) \|work=EUR-Lex \|publisher=European Union \|date=27 April 2016 \|accessdate=28 July 2023}}</ref> This is the sensitivity aspect of the regulation. GDPR also addresses location at many points, from data transfers outside the E.U. to the location of the "main establishment" of a data owner or "controller."<ref name="EUR-LexGDPR16" /> As for ownership, GDPR refers to this aspect of data as the "controller," defined as "the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data."<ref name="EUR-LexGDPR16" /> The word "controller" appears more than 500 times in the regulation, emphasizing the importance of ownership or control of data.<ref name="EUR-LexGDPR16" /> However, cloud providers using hybrid or multicloud approaches pose a challenge to labs, as verifying GDPR compliance in these deployments gets even more complicated. The lab would likely have to turn to key documents such as the CSP's SOC 2 audit report (discussed later) to get a fuller picture of GDPR compliance.<ref name="TellingHowCloud19">{{cite web \|url=https://cloudcomputing-news.net/news/2019/jun/03/how-cloud-computing-changing-laboratory-ecosystem/ \|title=How cloud computing is changing the laboratory ecosystem \|author=Telling, C. \|work=CloudTech \|date=03 June 2019 \|accessdate=28 July 2023}}</ref>

		While data privacy and protection regulations like GDPR, the Personal Data Protection Law (KVKK), and California Consumer Privacy Act (CCPA) take a broad approach, affecting most any organization doing cloud- or non-cloud business while handling sensitive and protected data, some regulations are more focused. The U.S.' [[Health Insurance Portability and Accountability Act]] (HIPAA) is huge for any laboratory handling electronic protected health information (ePHI), including in the cloud. The regulation is so significant that the U.S. Department of Health & Human Services (HHS) has released its own guidance on HIPAA and cloud computing.<ref name="HHSGuidance20">{{cite web \|url=https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html \|title=Guidance on HIPAA & Cloud Computing \|author=Office for Civil Rights \|work=Health Information Privacy \|publisher=U.S. Department of Health & Human Services \|date=23 December 2022 \|accessdate=28 July 2023}}</ref> That guidance highlights the sensitivity (ePHI), location (whether inside or outside the U.S.), and ownership (HIPAA covered entities and business associates) of data. That ownership part is important, as it addresses the role a CSP takes in this regard<ref name="HHSGuidance20" />:

		<blockquote>When a covered entity engages the services of a CSP to create, receive, maintain, or transmit ePHI (such as to process and/or store ePHI), on its behalf, the CSP is a business associate under HIPAA. Further, when a business associate subcontracts with a CSP to create, receive, maintain, or transmit ePHI on its behalf, the CSP subcontractor itself is a business associate. This is true even if the CSP processes or stores only encrypted ePHI and lacks an encryption key for the data. Lacking an encryption key does not exempt a CSP from business associate status and obligations under the HIPAA Rules. As a result, the covered entity (or business associate) and the CSP must enter into a HIPAA-compliant business associate agreement (BAA), and the CSP is both contractually liable for meeting the terms of the BAA and directly liable for compliance with the applicable requirements of the HIPAA Rules.</blockquote>

		Clinical and public health laboratories are already affected by HIPAA, but understanding how moving to the cloud affects those HIPAA requirements is vital and not always clear.<ref name="HHSGuidance20" /> In particular, the idea of a CSP as a business associate must be taken seriously, in conjunction with its shared responsibility policy and compliance products. Laboratories that need to be HIPAA-compliant should be prepared to do their research on HIPAA and the cloud by reading [https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html the HHS guide] and other reference material, as well consulting with experts on the topic when in-house expertise isn't available.

		Another area of concern for laboratories is GxP or "good practice" quality guidelines and regulations. Take for example the pharmaceutical manufacturer and their laboratories, which must take sufficient precautions to ensure that any manufacturing documentation (data, information, etc.) related to [[good manufacturing practice]] (GMP) requirements (e.g., via E.U. GMP Annex 11, U.S. 21 CFR Part 211, or Germany's AMWHV) is securely stored yet available for a specific retention period "in the event of closure of the manufacturing or testing site where the documentation is stored."<ref name="ECACloud20">{{cite web \|url=https://www.gmp-compliance.org/gmp-news/cloud-computing-regulations-for-the-return-transmission-of-data-in-the-event-of-business-discontinuation \|title=Cloud Computing: Regulations for the Return Transmission of Data in the Event of Business Discontinuation \|work-ECA Academy \|date=16 December 2020 \|accessdate=28 July 2023}}</ref> As the ECA Academy notes, in the cloud computing realm, it would be up to the laboratory to get provisions added into the CSP's service-level agreement (SLA) to address the GMP's necessity for data availability, and to decide whether maintaining a local backup of the data would be appropriate (as in, perhaps, a hybrid cloud scenario).

		That part about the SLA is important. Although a formal contract will address agreed-upon services, it's usually in vague terms; the SLA, on the other hand, defines all the responsibility the cloud provider holds, as well as your laboratory, for the supply and use of the CSP's services.<ref name="CaldwellContracts19">{{cite web \|url=https://www.asgnational.com/miscellaneous/contracts-vs-service-level-agreements/ \|archiveurl=https://web.archive.org/web/20200930063443/https://www.asgnational.com/miscellaneous/contracts-vs-service-level-agreements/ \|title=Contracts vs. Service Level Agreements \|author=Caldwell, D. \|work=ASG Blog \|date=16 February 2019 \|archivedate=30 September 2020 \|accessdate=28 July 2023}}</ref> These are your primary protections, along with vetting the CSP you use. This may be difficult, however, particularly in a public cloud, where auditing the security controls and protections of the CSP will be limited at best. To ensure GxP compliance in the cloud, your lab will have to examine the various certifications and compliance offerings of the CSP, and hope that the CSP staff handling your GxP data are trained on the requirements of GxP in the cloud.<ref name="McDowallClouds20">{{cite web \|url=https://www.csolsinc.com/blog/clouds-or-clods-software-as-a-service-in-gxp-regulated-laboratories/ \|title=Clouds or Clods? Software as a Service in GxP Regulated Laboratories \|author=McDowall, B. \|work=CSols Blog \|publisher=CSols, Inc \|date=27 August 2020 \|accessdate=28 July 2023}}</ref> However, public cloud providers like Microsoft<ref name="MazzoliGood20">{{cite web \|url=https://learn.microsoft.com/en-us/compliance/regulatory/offering-gxp \|title=Good Clinical, Laboratory, and Manufacturing Practices (GxP) \|author=Mazzoli, R. \|work=Microsoft Documentation \|publisher=Microsoft, Inc \|date=26 January 2023 \|accessdate=28 July 2023}}</ref> and Google<ref name="GoogleUsing20">{{cite web \|url=https://cloud.google.com/security/compliance/cloud-gxp-whitepaper \|title=Using Google Cloud in GxP Systems \|publisher=Google Cloud \|date=May 2020 \|accessdate=28 July 2023}}</ref> provide their own documentation and guidance on using their services in GxP environments. As Microsoft notes, however, "there is no GxP certification for cloud service providers."<ref name="MazzoliGood20" /> Instead, the CSPs focus on meeting [[Quality management system\|quality management]] and information security standards and employing their own best practices that match up with GxP requirements. Finally, they may also have an independent third party conduct GxP qualification reviews, with the resulting qualification guidelines detailing GxP responsibility between the CSP and the laboratory.<ref name="MazzoliGood20" /><ref name="GoogleUsing20" />

