User:Shawndouglas/sandbox/sublevel17

Sandbox begins below

Title: What are the key elements of a LIMS to better comply with ISO/IEC 17025?

Author for citation: Shawn E. Douglas

License for content: Creative Commons Attribution-ShareAlike 4.0 International

Publication date: TBD

Introduction

This article will turn to LIMSpec—a laboratory informatics requirements specification document that has evolved significantly over the years—for input into what the base and specialty requirements of a LIMS are in regards to better complying with ISO/IEC 17025. With the current version of LIMSpec having at its core standards such as ASTM E1578-18 Standard Guide for Laboratory Informatics and ISO/IEC 17025 Testing and calibration laboratories, the LIMSpec makes for a durable requirements document that, when used to acquire an informatics solution, can better help a laboratory choose appropriate functionality based upon current standards, regulations, guidance, and more. In particular, this article will look at the touch points of ISO/IEC 17025 with LIMSpec and highlight their importance.

But before we get into specific requirements, let's take a brief look at the connection between a laboratory informatics solution like a laboratory information management system (LIMS) and managing quality in the laboratory.

ISO/IEC 17025 and its connection to various LIMS requirements

Table 1. ISO/IEC 17025:2017's parts that relate to and drive LIMSpec requirements. ISO/IEC 17025:2017 part(s) Associated LIMSpec requirement In plain terms ... ISO/IEC 17025:2017 7.3.3 1.9 The system shall be able to define the collection and sampling details for registered samples or specimens, including container size and type, number of containers, collection date and time, temperature, name of the collector, lot number, storage location, preservation method, collection methods used (standard and nonstandard), sampling methods used, safety concerns, and retention period. Complete capture of data and metadata about a registered sample: A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS allows the lab to completely capture the details of incoming samples or specimens (herein shortened to simply "sample"). There are numerous data and metadata aspects of sample or specimen collection, and the LIMS should be flexible enough to capture any necessary details as part of entry into the system. ISO/IEC 17025:2017 7.4.2 1.13 The system shall assign each sample registered in the system a unique identifier using methodologies such as an ID with an incrementing integer or a user-defined naming format. Unique sample identifiers: A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS allows a unique and perpetual identifier to be assigned to each sample, including any sub-samples collected from the main sample. ISO/IEC 17025:2017 7.4.3 1.16 The system should provide a means to document any undesirable or unexpected characteristics of a submitted sample. Free-form reception-based sample data: A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS allows an authorized user to enter free-form data as it relates to a registered sample, including the state of the sample upon arrival and what, if anything, was wrong with the sample when received. ISO/IEC 17025:2017 7.4.2 2.8 The system should allow for the accurate identification of a physical sample or specimen in the system via barcode or RFID technology. Barcode and RFID support: A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS provides a means of issuing a unique barcode or some other scannable identifier—typically for improving automation or workflows—to a sample or sub-sample, all while linking the complete sample record to that barcode or scannable identifier such that it can be reviewed upon scanning by an authorized individual or acted upon by an automated system. ISO/IEC 17025:2017 7.7.2 2.11 The system shall allow samples, specimens, and tests to be created and used specifically for capturing data related to unique forms of sampling and testing such as representative sampling, calibration testing, quality control testing, preventative maintenance testing, stability testing, sterility testing, remediated testing, compatibility testing, identity testing, proficiency testing, and service-event-related testing. Support a sufficiently wide selection of unique sample types and analytical test methods: A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS is flexible enough to support, at a bare minimum, a wide variety of sample types and test methods, particularly those mandated by standards and regulations. More optimally, the LIMS will come preconfigured to a wide array of sample types and test methods, while allowing authorized users to easily and efficiently add new sample types and test methods to meet regulatory and laboratory business goals. ISO/IEC 17025:2017 6.2.6 ISO/IEC 17025:2017 7.7.1 ISO/IEC 17025:2017 7.8.1.1 4.4 The system shall provide one or more levels of review, as well as interpretation and documentation of results—whether entered manually or via an automated process—before release. Multi-level review of test results: A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS can programmatically require an analytical test result to be held in the system, unable to move on through the workflow, until one or more levels of review and approval have been made, whether it be by authorized human or automated process. ISO/IEC 17025:2017 7.5.1 ISO/IEC 17025:2017 7.8.1.1 ISO/IEC 17025:2017 7.8.2.1 ISO/IEC 