21 CFR Part 11

The Title 21 Code of Federal Regulations Part 11 (21 CFR Part 11) provides compliance information regarding the U.S. Food and Drug Administration's (FDA) guidelines on electronic records and electronic signatures. Within this part, requirements are created to help ensure security, integrity, and confidentially of electronic records and to ensure electronic signatures are as legally binding as hand-written signatures.

Practically speaking, Part 11 requires drug makers, medical device manufacturers, biotech and biologics companies, contract research organizations, and other FDA-regulated industries, with some specific exceptions, to implement controls, including audits, system validations, audit trails, electronic signatures, and documentation for closed and open software and systems involved in processing specific electronic data. This primarily includes data to be maintained by the FDA predicate rules and data used to demonstrate compliance to a predicate rule. (A predicate rule is any requirement set forth in the Federal Food, Drug and Cosmetic Act, the Public Health Service Act, or any FDA regulation other than Part 11.) The rule also applies to submissions made to the FDA in electronic format, but not to paper submissions by electronic methods, though paper submissions may eventually be prohibited by the FDA.

History

By the early 1990s, food and drug manufacturers approached the U.S. Food and Drug Administration (FDA) about the possibility of electronic submissions with electronic signatures. However, at that time the government did not allow for digital signatures. In July 1992, the FDA began soliciting comments about the process of using electronic signatures.

In March 1997, the FDA issued Part 11 regulations which, in the words of the FDA, were "intended to permit the widest possible use of electronic technology, compatible with FDA's responsibility to protect the public health." Various keynote speeches by FDA insiders early in the 21st century (in addition to compliance guides and draft guidance documents) as well as strong efforts by the FDA to motivate industry to move to e-filing resulted in many companies like Eli Lilly, Agilent Technologies, and other businesses rapidly being forced to change their methods and systems to adapt to the new standards.

However, many entities expressed concerns about the Title 11 conditions, including concerns the regulations would "unnecessarily restrict" the use of technology, add significant compliance costs beyond what was intended, and stifle technological innovation while reducing public health benefit. In November 2002, the FDA released the guidance document "Guidance for Industry 21 CFR Part 11; Electronic Records; Electronic Signatures, Electronic Copies of Electronic Records" to the public for commenting. On February 3, 2003, the FDA withdrew that document, stating "we wanted to minimize industry time spent reviewing and commenting on the draft guidance when that draft guidance may no longer represent our approach under the [current good manufacturing practice] initiative," adding it would afterwards "intend to exercise enforcement discretion with regard to certain Part 11 requirements." Further guidance documents were withdrawn later that month, culminating in a final guidance document in August 2003 stating the government body would re-examine Part 11 and make necessary changes. However, the FDA reiterated despite its retraction of the guidance documents "21 CFR Part 11 is not going away, and neither is the agency's demand for electronic record integrity." The retraction of guidance and change in policy, however, led many IT members in the pharmaceutical and life sciences industry in late 2004 to state one of the key problems they face as the lack of clear guidelines from the FDA about what is required for compliance.

The FDA had indicated it would produce a revised version of Part 11 by the end of 2006, after its Third Annual FDA Information Management Summit had concluded. Those revisions never arrived, and little in the way of updates on the topic arrived. On July 8, 2010, the FDA announced it would begin to audit facilities working with drugs "in an effort to evaluate industry's compliance and understanding of Part 11 in light of the enforcement discretion," leaving some to wonder if this was an indicator the regulation and/or its guidance would finally see a revision.

With an increase in violations of data integrity in current good manufacturing practice (CGMP) inspections in the mid-2010s, the U.S. Food and Drug Administration eventually issued draft guidance in April 2016 for implementing the data integrity requirements of 21 CFR Parts 210–212, as well as clarifying how electronic signature and record-keeping requirements in 21 CFR Part 11 apply. That guidance was finalized in December 2018, encouraging firms to "implement meaningful and effective strategies to manage their data integrity risks based on their process understanding and knowledge management of technologies and business models."

Structure

The structure of Part 11 is as follows:

Subpart A — General Provisions

§ 11.1 Scope

§ 11.2 Implementation

§ 11.3 Definitions

Subpart B — Electronic Records

§ 11.10 Controls for closed systems

§ 11.30 Controls for open systems

§ 11.50 Signature manifestations

§ 11.70 Signature/record linking

Subpart C — Electronic Signatures

§ 11.100 General requirements

§ 11.200 Electronic signature components and controls

§ 11.300 Controls for identification codes/passwords

Subpart A

This is essentially the preamble of the regulations, explaining to what and who the regulations apply as well as how they'll apply. Definitions of common terms appearing in the regulations can also be found here, including a clarification in the difference between a digital and electronic signature.

Subpart B

This section covers the requirements applicable to electronic records and their management. Several requirements are addressed, including "how to ensure the authenticity, integrity, and, when appropriate, the confidentiality of electronic records"; what content a signature should contain; and how electronic records and their signatures should be linked. It also covers topics like system validation, data traceability, audit control, and version control.

Subpart C

This final section addresses the requirements specific to electronic signatures and their use. General requirements for electronic signatures, their components and controls, and password controls are all addressed. Additionally, this section addresses requirements for more advanced biometric-based signatures.

Audit guidelines and checklist

Main article: 21 CFR Part 11/Audit guidelines and checklist

For those auditing computer systems and IT environments for their compliance with 21 CFR Part 11 and other regulations, a set of guidelines and checklist items may be useful.

Click the link above for the full set of guidelines and checklist items.

Further reading

• "Electronic Code of Federal Regulations - Title 21: Food and Drugs - Part 11: Electronic Records; Electronic Signatures". U.S. Government Printing Office. https://www.ecfr.gov/current/title-21/part-11. 

• "CFR - Code of Federal Regulations - Title 21 - Part 11 Electronic Records; Electronic Signatures". U.S. Food and Drug Administration. https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfcfr/cfrsearch.cfm?cfrpart=11. 

• Huber, L. (15 November 2012). "Tutorial: 21 CFR Part 11 - Electronic Records and Electronic Signatures". LabCompliance. Archived from the original on 03 January 2020. https://web.archive.org/web/20180103191244/http://www.labcompliance.com/tutorial/part11/.