		Ultimately, navigating the challenge of ensuring your laboratory's move to the cloud complies with necessary regulations is a tricky matter. Ensuring the CSP you choose actually meets HIPAA, GxP, and other requirements isn't always a guaranteed proposition by simply auditing the CSPs whitepapers and other associated compliance documents. However, experts such as Linford & Co.'s Nicole Hemmer and IDBS' Damien Tiller emphasize that the most comprehensive CSP documentation to examine towards gaining a more complete picture of the CSP's security is the SOC 2 (SOC for Service Organizations: Trust Services
		Criteria) report.<ref name="HemmerTrust19">{{cite web \|url=https://linfordco.com/blog/trust-services-critieria-principles-soc-2/ \|title=2023 Trust Services Criteria (TSCs) for SOC 2 Reports \|author=Colby, L. \|work=Linford & Company IT Audit & Compliance Blog \|publisher=Linford and Co. LLP \|date=01 February 2023 \|accessdate=28 July 2023}}</ref><ref name="TillerIsThe19">{{cite web \|url=https://storage.pardot.com/468401/1614781936jHqdU6H6/Whitepaper_Is_the_cloud_a_safe_place_for_your_data.pdf \|archiveurl=https://web.archive.org/web/20210308231558/https://storage.pardot.com/468401/1614781936jHqdU6H6/Whitepaper_Is_the_cloud_a_safe_place_for_your_data.pdf \|format=PDF \|title=Is the Cloud a Safe Place for Your Data?: How Life Science Organizations Can Ensure Integrity and Security in a SaaS Environment \|author=Tiller, D. \|publisher=IDBS \|date=2019 \|archivedate=08 March 2023 \|accessdate=28 July 2023}}</ref> A CSP's SOC 2 audit results outline nearly 200 information security, data integrity, data availability, and data retention controls and any non-conformities with those controls (the CSP must show those controls have been effectively in place over a six- to 12-month period). The SOC 2 report has other useful aspects, including a full service description and audit observations, making it the best tool for a laboratory to judge a CSP's ability to assist with regulatory compliance.<ref name="TillerIsThe19" />

Shawndouglas: Blanked the page

2022-05-05T21:23:45Z

Blanked the page

Show changes

Shawndouglas at 19:35, 5 May 2022

2022-05-05T19:35:48Z

Shawndouglas at 18:03, 5 May 2022

2022-05-05T18:03:10Z

← Older revision		Revision as of 18:03, 5 May 2022
Line 143:		Line 143:
	[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Sample Processing and Analysis Procedures for PDP (throughout)]<br />		[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Sample Processing and Analysis Procedures for PDP (throughout)]<br />
	[https://www.wada-ama.org/en/resources/world-anti-doping-program/international-standard-laboratories-isl WADA International Standard for Laboratories (ISL) (throughout)]<br />		[https://www.wada-ama.org/en/resources/world-anti-doping-program/international-standard-laboratories-isl WADA International Standard for Laboratories (ISL) (throughout)]<br />
	[https://www.wada-ama.org/en/resources/world-anti-doping-program/international-standard-~~laboratories~~-~~isl~~ WADA International Standard for the Protection of Privacy and Personal Information (ISPPPI) (throughout)]<br />		[https://www.wada-ama.org/en/resources/world-anti-doping-program/international-standard-protection-privacy-and-personal WADA International Standard for the Protection of Privacy and Personal Information (ISPPPI) (throughout)]<br />
	[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2 (throughout)]		[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2 (throughout)]
	\| style="background-color:white;" \|'''7.2''' The system shall have the ability to readily provide authorized access to electronic documents such as standard operating procedures, quality manuals, laboratory management plans, instrument manuals, employee medical records, material safety data sheets, information exchange agreements, confidentiality agreements, and other applicable documents to designated personnel and officials.		\| style="background-color:white;" \|'''7.2''' The system shall have the ability to readily provide authorized access to electronic documents such as standard operating procedures, quality manuals, laboratory management plans, instrument manuals, employee medical records, material safety data sheets, information exchange agreements, confidentiality agreements, and other applicable documents to designated personnel and officials.

Shawndouglas at 18:02, 5 May 2022

2022-05-05T18:02:18Z

← Older revision		Revision as of 18:02, 5 May 2022
Line 143:		Line 143:
	[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Sample Processing and Analysis Procedures for PDP (throughout)]<br />		[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Sample Processing and Analysis Procedures for PDP (throughout)]<br />
	[https://www.wada-ama.org/en/resources/world-anti-doping-program/international-standard-laboratories-isl WADA International Standard for Laboratories (ISL) (throughout)]<br />		[https://www.wada-ama.org/en/resources/world-anti-doping-program/international-standard-laboratories-isl WADA International Standard for Laboratories (ISL) (throughout)]<br />
			[https://www.wada-ama.org/en/resources/world-anti-doping-program/international-standard-laboratories-isl WADA International Standard for the Protection of Privacy and Personal Information (ISPPPI) (throughout)]<br />
	[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2 (throughout)]		[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2 (throughout)]
	\| style="background-color:white;" \|'''7.2''' The system shall have the ability to readily provide authorized access to electronic documents such as standard operating procedures, quality manuals, laboratory management plans, instrument manuals, employee medical records, material safety data sheets, information exchange agreements, confidentiality agreements, and other applicable documents to designated personnel and officials.		\| style="background-color:white;" \|'''7.2''' The system shall have the ability to readily provide authorized access to electronic documents such as standard operating procedures, quality manuals, laboratory management plans, instrument manuals, employee medical records, material safety data sheets, information exchange agreements, confidentiality agreements, and other applicable documents to designated personnel and officials.