17025:2017 7.8.3.1 6.5 The system shall substantiate the status of verified results by using tools like a certificate of analysis, which shall include details like unique identifiers; analysis procedures used; reference intervals; environmental conditions; who provided the results; additional comments, opinions, and interpretations and who provided them; and applicable times and dates. Support for certificates of analysis or similar verification documents: A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS is pre-configured to build out certificates of analysis (COAs) and other results verification documents. The COA and other verification documents will ideally be populated with data and metadata relevant to meeting specific industry or regulatory needs, in a format that is consistent and legally durable for its recipient. ISO/IEC 17025:2017 7.8.8 6.9 The system shall clearly identify a changed, amended, or re-issued report as being such, and clearly identify any change of information and reason for change in such a report. Support for changed, amended, or re-issued reports: A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS places a demand on analytical reports changed, amended, or re-issued in the LIMS such that they can't be issued without making readily apparent to the recipient what was changed and why it was changed. ISO/IEC 17025:2017 5.3 ISO/IEC 17025:2017 5.5 ISO/IEC 17025:2017 8.3.2 7.1 The system shall be capable of creating, managing, and securely holding a variety of document types, while also allowing for the review and approval of those documents using version and release controls. Document management, with versioning and release controls: A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS provides robust support for the creation, upload, management, and retaining of a diverse array of document types in the LIMS. The lab also benefits when the LIMS supports versioning of documents and provides approval and release controls to authorized users. ISO/IEC 17025:2017 (throughout) 7.2 The system shall have the ability to readily provide authorized access to electronic documents such as standard operating procedures, quality manuals, laboratory management plans, instrument manuals, employee medical records, material safety data sheets, information exchange agreements, confidentiality agreements, and other applicable documents to designated personnel and officials. Authorized document access: A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS not only provides robust document management support, but also is able to provide rapid access to housed documents for authorized users and officials. (This is usually supported by role-based access; see 34.4.) ISO/IEC 17025:2017 7.5.2 ISO/IEC 17025:2017 8.3.2 7.3 The system shall be able to clearly provide the most current version of a document and archive prior versions. Provision of the most current document version: A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS limits access to only the most currently approved version of a document, unless the user is authorized to specifically view older archived versions of the document. If so, the LIMS shall clearly denote that it's an older, archived version. ISO/IEC 17025:2017 6.5 ISO/IEC 17025:2017 7.2.1.3 ISO/IEC 17025:2017 7.3.1–2 7.5 The system shall allow the creation, approval, rejection, and management of sampling and test methods performed at the laboratory, capturing details about the test method, method reference, specifications, assigned limits, holding times, etc. as required by a reference method or regulation. Robust sampling and test method development: A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS is flexible enough to allow authorized users to create, approve, reject, and manage changes to sampling and test methods in the system, including the addition of all necessary descriptive data and metadata as required by a reference method or regulation. Some of that descriptive data may be free-form, and the LIMS should support that. (Tangentially related to 2.11.) ISO/IEC 17025:2017 6.2.6 ISO/IEC 17025:2017 7.2.2.1 ISO/IEC 17025:2017 7.2.2.4 7.6 The system shall provide a means for recording validation information for modified existing or new in-house test methods, either as a method itself or through some other means. Validation information such as procedures used, specifications, performance characteristics, and results obtained shall be allowed as input. Validation of sampling and test methods: A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS requires newly added or modified sampling and test methods to be properly validated before being put into use, while requiring the entry of all necessary specifics of the validation process for verification by authorized individuals. ISO/IEC 17025:2017 6.2.2 ISO/IEC 17025:2017 6.2.3 ISO/IEC 17025:2017 6.2.5 ISO/IEC 17025:2017 6.2.6 7.7 The system shall maintain training and certification records for personnel and allow the assignment of available training paths and certifications to specific personnel, such that only trained, certified, and experienced personnel are able to perform assigned tasks. Support for training and certification records: A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS has a mechanism for adding training and certification records for personnel and contractors and associating those records with those individuals. Those records must have internal flags that can be tied to one or more actions in the system, such