21 CFR Part 11

The Title 21 Code of Federal Regulations Part 11 (21 CFR Part 11) provides compliance information regarding electronic records and electronic signatures. Within this part, requirements are created to help ensure security, integrity, and confidentially of electronic records and to ensure electronic signatures are as legally binding as hand-written signatures.^[1]

Practically speaking, Part 11 requires drug makers, medical device manufacturers, biotech and biologics companies, contract research organizations, and other FDA-regulated industries, with some specific exceptions, to implement controls, including audits, system validations, audit trails, electronic signatures, and documentation for closed and open software and systems involved in processing electronic specific data. This primarily includes data to be maintained by the FDA predicate rules and that used to demonstrate compliance to a predicate rule. A predicate rule is any requirement set forth in the Federal Food, Drug and Cosmetic Act, the Public Health Service Act, or any FDA regulation other than Part 11.^[2] The rule also applies to submissions made to the FDA in electronic format, but not to paper submissions by electronic methods, though paper submissions may eventually be prohibited by the FDA.^[3]

History

By the early 1990s, food and drug manufacturers approached the U.S. Food and Drug Administration (FDA) about the possibility of electronic submissions with electronic signatures. However, at that time the government did not allow for digital signatures. In July 1992, the FDA began soliciting comments about the process of using electronic signatures.^[4]

In March 1997, the FDA issued Part 11 regulations which, in the words of the FDA, were "intended to permit the widest possible use of electronic technology, compatible with FDA's responsibility to protect the public health."^[2] Various keynote speeches by FDA insiders early in the 21st century (in addition to compliance guides and draft guidance documents)^[2] as well as strong efforts by the FDA to motivate industry to move to e-filing^[5] resulted in many companies like Eli Lilly^[6], Agilent Technologies^[7], and other businesses rapidly being forced to change their methods and systems to adapt to the new standards.^[2]^[8]

However, many entities expressed concerns about the Title 11 conditions, including concerns the regulations would "unnecessarily restrict" the use of technology, add significant compliance costs beyond what was intended, and stifle technological innovation while reducing public health benefit.^[2] In November 2002, the FDA released the guidance document "Guidance for Industry 21 CFR Part 11; Electronic Records; Electronic Signatures, Electronic Copies of Electronic Records" to the public for commenting.^[9] On February 3, 2003, the FDA withdrew that document, stating "we wanted to minimize industry time spent reviewing and commenting on the draft guidance when that draft guidance may no longer represent our approach under the [current good manufacturing practice] initiative," adding it would afterwards "intend to exercise enforcement discretion with regard to certain part 11 requirements."^[2] Further guidance documents were withdrawn later that month, culminating in a final guidance document in August 2003 stating the government body would re-examine Part 11 and make necessary changes.^[2]^[10] However, the FDA reiterated despite its retraction of the guidance documents "21 CFR Part 11 is not going away, and neither is the agency's demand for electronic record integrity."^[11] The retraction of guidance and change in policy, however, led many IT members in the pharmaceutical and life sciences industry in late-2004 to state one of the key problems they face as the lack of clear guidelines from the FDA about what is required for compliance.^[12]

The FDA had indicated it would produce a revised version of Part 11 by the end of 2006, after its Third Annual FDA Information Management Summit had concluded.^[13] Those revisions never arrived, and little in the way of updates on the topic arrived.^[14] On July 8, 2010, the FDA announced it would begin to audit facilities working with drugs "in an effort to evaluate industry's compliance and understanding of Part 11 in light of the enforcement discretion,"^[15] leaving some to wonder if this was an indicator the regulation and/or its guidance would finally see a revision.^[16]^[17]