Shawndouglas at 22:50, 4 May 2022

2022-05-04T22:50:23Z

Shawndouglas at 21:22, 4 May 2022

2022-05-04T21:22:08Z

Shawndouglas at 20:57, 4 May 2022

2022-05-04T20:57:17Z

← Older revision		Revision as of 19:35, 5 May 2022
Line 76:		Line 76:
	[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Data and Instrumentation for PDP (throughout)]<br />		[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Data and Instrumentation for PDP (throughout)]<br />
	[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Sample Processing and Analysis Procedures for PDP (throughout)]<br />		[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Sample Processing and Analysis Procedures for PDP (throughout)]<br />
	[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2 (throughout)]		[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #961, Annex 13 (throughout)]<br />
			[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2 (throughout)]<br />
			[https://www.gmp-compliance.org/guidelines/gmp-guideline/who-guidance-on-good-data-and-record-management-practices WHO Technical Report Series, #996, Annex 5 (throughout)]
	\| style="background-color:white;" \|'''7.1''' The system shall be capable of creating, managing, and securely holding a variety of document types, while also allowing for the review and approval of those documents using version and release controls.		\| style="background-color:white;" \|'''7.1''' The system shall be capable of creating, managing, and securely holding a variety of document types, while also allowing for the review and approval of those documents using version and release controls.
	\|-		\|-
Line 144:		Line 146:
	[https://www.wada-ama.org/en/resources/world-anti-doping-program/international-standard-laboratories-isl WADA International Standard for Laboratories (ISL) (throughout)]<br />		[https://www.wada-ama.org/en/resources/world-anti-doping-program/international-standard-laboratories-isl WADA International Standard for Laboratories (ISL) (throughout)]<br />
	[https://www.wada-ama.org/en/resources/world-anti-doping-program/international-standard-protection-privacy-and-personal WADA International Standard for the Protection of Privacy and Personal Information (ISPPPI) (throughout)]<br />		[https://www.wada-ama.org/en/resources/world-anti-doping-program/international-standard-protection-privacy-and-personal WADA International Standard for the Protection of Privacy and Personal Information (ISPPPI) (throughout)]<br />
	[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2 (throughout)]		[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #961, Annex 13 (throughout)]<br />
			[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2 (throughout)]<br />
			[https://www.gmp-compliance.org/guidelines/gmp-guideline/who-guidance-on-good-data-and-record-management-practices WHO Technical Report Series, #996, Annex 5 (throughout)]
	\| style="background-color:white;" \|'''7.2''' The system shall have the ability to readily provide authorized access to electronic documents such as standard operating procedures, quality manuals, laboratory management plans, instrument manuals, employee medical records, material safety data sheets, information exchange agreements, confidentiality agreements, and other applicable documents to designated personnel and officials.		\| style="background-color:white;" \|'''7.2''' The system shall have the ability to readily provide authorized access to electronic documents such as standard operating procedures, quality manuals, laboratory management plans, instrument manuals, employee medical records, material safety data sheets, information exchange agreements, confidentiality agreements, and other applicable documents to designated personnel and officials.
	\|-		\|-
Line 209:		Line 213:
	[https://www.ams.usda.gov/services/lab-testing/lab-approval USDA LAS Laboratory Approval Program (LAP) Policies and Procedures 12.4b]<br />		[https://www.ams.usda.gov/services/lab-testing/lab-approval USDA LAS Laboratory Approval Program (LAP) Policies and Procedures 12.4b]<br />
	[https://www.wada-ama.org/en/resources/world-anti-doping-program/international-standard-laboratories-isl WADA International Standard for Laboratories (ISL) 4.2.1 and 5.3.6]<br />		[https://www.wada-ama.org/en/resources/world-anti-doping-program/international-standard-laboratories-isl WADA International Standard for Laboratories (ISL) 4.2.1 and 5.3.6]<br />
			[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #961, Annex 13, 10.1]<br />
	[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 4.11]<br />		[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 4.11]<br />
	[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 15.13]		[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 15.13]
Line 331:		Line 336:
	[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Administrative Procedures for the PDP 6.1]<br />		[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Administrative Procedures for the PDP 6.1]<br />
	[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Sampling Procedures for PDP 6.1.2.8 and 6.1.3]<br />		[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Sampling Procedures for PDP 6.1.2.8 and 6.1.3]<br />
	[https://www.wada-ama.org/en/resources/world-anti-doping-program/international-standard-laboratories-isl WADA International Standard for Laboratories (ISL) 5.2.2]		[https://www.wada-ama.org/en/resources/world-anti-doping-program/international-standard-laboratories-isl WADA International Standard for Laboratories (ISL) 5.2.2]<br />
			[https://www.gmp-compliance.org/guidelines/gmp-guideline/who-guidance-on-good-data-and-record-management-practices WHO Technical Report Series, #996, Annex 5, 8.1]
	\| style="background-color:white;" \|'''8.1''' The system shall have the ability to create and maintain individual personnel records for tracking such things as demographics, certifications, training, evaluations, medical history, and occupational exposure.		\| style="background-color:white;" \|'''8.1''' The system shall have the ability to create and maintain individual personnel records for tracking such things as demographics, certifications, training, evaluations, medical history, and occupational exposure.
	\|-		\|-
Line 519:		Line 525:
	[https://www.pfp-ifss.org/ifss-resources/human-and-animal-food-testing-laboratories-best-practices-manual-december-2018/ PFP Human and Animal Food Testing Laboratories Best Practices Manual]<br />		[https://www.pfp-ifss.org/ifss-resources/human-and-animal-food-testing-laboratories-best-practices-manual-december-2018/ PFP Human and Animal Food Testing Laboratories Best Practices Manual]<br />
	[https://ris.dls.virginia.gov/uploads/1VAC30/dibr/Microsoft%20Word%20-%20STD-ELV1-2016-Rev2.1_LabReqs_ANSIapp.doc-20210426142653.pdf TNI EL-V1-2016-Rev.2.1 (V1,M2 4.13.3)]<br />		[https://ris.dls.virginia.gov/uploads/1VAC30/dibr/Microsoft%20Word%20-%20STD-ELV1-2016-Rev2.1_LabReqs_ANSIapp.doc-20210426142653.pdf TNI EL-V1-2016-Rev.2.1 (V1,M2 4.13.3)]<br />
	[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 15.7 and 15.9]		[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 15.7 and 15.9]<br />
			[https://www.gmp-compliance.org/guidelines/gmp-guideline/who-guidance-on-good-data-and-record-management-practices WHO Technical Report Series, #996, Annex 5 (throughout)]
	\| style="background-color:white;" \|'''9.2''' The system shall document in the audit trail any event—including administrative and privileged functions—that creates, modifies, and deletes data, including user accounts, passwords, files, directories, logs, and other system resources.		\| style="background-color:white;" \|'''9.2''' The system shall document in the audit trail any event—including administrative and privileged functions—that creates, modifies, and deletes data, including user accounts, passwords, files, directories, logs, and other system resources.
	\|-		\|-
Line 722:		Line 729:
	[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Administrative Procedures for the PDP 7.2]<br />		[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Administrative Procedures for the PDP 7.2]<br />
	[https://www.ams.usda.gov/services/lab-testing/lab-approval USDA LAS Laboratory Approval Program (LAP) Policies and Procedures 12.4j]<br />		[https://www.ams.usda.gov/services/lab-testing/lab-approval USDA LAS Laboratory Approval Program (LAP) Policies and Procedures 12.4j]<br />
	[https://www.wada-ama.org/en/resources/world-anti-doping-program/international-standard-laboratories-isl WADA International Standard for Laboratories (ISL) 4.2.1 and 5.2.4]		[https://www.wada-ama.org/en/resources/world-anti-doping-program/international-standard-laboratories-isl WADA International Standard for Laboratories (ISL) 4.2.1 and 5.2.4]<br />
			[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #961, Annex 13, 6.1]
	\| style="background-color:white;" \|'''10.13''' The system shall be able to uniquely identify each instrument and any associated components and maintain that and other information—such as manufacturer, model number, serial number, and calibration and maintenance history—within the system.		\| style="background-color:white;" \|'''10.13''' The system shall be able to uniquely identify each instrument and any associated components and maintain that and other information—such as manufacturer, model number, serial number, and calibration and maintenance history—within the system.
	\|-		\|-
Line 967:		Line 975:
	[https://ris.dls.virginia.gov/uploads/1VAC30/dibr/Microsoft%20Word%20-%20STD-ELV1-2016-Rev2.1_LabReqs_ANSIapp.doc-20210426142653.pdf TNI EL-V1-2016-Rev.2.1 (V1,M2 4.6.4)]<br />		[https://ris.dls.virginia.gov/uploads/1VAC30/dibr/Microsoft%20Word%20-%20STD-ELV1-2016-Rev2.1_LabReqs_ANSIapp.doc-20210426142653.pdf TNI EL-V1-2016-Rev.2.1 (V1,M2 4.6.4)]<br />
	[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Administrative Procedures for the PDP 7.1]<br />		[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Administrative Procedures for the PDP 7.1]<br />
			[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #961, Annex 13, 7.1 and 7.3]<br />
	[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 14.8]		[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 14.8]
	\| style="background-color:white;" \|'''15.4''' The system should provide a means for ordering inventory through a qualified vendor using a vendor master list containing approval status for order validation.		\| style="background-color:white;" \|'''15.4''' The system should provide a means for ordering inventory through a qualified vendor using a vendor master list containing approval status for order validation.
Line 1,066:		Line 1,075:
	[https://clsi.org/standards/products/quality-management-systems/documents/qms22/ CLSI QMS22 2.2.2.3]<br />		[https://clsi.org/standards/products/quality-management-systems/documents/qms22/ CLSI QMS22 2.2.2.3]<br />
	[https://www.epa.gov/quality/guidance-quality-assurance-project-plans-epa-qag-5 EPA QA/G-5 2.2.10]<br />		[https://www.epa.gov/quality/guidance-quality-assurance-project-plans-epa-qag-5 EPA QA/G-5 2.2.10]<br />
	[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 17.12]		[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 17.12]<br />
			[https://www.gmp-compliance.org/guidelines/gmp-guideline/who-guidance-on-good-data-and-record-management-practices WHO Technical Report Series, #996, Annex 5, 11.12]
	\| style="background-color:white;" \|'''16.5''' The system should trigger an alert or notification when an OOS/OOT status is found, indicating a delay in processing and prompting a documented investigation to identify the root cause.		\| style="background-color:white;" \|'''16.5''' The system should trigger an alert or notification when an OOS/OOT status is found, indicating a delay in processing and prompting a documented investigation to identify the root cause.
	\|-		\|-
Line 1,088:		Line 1,098:
	[https://www.ams.usda.gov/services/lab-testing/lab-approval USDA LAS Laboratory Approval Program (LAP) Policies and Procedures 12.4h]<br />		[https://www.ams.usda.gov/services/lab-testing/lab-approval USDA LAS Laboratory Approval Program (LAP) Policies and Procedures 12.4h]<br />
	[https://www.wada-ama.org/en/resources/world-anti-doping-program/international-standard-laboratories-isl WADA International Standard for Laboratories (ISL) 5.3.9]<br />		[https://www.wada-ama.org/en/resources/world-anti-doping-program/international-standard-laboratories-isl WADA International Standard for Laboratories (ISL) 5.3.9]<br />
			[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #961, Annex 13, 11.1]<br />
	[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 2.1 (f, j)]<br />		[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 2.1 (f, j)]<br />
	[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 5.0]		[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 5.0]<br />
			[https://www.gmp-compliance.org/guidelines/gmp-guideline/who-guidance-on-good-data-and-record-management-practices WHO Technical Report Series, #996, Annex 5, 11.12]
	\| style="background-color:white;" \|'''16.6''' The system shall allow for the documentation of and corrective and preventive action towards all types of nonconformance.		\| style="background-color:white;" \|'''16.6''' The system shall allow for the documentation of and corrective and preventive action towards all types of nonconformance.
	\|-		\|-

← Older revision		Revision as of 22:50, 4 May 2022
Line 142:		Line 142:
	[https://www.ams.usda.gov/services/lab-testing/lab-approval USDA LAS Laboratory Approval Program (LAP) Policies and Procedures 12.3]<br />		[https://www.ams.usda.gov/services/lab-testing/lab-approval USDA LAS Laboratory Approval Program (LAP) Policies and Procedures 12.3]<br />
	[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Sample Processing and Analysis Procedures for PDP (throughout)]<br />		[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Sample Processing and Analysis Procedures for PDP (throughout)]<br />
			[https://www.wada-ama.org/en/resources/world-anti-doping-program/international-standard-laboratories-isl WADA International Standard for Laboratories (ISL) (throughout)]<br />
	[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2 (throughout)]		[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2 (throughout)]
	\| style="background-color:white;" \|'''7.2''' The system shall have the ability to readily provide authorized access to electronic documents such as standard operating procedures, quality manuals, laboratory management plans, instrument manuals, employee medical records, material safety data sheets, information exchange agreements, confidentiality agreements, and other applicable documents to designated personnel and officials.		\| style="background-color:white;" \|'''7.2''' The system shall have the ability to readily provide authorized access to electronic documents such as standard operating procedures, quality manuals, laboratory management plans, instrument manuals, employee medical records, material safety data sheets, information exchange agreements, confidentiality agreements, and other applicable documents to designated personnel and officials.
Line 184:		Line 185:
	[https://www.ams.usda.gov/sites/default/files/media/TestingGuidelinesforHemp.pdf USDA Hemp Production Program Laboratory Testing Guidelines, Summary of Practice 1.2]<br />		[https://www.ams.usda.gov/sites/default/files/media/TestingGuidelinesforHemp.pdf USDA Hemp Production Program Laboratory Testing Guidelines, Summary of Practice 1.2]<br />
	[https://www.ams.usda.gov/sites/default/files/media/TestingGuidelinesforHemp.pdf USDA Hemp Production Program Laboratory Testing Guidelines, Testing Methods 3]<br />		[https://www.ams.usda.gov/sites/default/files/media/TestingGuidelinesforHemp.pdf USDA Hemp Production Program Laboratory Testing Guidelines, Testing Methods 3]<br />
			[https://www.wada-ama.org/en/resources/world-anti-doping-program/international-standard-laboratories-isl WADA International Standard for Laboratories (ISL) 4.2.1]<br />
	[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 15.14]		[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 15.14]
	\| style="background-color:white;" \|'''7.5''' The system shall allow the creation, approval, rejection, and management of sampling and test methods performed at the laboratory, capturing details about the test method, method reference, specifications, assigned limits, holding times, etc. as required by a reference method or regulation.		\| style="background-color:white;" \|'''7.5''' The system shall allow the creation, approval, rejection, and management of sampling and test methods performed at the laboratory, capturing details about the test method, method reference, specifications, assigned limits, holding times, etc. as required by a reference method or regulation.
Line 205:		Line 207:
	[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Administrative Procedures for the PDP 8.4]<br />		[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Administrative Procedures for the PDP 8.4]<br />
	[https://www.ams.usda.gov/services/lab-testing/lab-approval USDA LAS Laboratory Approval Program (LAP) Policies and Procedures 12.4b]<br />		[https://www.ams.usda.gov/services/lab-testing/lab-approval USDA LAS Laboratory Approval Program (LAP) Policies and Procedures 12.4b]<br />
			[https://www.wada-ama.org/en/resources/world-anti-doping-program/international-standard-laboratories-isl WADA International Standard for Laboratories (ISL) 4.2.1 and 5.3.6]<br />
	[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 4.11]<br />		[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 4.11]<br />
	[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 15.13]		[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 15.13]
Line 274:		Line 277:
	[https://ris.dls.virginia.gov/uploads/1VAC30/dibr/Microsoft%20Word%20-%20STD-ELV1-2016-Rev2.1_LabReqs_ANSIapp.doc-20210426142653.pdf TNI EL-V1-2016-Rev.2.1 (V1,M2 4.13.3)]<br />		[https://ris.dls.virginia.gov/uploads/1VAC30/dibr/Microsoft%20Word%20-%20STD-ELV1-2016-Rev2.1_LabReqs_ANSIapp.doc-20210426142653.pdf TNI EL-V1-2016-Rev.2.1 (V1,M2 4.13.3)]<br />
	[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Administrative Procedures for the PDP 6.1]<br />		[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Administrative Procedures for the PDP 6.1]<br />
			[https://www.wada-ama.org/en/resources/world-anti-doping-program/international-standard-laboratories-isl WADA International Standard for Laboratories (ISL) 5.2.2]
	\| style="background-color:white;" \|'''7.7''' The system shall maintain training and certification records for personnel and allow the assignment of available training paths and certifications to specific personnel, such that only trained, certified, and experienced personnel are able to perform assigned tasks.		\| style="background-color:white;" \|'''7.7''' The system shall maintain training and certification records for personnel and allow the assignment of available training paths and certifications to specific personnel, such that only trained, certified, and experienced personnel are able to perform assigned tasks.
	\|-		\|-
Line 325:		Line 329:
	[https://ris.dls.virginia.gov/uploads/1VAC30/dibr/Microsoft%20Word%20-%20STD-ELV1-2016-Rev2.1_LabReqs_ANSIapp.doc-20210426142653.pdf TNI EL-V1-2016-Rev.2.1 (V1,M2 5.2)]<br />		[https://ris.dls.virginia.gov/uploads/1VAC30/dibr/Microsoft%20Word%20-%20STD-ELV1-2016-Rev2.1_LabReqs_ANSIapp.doc-20210426142653.pdf TNI EL-V1-2016-Rev.2.1 (V1,M2 5.2)]<br />
	[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Administrative Procedures for the PDP 6.1]<br />		[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Administrative Procedures for the PDP 6.1]<br />
	[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Sampling Procedures for PDP 6.1.2.8 and 6.1.3]		[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Sampling Procedures for PDP 6.1.2.8 and 6.1.3]<br />
			[https://www.wada-ama.org/en/resources/world-anti-doping-program/international-standard-laboratories-isl WADA International Standard for Laboratories (ISL) 5.2.2]
	\| style="background-color:white;" \|'''8.1''' The system shall have the ability to create and maintain individual personnel records for tracking such things as demographics, certifications, training, evaluations, medical history, and occupational exposure.		\| style="background-color:white;" \|'''8.1''' The system shall have the ability to create and maintain individual personnel records for tracking such things as demographics, certifications, training, evaluations, medical history, and occupational exposure.
	\|-		\|-
Line 333:		Line 338:
	[https://eur-lex.europa.eu/eli/dir/2003/94/oj E.U. Commission Directive 2003/94/EC Article 13]<br />		[https://eur-lex.europa.eu/eli/dir/2003/94/oj E.U. Commission Directive 2003/94/EC Article 13]<br />
	[https://ris.dls.virginia.gov/uploads/1VAC30/dibr/Microsoft%20Word%20-%20STD-ELV1-2016-Rev2.1_LabReqs_ANSIapp.doc-20210426142653.pdf TNI EL-V1-2016-Rev.2.1 (V1,M2 4.8)]<br />		[https://ris.dls.virginia.gov/uploads/1VAC30/dibr/Microsoft%20Word%20-%20STD-ELV1-2016-Rev2.1_LabReqs_ANSIapp.doc-20210426142653.pdf TNI EL-V1-2016-Rev.2.1 (V1,M2 4.8)]<br />
			[https://www.wada-ama.org/en/resources/world-anti-doping-program/international-standard-laboratories-isl WADA International Standard for Laboratories (ISL) 5.3.10]<br />
	[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 2.1 (j)]<br />		[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 2.1 (j)]<br />
	[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 5.0]		[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 5.0]
Line 396:		Line 402:
	[https://www.ams.usda.gov/services/lab-testing/lab-approval USDA LAS Laboratory Approval Program (LAP) Policies and Procedures 12.4e]<br />		[https://www.ams.usda.gov/services/lab-testing/lab-approval USDA LAS Laboratory Approval Program (LAP) Policies and Procedures 12.4e]<br />
	[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Sampling Procedures for PDP 6.1.2.8 and 6.1.3]<br />		[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Sampling Procedures for PDP 6.1.2.8 and 6.1.3]<br />
			[https://www.wada-ama.org/en/resources/world-anti-doping-program/international-standard-laboratories-isl WADA International Standard for Laboratories (ISL) 5.2.2]<br />
	[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 2.1 (e)]<br />		[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 2.1 (e)]<br />
	[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 9.4]<br />		[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 9.4]<br />
Line 645:		Line 652:
	[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Data and Instrumentation for PDP 5.2]<br />		[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Data and Instrumentation for PDP 5.2]<br />
	[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Data and Instrumentation for PDP 6]<br />		[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Data and Instrumentation for PDP 6]<br />
			[https://www.wada-ama.org/en/resources/world-anti-doping-program/international-standard-laboratories-isl WADA International Standard for Laboratories (ISL) 5.2.4]<br />
	[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 13.5]<br />		[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 13.5]<br />
	[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 16.23]		[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 16.23]
Line 712:		Line 720:
	[https://ris.dls.virginia.gov/uploads/1VAC30/dibr/Microsoft%20Word%20-%20STD-ELV1-2016-Rev2.1_LabReqs_ANSIapp.doc-20210426142653.pdf TNI EL-V1-2016-Rev.2.1 (V1,M2 5.5)]<br />		[https://ris.dls.virginia.gov/uploads/1VAC30/dibr/Microsoft%20Word%20-%20STD-ELV1-2016-Rev2.1_LabReqs_ANSIapp.doc-20210426142653.pdf TNI EL-V1-2016-Rev.2.1 (V1,M2 5.5)]<br />
	[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Administrative Procedures for the PDP 7.2]<br />		[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Administrative Procedures for the PDP 7.2]<br />
	[https://www.ams.usda.gov/services/lab-testing/lab-approval USDA LAS Laboratory Approval Program (LAP) Policies and Procedures 12.4j]		[https://www.ams.usda.gov/services/lab-testing/lab-approval USDA LAS Laboratory Approval Program (LAP) Policies and Procedures 12.4j]<br />
			[https://www.wada-ama.org/en/resources/world-anti-doping-program/international-standard-laboratories-isl WADA International Standard for Laboratories (ISL) 4.2.1 and 5.2.4]
	\| style="background-color:white;" \|'''10.13''' The system shall be able to uniquely identify each instrument and any associated components and maintain that and other information—such as manufacturer, model number, serial number, and calibration and maintenance history—within the system.		\| style="background-color:white;" \|'''10.13''' The system shall be able to uniquely identify each instrument and any associated components and maintain that and other information—such as manufacturer, model number, serial number, and calibration and maintenance history—within the system.
	\|-		\|-
Line 754:		Line 763:
	[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Data and Instrumentation for PDP 5.4]<br />		[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Data and Instrumentation for PDP 5.4]<br />
	[https://www.ams.usda.gov/services/lab-testing/lab-approval USDA LAS Laboratory Approval Program (LAP) Policies and Procedures 12.4c]<br />		[https://www.ams.usda.gov/services/lab-testing/lab-approval USDA LAS Laboratory Approval Program (LAP) Policies and Procedures 12.4c]<br />
			[https://www.wada-ama.org/en/resources/world-anti-doping-program/international-standard-laboratories-isl WADA International Standard for Laboratories (ISL) 5.2.4]<br />
	[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 15.46]<br />		[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 15.46]<br />
	[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 16.23]		[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 16.23]
Line 1,041:		Line 1,051:
	[https://ris.dls.virginia.gov/uploads/1VAC30/dibr/Microsoft%20Word%20-%20STD-ELV1-2016-Rev2.1_LabReqs_ANSIapp.doc-20210426142653.pdf TNI EL-V1-2016-Rev.2.1 (V1,M2 4.9 and 5.7.2)]<br />		[https://ris.dls.virginia.gov/uploads/1VAC30/dibr/Microsoft%20Word%20-%20STD-ELV1-2016-Rev2.1_LabReqs_ANSIapp.doc-20210426142653.pdf TNI EL-V1-2016-Rev.2.1 (V1,M2 4.9 and 5.7.2)]<br />
	[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Administrative Procedures for the PDP 8.2.2]<br />		[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Administrative Procedures for the PDP 8.2.2]<br />
			[https://www.wada-ama.org/en/resources/world-anti-doping-program/international-standard-laboratories-isl WADA International Standard for Laboratories (ISL) 5.3.6]<br />
	[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 16.3]		[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 16.3]
	\| style="background-color:white;" \|'''16.3''' The system shall be able to record instances of identified nonconformance and method deviation, as well as the actions required to restore the process to conformity. In the case of a planned deviation, the system shall require documentation, justification, proof of validation, adjusted reference intervals, and authorization for the deviated process.		\| style="background-color:white;" \|'''16.3''' The system shall be able to record instances of identified nonconformance and method deviation, as well as the actions required to restore the process to conformity. In the case of a planned deviation, the system shall require documentation, justification, proof of validation, adjusted reference intervals, and authorization for the deviated process.
Line 1,075:		Line 1,086:
	[https://ris.dls.virginia.gov/uploads/1VAC30/dibr/Microsoft%20Word%20-%20STD-ELV1-2016-Rev2.1_LabReqs_ANSIapp.doc-20210426142653.pdf TNI EL-V1-2016-Rev.2.1 (throughout)]<br />		[https://ris.dls.virginia.gov/uploads/1VAC30/dibr/Microsoft%20Word%20-%20STD-ELV1-2016-Rev2.1_LabReqs_ANSIapp.doc-20210426142653.pdf TNI EL-V1-2016-Rev.2.1 (throughout)]<br />
	[https://www.ams.usda.gov/services/lab-testing/lab-approval USDA LAS Laboratory Approval Program (LAP) Policies and Procedures 12.4h]<br />		[https://www.ams.usda.gov/services/lab-testing/lab-approval USDA LAS Laboratory Approval Program (LAP) Policies and Procedures 12.4h]<br />
			[https://www.wada-ama.org/en/resources/world-anti-doping-program/international-standard-laboratories-isl WADA International Standard for Laboratories (ISL) 5.3.9]<br />
	[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 2.1 (f, j)]<br />		[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 2.1 (f, j)]<br />
	[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 5.0]		[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 5.0]

← Older revision		Revision as of 21:22, 4 May 2022
Line 140:		Line 140:
	[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Data and Instrumentation for PDP (throughout)]<br />		[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Data and Instrumentation for PDP (throughout)]<br />
	[https://www.ams.usda.gov/sites/default/files/media/TestingGuidelinesforHemp.pdf USDA Hemp Production Program Laboratory Testing Guidelines (throughout)]<br />		[https://www.ams.usda.gov/sites/default/files/media/TestingGuidelinesforHemp.pdf USDA Hemp Production Program Laboratory Testing Guidelines (throughout)]<br />
			[https://www.ams.usda.gov/services/lab-testing/lab-approval USDA LAS Laboratory Approval Program (LAP) Policies and Procedures 12.3]<br />
	[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Sample Processing and Analysis Procedures for PDP (throughout)]<br />		[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Sample Processing and Analysis Procedures for PDP (throughout)]<br />
	[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2 (throughout)]		[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2 (throughout)]
Line 203:		Line 204:
	[https://ris.dls.virginia.gov/uploads/1VAC30/dibr/Microsoft%20Word%20-%20STD-ELV1-2016-Rev2.1_LabReqs_ANSIapp.doc-20210426142653.pdf TNI EL-V1-2016-Rev.2.1 (V1,M2 4.13.2.3)]<br />		[https://ris.dls.virginia.gov/uploads/1VAC30/dibr/Microsoft%20Word%20-%20STD-ELV1-2016-Rev2.1_LabReqs_ANSIapp.doc-20210426142653.pdf TNI EL-V1-2016-Rev.2.1 (V1,M2 4.13.2.3)]<br />
	[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Administrative Procedures for the PDP 8.4]<br />		[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Administrative Procedures for the PDP 8.4]<br />
			[https://www.ams.usda.gov/services/lab-testing/lab-approval USDA LAS Laboratory Approval Program (LAP) Policies and Procedures 12.4b]<br />
	[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 4.11]<br />		[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 4.11]<br />
	[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 15.13]		[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 15.13]
Line 392:		Line 394:
	[https://ris.dls.virginia.gov/uploads/1VAC30/dibr/Microsoft%20Word%20-%20STD-ELV1-2016-Rev2.1_LabReqs_ANSIapp.doc-20210426142653.pdf TNI EL-V1-2016-Rev.2.1 (V1,M2 5.2)]<br />		[https://ris.dls.virginia.gov/uploads/1VAC30/dibr/Microsoft%20Word%20-%20STD-ELV1-2016-Rev2.1_LabReqs_ANSIapp.doc-20210426142653.pdf TNI EL-V1-2016-Rev.2.1 (V1,M2 5.2)]<br />
	[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Administrative Procedures for the PDP 6.1]<br />		[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Administrative Procedures for the PDP 6.1]<br />
			[https://www.ams.usda.gov/services/lab-testing/lab-approval USDA LAS Laboratory Approval Program (LAP) Policies and Procedures 12.4e]<br />
	[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Sampling Procedures for PDP 6.1.2.8 and 6.1.3]<br />		[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Sampling Procedures for PDP 6.1.2.8 and 6.1.3]<br />
	[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 2.1 (e)]<br />		[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 2.1 (e)]<br />
Line 708:		Line 711:
	[https://www.wadsworth.org/regulatory/clep/clinical-labs/laboratory-standards NYSDOH CLEP Clinical Laboratory Standards of Practice, General Systems Standards]<br />		[https://www.wadsworth.org/regulatory/clep/clinical-labs/laboratory-standards NYSDOH CLEP Clinical Laboratory Standards of Practice, General Systems Standards]<br />
	[https://ris.dls.virginia.gov/uploads/1VAC30/dibr/Microsoft%20Word%20-%20STD-ELV1-2016-Rev2.1_LabReqs_ANSIapp.doc-20210426142653.pdf TNI EL-V1-2016-Rev.2.1 (V1,M2 5.5)]<br />		[https://ris.dls.virginia.gov/uploads/1VAC30/dibr/Microsoft%20Word%20-%20STD-ELV1-2016-Rev2.1_LabReqs_ANSIapp.doc-20210426142653.pdf TNI EL-V1-2016-Rev.2.1 (V1,M2 5.5)]<br />
	[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Administrative Procedures for the PDP 7.2]		[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Administrative Procedures for the PDP 7.2]<br />
			[https://www.ams.usda.gov/services/lab-testing/lab-approval USDA LAS Laboratory Approval Program (LAP) Policies and Procedures 12.4j]
	\| style="background-color:white;" \|'''10.13''' The system shall be able to uniquely identify each instrument and any associated components and maintain that and other information—such as manufacturer, model number, serial number, and calibration and maintenance history—within the system.		\| style="background-color:white;" \|'''10.13''' The system shall be able to uniquely identify each instrument and any associated components and maintain that and other information—such as manufacturer, model number, serial number, and calibration and maintenance history—within the system.
	\|-		\|-
Line 749:		Line 753:
	[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Administrative Procedures for the PDP 5.2.4]<br />		[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Administrative Procedures for the PDP 5.2.4]<br />
	[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Data and Instrumentation for PDP 5.4]<br />		[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Data and Instrumentation for PDP 5.4]<br />
			[https://www.ams.usda.gov/services/lab-testing/lab-approval USDA LAS Laboratory Approval Program (LAP) Policies and Procedures 12.4c]<br />
	[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 15.46]<br />		[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 15.46]<br />
	[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 16.23]		[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 16.23]
Line 1,069:		Line 1,074:
	[https://www.pfp-ifss.org/ifss-resources/human-and-animal-food-testing-laboratories-best-practices-manual-december-2018/ PFP Human and Animal Food Testing Laboratories Best Practices Manual]<br />		[https://www.pfp-ifss.org/ifss-resources/human-and-animal-food-testing-laboratories-best-practices-manual-december-2018/ PFP Human and Animal Food Testing Laboratories Best Practices Manual]<br />
	[https://ris.dls.virginia.gov/uploads/1VAC30/dibr/Microsoft%20Word%20-%20STD-ELV1-2016-Rev2.1_LabReqs_ANSIapp.doc-20210426142653.pdf TNI EL-V1-2016-Rev.2.1 (throughout)]<br />		[https://ris.dls.virginia.gov/uploads/1VAC30/dibr/Microsoft%20Word%20-%20STD-ELV1-2016-Rev2.1_LabReqs_ANSIapp.doc-20210426142653.pdf TNI EL-V1-2016-Rev.2.1 (throughout)]<br />
			[https://www.ams.usda.gov/services/lab-testing/lab-approval USDA LAS Laboratory Approval Program (LAP) Policies and Procedures 12.4h]<br />
	[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 2.1 (f, j)]<br />		[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 2.1 (f, j)]<br />
	[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 5.0]		[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 5.0]

← Older revision		Revision as of 20:57, 4 May 2022
Line 139:		Line 139:
	[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Administrative Procedures for the PDP (throughout)]<br />		[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Administrative Procedures for the PDP (throughout)]<br />
	[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Data and Instrumentation for PDP (throughout)]<br />		[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Data and Instrumentation for PDP (throughout)]<br />
			[https://www.ams.usda.gov/sites/default/files/media/TestingGuidelinesforHemp.pdf USDA Hemp Production Program Laboratory Testing Guidelines (throughout)]<br />
	[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Sample Processing and Analysis Procedures for PDP (throughout)]<br />		[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Sample Processing and Analysis Procedures for PDP (throughout)]<br />
	[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2 (throughout)]		[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2 (throughout)]
Line 180:		Line 181:
	[https://ris.dls.virginia.gov/uploads/1VAC30/dibr/Microsoft%20Word%20-%20STD-ELV1-2016-Rev2.1_LabReqs_ANSIapp.doc-20210426142653.pdf TNI EL-V1-2016-Rev.2.1 (V1,M2 5.4)]<br />		[https://ris.dls.virginia.gov/uploads/1VAC30/dibr/Microsoft%20Word%20-%20STD-ELV1-2016-Rev2.1_LabReqs_ANSIapp.doc-20210426142653.pdf TNI EL-V1-2016-Rev.2.1 (V1,M2 5.4)]<br />
	[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Administrative Procedures for the PDP 8.4]<br />		[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Administrative Procedures for the PDP 8.4]<br />
			[https://www.ams.usda.gov/sites/default/files/media/TestingGuidelinesforHemp.pdf USDA Hemp Production Program Laboratory Testing Guidelines, Summary of Practice 1.2]<br />
			[https://www.ams.usda.gov/sites/default/files/media/TestingGuidelinesforHemp.pdf USDA Hemp Production Program Laboratory Testing Guidelines, Testing Methods 3]<br />
	[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 15.14]		[https://extranet.who.int/pqweb/medicines/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 15.14]
	\| style="background-color:white;" \|'''7.5''' The system shall allow the creation, approval, rejection, and management of sampling and test methods performed at the laboratory, capturing details about the test method, method reference, specifications, assigned limits, holding times, etc. as required by a reference method or regulation.		\| style="background-color:white;" \|'''7.5''' The system shall allow the creation, approval, rejection, and management of sampling and test methods performed at the laboratory, capturing details about the test method, method reference, specifications, assigned limits, holding times, etc. as required by a reference method or regulation.
Line 960:		Line 963:
	[https://www.astm.org/e1578-18.html ASTM E1578-18 E-8-5]<br />		[https://www.astm.org/e1578-18.html ASTM E1578-18 E-8-5]<br />
	[https://www.wadsworth.org/regulatory/clep/clinical-labs/laboratory-standards NYSDOH CLEP Clinical Laboratory Standards of Practice, General Systems Standards]<br />		[https://www.wadsworth.org/regulatory/clep/clinical-labs/laboratory-standards NYSDOH CLEP Clinical Laboratory Standards of Practice, General Systems Standards]<br />
	[https://ris.dls.virginia.gov/uploads/1VAC30/dibr/Microsoft%20Word%20-%20STD-ELV1-2016-Rev2.1_LabReqs_ANSIapp.doc-20210426142653.pdf TNI EL-V1-2016-Rev.2.1 (V1,M2 4.6.2)]		[https://ris.dls.virginia.gov/uploads/1VAC30/dibr/Microsoft%20Word%20-%20STD-ELV1-2016-Rev2.1_LabReqs_ANSIapp.doc-20210426142653.pdf TNI EL-V1-2016-Rev.2.1 (V1,M2 4.6.2)]<br />
			[https://www.ams.usda.gov/sites/default/files/media/TestingGuidelinesforHemp.pdf USDA Hemp Production Program Laboratory Testing Guidelines, Summary of Practice 1.5]
	\| style="background-color:white;" \|'''15.5''' The system should provide a means for accurately recording the receipt, approval, distribution, and disposal of materials.		\| style="background-color:white;" \|'''15.5''' The system should provide a means for accurately recording the receipt, approval, distribution, and disposal of materials.
	\|-		\|-