that only users with those flags (associated with the training and certification records) can perform those system actions or be scheduled for certain laboratory activities. ISO/IEC 17025:2017 8.3.2 7.10 The system shall be capable of uniquely identifying documents created in and added to the system. Support for unique document identifiers: A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS automatically attaches a unique identifier to documents created in and uploaded to the system, including new versions of existing documents. ISO/IEC 17025:2017 7.9 8.2 The system shall allow authorized personnel to document complaints and problems reported to the laboratory or production facility. Complaint and problem management: A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS has a mechanism that allows authorized users to enter, in a consistent fashion, formal complaints and problems originating from within or related to the laboratory. Ideally, the LIMS will also allow the appropriate and authorized management of existing complaints and problems entered into the system such that proof can be made of not only who filed the complaint but also who marked the complaint as resolved. ISO/IEC 17025:2017 6.2.2 ISO/IEC 17025:2017 6.2.3 ISO/IEC 17025:2017 6.2.5 ISO/IEC 17025:2017 6.2.6 8.8 The system shall map available system tasks (such as approved test methods) or sample types (such as select agents and toxins) to available training paths and certifications, such that only trained, certified, and experienced personnel are able to perform assigned tasks. Support for mapping professional requirements to existing system tasks, sample types, and methods: A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS has a means to generically link a training or certification type to a performable system action, a sample type, or a method (as well as other things). As such, a user with that training and certification would be permitted to perform activities related to the action, sample, or method. (Tangentially related to 7.7.) ISO/IEC 17025:2017 6.4.7 ISO/IEC 17025:2017 6.4.8 10.7 The system shall allow for the configuration of calibration and maintenance frequency and time frames for—as well as the manual and automatic scheduling of calibration or maintenance of—equipment, instruments, and systems. Available intervals should include days, weeks, months, and years. Support for scheduled, frequency-based calibration and maintenance: A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS supports manual and automated scheduling of calibration and maintenance activities at a designated and relatively granular frequency, preferably notifying assigned individuals in advance of such activities. ISO/IEC 17025:2017 6.4.4 ISO/IEC 17025:2017 6.4.9 10.9 The system shall clearly identify any instrument that is out-of-calibration, beyond its preventative maintenance due date, or under investigation and prevent it from being selected for use. Instrument lock-out: A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS is capable of locking out a linked instrument and preventing its use in any system activities when certain criteria have been met. Common criteria includes not having been calibrated by a due date, not having been maintained by a due date, or an authorized user designating the instrument as unusable or under investigation, though the LIMS will preferably be flexible enough to allow for the addition of other criteria. ISO/IEC 17025:2017 6.4.8 10.10 The system shall be able to show all instances of scheduled calibration, preventative maintenance, and service dates for an instrument. Consistent calibration and maintenance records: A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS consistently and securely maintains a complete record of calibration, maintenance, and service for an instrument, including dates, times, entities involved, and the results of the activities. ISO/IEC 17025:2017 6.4.13 ISO/IEC 17025:2017 6.5 10.11 The system shall be able to link a calibration activity to certified reference material or designated measurement processes. Calibration activity linkages: A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS can require, when appropriate, the addition of or linking to a certified reference material or appropriate measurement process when an authorized user or automated component records a new calibration action in the LIMS, such that the calibration activity can be further verified as appropriate. ISO/IEC 17025:2017 6.4.8 ISO/IEC 17025:2017 6.4.13 10.13 The system shall be able to uniquely identify each instrument and any associated components and maintain that and other information—such as manufacturer, model number, serial number, and calibration and maintenance history—within the system. Unique identification of instruments: A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS provides a means to uniquely and clearly identify a connected (or even disconnected) instrument, such that it can't be confused with another similar instrument. Along with the unique identifier, the addition of further information about the instrument and its origins needs to be allowed so that it can easily be referenced by authorized users. ISO/IEC 17025:2017 6.4.4–5 ISO/IEC 17025:2017 6.4.13 10.15 The system shall be capable of chronologically logging details for scheduled and unscheduled calibration and maintenance activities for each instrument, including calibration status, calibration standard, date and time of calibration or maintenance, work performed, who conducted it, and signatures of those verifying the completed activities. Calibration and maintenance audit trail: A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS maintains a secure, chronological audit trail of both scheduled and unscheduled calibration, maintenance, and service activities for each uniquely registered instrument. Like other audit trails, vital data such time, date, entities involved, results, and signatures will need to be included to best ensure the quality of instrument-related analytical results. (Tangentially related to 10.10.) ISO/IEC 17025:2017 7.2.1.7 ISO/IEC 17025:2017 7.2.2.1 ISO/IEC 17025:2017 7.10.2 ISO/IEC 17025:2017 8.7 16.3 The system shall be able to record instances of identified nonconformance and method deviation, as well as the actions required to restore the process to conformity. In the case of a planned deviation, the system shall require documentation, justification, proof of validation, adjusted reference intervals, and authorization for the deviated process. Nonconformance and deviation tracking: A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS is sufficiently robust to automatically and manually allow for the recording of instances of nonconformance and deviation from methods. That nonconformance and deviation may be either intentional or unintentional, yet the LIMS should be flexible enough to manage both, requiring additional details for the logged nonconformance and deviation, including whether or not the action was restored to conformity, as well as—if intentional—the full details of the planned deviation. Typical details involve the who, what, why, and how of it, but the LIMS must be flexible enough to allow for additional details to be captured, when necessary, for laboratory inspection or audit purposes. ISO/IEC 17025:2017 7.7.1 18.1 The system should allow authorized users to configure the generation of statistical trending and control charts. ISO/IEC 17025:2017 8.8.2 19.7 The system shall allow for the documentation and management of internal and external audit activities, while allowing samples, methods, tests, results, reports, documents, and more to be clearly associated with that corresponding audit activity. ISO/IEC 17025:2017 8.4.2 27.3 The system shall provide a means to choose—based on date and type of data—electronic data and metadata to archive. ISO/IEC 17025:2017 8.4.2 27.4 The system shall provide a guaranteed means to retrieve and restore archived data and metadata that is readable and accurate. ISO/IEC 17025:2017 8.4.2 27.11 The system’s data storage tools shall provide data backup and retrieval functions that meet or exceed industry best practices, including producing exact and complete backups that are secure and encrypted from manipulation and loss. ISO/IEC 17025:2017 6.3.3 ISO/IEC 17025:2017 6.3.4 30.9 The system should allow for other types of facility monitoring (such as alarm, light, lock, and door statuses) and send notifications when necessary with recommendations for immediate and corrective action. The system should also maintain a log of all such monitored systems and their status changes. ISO/IEC 17025:2017 6.3.3 ISO/IEC 17025:2017 6.3.4 ISO/IEC 17025:2017 7.4.4 30.11 The system should allow for environmental control and monitoring of equipment (such as incubators and freezers) and send notifications when necessary with recommendations for immediate and corrective action. The system should also maintain a log of all such monitored equipment and their associated status changes. ISO/IEC 17025:2017 8.4.2 31.4 The system shall have a mechanism to securely retain data in the system for a specific time period and enable protections that ensure the accurate and ready retrieval of that data throughout the records retention period. ISO/IEC 17025:2017 4.2.1 ISO/IEC 17025:2017 7.11.3 32.22 The system shall provide a security interface usable across all modules of the system that secures data and operations and prevents unauthorized access to data and functions. ISO/IEC 17025:2017 7.11.5 33.4 The system should be well documented by the vendor in comprehensive training material for all aspects of system use, including administration, operation, and troubleshooting. ISO/IEC 17025:2017 7.11.2 33.5 The system shall be validated initially and periodically, with those validation activities being documented, to ensure the accuracy, consistency, and reliability of system performance and its electronic records. ISO/IEC 17025:2017 7.8.7.1 ISO/IEC 17025:2017 7.11.3 ISO/IEC 17025:2017 8.3.2 34.4 The system shall support the ability to define, record, and change the level of access for individual users to system groups, roles, machines, processes, and objects based on their responsibilities, including when those responsibilities change. The system should be able to provide a list of individuals assigned to a given system group, role, machine, process, or object. ISO/IEC 17025:2017 7.11.3 34.7 The vendor shall restrict logical access to database storage components to authorized individuals. If providing a hosted service, the vendor should also restrict physical access to database storage components to authorized individuals. (In the case of an on-site solution, the buyer is responsible for limiting physical access to database storage components to meet 21 CFR Part 11, HIPAA, and CJIS guidelines.)

In other words, Table 1 would indicate the following functionality as important to a lab attempting to conform to ISO/IEC 17025: