[Federal Register: April 8, 2004 (Volume 69, Number 68)]
[Notices]
[Page 18591-18593]
From the Federal Register Online via GPO Access [wais.access.gpo.gov]
[DOCID:fr08ap04-63]
-----------------------------------------------------------------------
DEPARTMENT OF HEALTH AND HUMAN SERVICES
Food and Drug Administration
[Docket No. 2004N-0133]
Electronic Record; Electronic Signatures; Public Meeting
AGENCY: Food and Drug Administration, HHS.
ACTION: Notice of public meeting; request for comments.
-----------------------------------------------------------------------
SUMMARY: The Food and Drug Administration (FDA) is announcing a public
meeting to discuss various topics concerning our regulations on
electronic records and electronic signatures in part 11 (21 CFR part
11). FDA has begun to re-examine part 11 as it applies to all FDA-
regulated products. We will consider the input from the public meeting
and comments on the topics presented in this document as we evaluate
potential changes to part 11.
DATES: The public meeting will be held on June 11, 2004, from 8 a.m. to
4:30 p.m. Submit written or electronic requests to speak plus a
presentation abstract by May 12, 2004. Although written or electronic
comments on the issues presented in this document will be accepted
until July 9, 2004, to have your comments considered at the meeting,
submit them by May 12, 2004.
ADDRESSES: The public meeting will be held at the National
Transportation Safety Board Boardroom and Conference Center, 429
L'Enfant Plaza, SW., Washington, DC 20594, 202-314-6421. The center may
be reached by Metro, using the L'Enfant Plaza Station on the green,
yellow, blue, and orange lines; for further information see http://frwebgate.access.gpo.gov/cgi-bin/leaving.cgi?from=leavingFR.html&log=linklog&to=http://www.ntsb.gov/events/newlocation.htm.
(FDA has verified the Web site
address, but FDA is not responsible for any subsequent changes to the
Web site after this document publishes in the Federal Register.)
You may submit comments, identified by Docket No. 2004N-0133, by
any of the following methods:
Federal eRulemaking Portal: http://frwebgate.access.gpo.gov/cgi-bin/leaving.cgi?from=leavingFR.html&log=linklog&to=http://www.regulations.gov.
Follow the instructions for submitting comments.
Agency Web site: http://frwebgate.access.gpo.gov/cgi-bin/leaving.cgi?from=leavingFR.html&log=linklog&to=http://www.fda.gov/dockets/ecomments.
Follow the instructions for submitting comments on the
agency Web site.
E-mail: fdadockets@oc.fda.gov. Include Docket
No. 2004N-0133 in the subject line of your e-mail message.
FAX: 301-827-6870.
Mail/Hand delivery/Courier [For paper, disk, or
CD-ROM submissions]: Division of Dockets Management (HFA-305), Food and
Drug Administration, 5630 Fishers Lane, rm. 1061, Rockville, MD 20852.
Instructions: All submissions received must include the agency name
and Docket No. for this rulemaking. All comments received will be
posted without change to http://frwebgate.access.gpo.gov/cgi-bin/leaving.cgi?from=leavingFR.html&log=linklog&to=http://www.fda.gov/dockets/ecomments,
including any personal information provided. For detailed instructions
on submitting comments and additional information on the rulemaking
process, see the ``Request for Comments'' heading in the SUPPLEMENTARY
INFORMATION section of this document.
Docket: For access to the docket to read background documents or
comments received, go to http://frwebgate.access.gpo.gov/cgi-bin/leaving.cgi?from=leavingFR.html&log=linklog&to=http://www.fda.gov/dockets/ecomments and/or
the Division of Dockets Management, 5630 Fishers Lane,rm. 1061,
Rockville, MD 20852.
Transcripts of the public meeting will be available for review at
the Division of Dockets Management (see ADDRESSES) and on the Internet
at http://frwebgate.access.gpo.gov/cgi-bin/leaving.cgi?from=leavingFR.html&log=linklog&to=http://www.fda.gov/ohrms/dockets.
FOR FURTHER INFORMATION CONTACT:
For General Information: Joseph C. Famulare, Center for Drug
Evaluation and Research (HFD-320), Food and Drug Administration, 11919
Rockville Pike, Rockville, MD 20852, 301-827-8940, part11@cder.fda.gov;
or
David Doleski, Center for Biologics Evaluation and Research (HFM-
676), Food and Drug Administration, 1401 Rockville Pike, Rockville, MD
20852-1448, 301-827-3031, doleski@cber.fda.gov; or
John Murray, Center for Devices and Radiological Health (HFZ-340),
Food and Drug Administration, 9200 Corporate Blvd., Rockville, MD
20850, 301-594-4659, jfm@cdrh.fda.gov; or
Vernon D. Toelle, Center for Veterinary Medicine (HFV-234), Food
and Drug Administration, 7500 Standish Pl., Rockville, MD 20855, 301-
827-0312, vtoelle@cvm.fda.gov; or
JoAnn Ziyad, Center for Food Safety and Applied Nutrition (HFS-
206), Food and Drug Administration, 5100 Paint Branch Pkwy., College
Park, MD 20740-3835, 202-418-3116, jziyad@cfsan.fda.gov; or
Scott MacIntire, Office of Regulatory Affairs (HFC-240), Food and
Drug Administration, 5600 Fishers Lane, Rockville, MD 20857-1706, 301-
827-0386, smacinti@ora.fda.gov.
For Registration Information: Anne M. Henig, Center for Drug
Evaluation and Research (HFD-6), Food and Drug Administration, 5600
Fishers Lane, Rockville, MD 20857, 301-443-5576, heniga@cder.fda.gov.
SUPPLEMENTARY INFORMATION:
I. Background
Part 11 provides the criteria under which FDA considers electronic
records, electronic signatures, and handwritten signatures executed to
electronic records as equivalent to paper records, and handwritten
signatures executed on paper (62 FR 13430, March 20, 1997). These
regulations, which apply to all FDA program areas, were intended to
permit the widest possible use of electronic technology, consistent
with FDA's responsibility to protect the public health.
After part 11 became effective in August 1997, significant
discussions ensued among industry, contractors, and the agency
concerning the scope, interpretation, and implementation of the
regulations. Concerns were raised that some interpretations of the part
11 requirements would do the following: (1) Unnecessarily restrict the
use of electronic technology in a manner inconsistent with FDA's stated
intent in issuing the rule, (2) significantly increase the costs of
compliance to an extent that was not contemplated at the time the rule
was drafted, and (3) discourage innovation and technological advances
without providing a
[[Page 18592]]
significant public health benefit. In particular, concerns were raised
regarding part 11 requirements for validation, audit trails, record
retention, record copying, and legacy systems.
As an outgrowth of our current good manufacturing practice (CGMP)
initiative for human and animal drugs and biologics, we have begun to
re-examine part 11 as it applies to all FDA regulated products. We
recently articulated our current thinking on part 11 in the guidance
for industry entitled ``Part 11, Electronic Records; Electronic
Signatures--Scope and Application'' (part 11 guidance) issued on
September 5, 2003 (68 FR 52779). We explained in the part 11 guidance
that we anticipate rulemaking to change part 11 as a result of our re-
examination and that while we are re-examining part 11, we will
narrowly interpret the scope of the regulation. By narrowly
interpreting the scope of part 11, we mean that fewer records will be
considered to be subject to part 11. For those records that remain
subject to part 11, we intend to exercise enforcement discretion with
regard to part 11 requirements for validation, audit trails, record
retention and record copying in the manner described in the part 11
guidance and with regard to all part 11 requirements for systems that
were operational before the effective date of part 11 under the
circumstances described in the part 11 guidance. As noted in the part
11 guidance, we will enforce all predicate rule requirements\1\.
---------------------------------------------------------------------------
\1\ As noted in the part 11 guidance, the underlying
requirements set forth in the Federal Food, Drug, and Cosmetic Act,
the Public Health Service Act, and FDA regulations (other than part
11) are referred to as ``predicate rules.''
---------------------------------------------------------------------------
II. Purpose of Public Meeting
The purpose of the public meeting is to obtain input from the
regulated industry and other stakeholders on the topics outlined in
this document. Stakeholders include, but are not limited to,
manufacturers of products regulated by FDA, suppliers of software
products, consultants to regulated industries, and consumer groups.
III. FDA's Objectives in Re-Examining Part 11
FDA's re-examination of part 11 includes the following objectives:
To prevent unnecessary controls and costs, yet
retain the objectives of the rule.
To clarify the scope of part 11 (e.g., how it
relates to other FDA regulations).
To ensure that part 11 provides an adequate
level of record security, authenticity, and integrity, and encourages
innovation and technological advances.
To further these objectives, we are seeking to
accomplish the following:
Identify areas where part 11 could be less
prescriptive and detailed, and
Clarify the relationship between part 11 and
other FDA regulations (predicate rules) with respect to record and
recordkeeping requirements.
IV. Topics for Discussion and Comment
FDA would like public input to assist with our re-examination of
part 11. We invite discussion on the scope of part 11, risk-based
approaches, validation, audit trails, record retention, record copying,
and legacy systems. We present the following specific issues and
questions for comment in the public meeting.
A. Part 11 Subpart A--General Provisions
Within the context of subpart A of part 11, we would like
interested parties to address the following:
1. In the part 11 guidance document, we clarified that only certain
records would fall within the scope of part 11. For example, we stated
that under the narrow interpretation of its scope, part 11 would apply
where records are required to be maintained under predicate rules or
submitted to FDA, and when persons choose to used records in electronic
format in place of paper format. On the other hand, when persons use
computers to generate paper printouts of electronic records, those
paper records meet all the requirements of the applicable predicate
rules, and persons rely on the paper records to perform their regulated
activities, FDA would generally not consider persons to be ``using
electronic records in lieu of paper records'' under Sec. 11.2(a) and
(b). In these instances, the use of computer systems in the generation
of paper records would not trigger part 11. We are interested in
comments on FDA's interpretation of the narrow scope of part 11 as
discussed in the part 11 guidance and whether part 11 should be revised
to implement the narrow interpretation described in the guidance.
2. We are interested in comments on whether revisions to
definitions in part 11 would help clarify a narrow approach and
suggestions for any such revisions.
3. In the part 11 guidance we announced that we did not intend to
take enforcement action to enforce compliance with the validation,
audit trail, record retention, and record copying requirements of part
11 in the manner described in the part 11 guidance. We emphasized that
records must still be maintained or submitted in accordance with the
underlying predicate rules, and the agency could take regulatory action
for noncompliance with such predicate rules. We are interested in
comments on the need for clarification in part 11 regarding which
records are required by predicate rules and are therefore required to
be part 11 compliant?
B. Part 11 Subpart B--Electronic Records
Within the context of subpart B, the agency wants to solicit ideas
on how to ensure that controls to safeguard records are appropriate and
reasonable. There may be instances where persons believe that there are
acceptable alternative approaches for implementing controls, with
appropriate justification. We want to solicit ideas about how decisions
for using alternative controls should be made, such as using a risk
assessment. We would like interested parties to address the following:
1. As mentioned previously, the part 11 guidance identified four
areas where we do not intend to take enforcement action under the
circumstances described in the part 11 guidance, including the
validation, audit trail, record retention, and record copying
requirements of part 11. The part 11 guidance further recommends that
decisions on whether or not to implement part 11 requirements on
validation, audit trail, record retention, and record copying should be
based on a justified and documented risk assessment and a determination
of the potential of the system to affect product quality and safety,
and record integrity. We are interested in comments on whether there
are other areas of part 11 that should incorporate the concept of a
risk-based approach, detailed in the part 11 guidance (e.g., those that
require operational system and device checks).
2. Is additional clarity needed regarding how predicate rule
requirements related to subpart B can be fulfilled?
3. Under the current part 11, the controls that apply to electronic
records that are maintained also apply to electronic records that are
submitted to FDA. Should the requirements for electronic records
submitted to FDA be separate from electronic records maintained to
satisfy predicate rule requirements?
4. The controls for electronic records in subpart B distinguish
between open systems (an environment where system access is not
controlled by persons who are responsible for the content of electronic
records that are on the system) and closed systems (an environment
where system access is
[[Page 18593]]
controlled by persons who are responsible for the content of electronic
records that are on the system). Should part 11 continue to
differentiate between open systems and closed systems?
For individual controls in subpart B, we request comments on the
following:
1. The part 11 guidance identified validation as one of the four
areas where we intend to exercise enforcement discretion in the manner
described in the guidance. Should we retain the validation provision
under Sec. 11.10(b) required to ensure that a system meets predicate
rule requirements for validation?
2. The part 11 guidance identified record retention and record
copying requirements as areas where we plan to exercise enforcement
discretion in the manner described in the part 11 guidance. Are there
any related predicate rule requirements that you believe are necessary
to preserve the content and meaning of records with respect to record
copying and record retention? What requirements would preserve record
security and integrity and ensure that records are suitable for
inspection, review, and copying by the agency?
3. Should audit trail requirements include safeguards designed and
implemented to deter, prevent, and document unauthorized record
creation, modification, and deletion?
4. Section 11.10(k) requires appropriate controls over systems
documentation. In light of how technology has developed since part 11
became effective, should part 11 be modified to incorporate concepts,
such as configuration and document management, for all of a system's
software and hardware?
C. Part 11 Subpart C--Electronic Signatures
Within the context of subpart C, we would like interested parties
to address the following: Section 11.10(d) requires that system access
be limited to authorized individuals, but it does not address the
handling of security breaches where an unauthorized individual accesses
the system. Should part 11 address investigations and followup when
these security breaches occur?
D. Additional Questions for Comment
In addition, we invite comment on the following questions:
1. What are the economic ramifications of modifying part 11 based
on the issues raised in this document?
2. Is there a need to clarify in part 11 which records are required
by predicate rules where those records are not specifically identified
in predicate rules? If so, how could this distinction be made?
3. In what ways can part 11 discourage innovation?
4. What potential changes to part 11 would encourage innovation and
technical advances consistent with the agency's need to safeguard
public health?
5. What risk-based approaches would help to ensure that electronic
records have the appropriate levels of integrity and authenticity
elements and that electronic signatures are legally binding and
authentic?
6. The part 11 guidance announced that the agency would exercise
enforcement discretion (during our re-examination of part 11) with
respect to all part 11 requirements for systems that otherwise were
operational prior to August 20, 1997 (legacy systems), the effective
date of part 11. What are stakeholder concerns in regards to
modifications made to legacy systems in use as of August 1997?
Can the use of risk mitigation and appropriate controls eliminate
concerns regarding legacy systems?
7. Should part 11 address record conversion?
8. Are there provisions of part 11 that should be augmented,
modified, or deleted as a result of new technologies that have become
available since part 11 was issued?
V. Registration and Requests for Oral Presentations
Preregistration is not necessary if you are not speaking and plan
only to attend. However, seating is limited and will be available on a
first-come first-served basis.
To speak at the public meeting, you must preregister by May 12,
2004. Requests must be submitted electronically or in writing (see
ADDRESSES). In your request to speak, you should provide the following
information: (1) Specific issue that you intend to address; (2) names
and addresses of all individuals that plan to participate; and (3)
presentation abstract. Presentations should be limited to the topics
addressed in this document. We will accept requests to speak based on
the number of requests we receive, time constraints, and subjects
covered. We will notify speakers of the scheduled time for their
presentation before the meeting. Depending on the number of speakers,
we may need to limit the time allotted for each presentation; at this
point speakers should plan to limit their oral presentations to no more
than 15 minutes. Speakers must submit two copies of each presentation
by June 11, 2004. If you need special accommodations due to a
disability, please inform the registration contact person at least 7
days in advance of the meeting.
VI. Request for Comments
Regardless of attendance at the public meeting, interested persons
may submit written or electronic comments on the topics presented in
this document by July 9, 2004, to the Division of Dockets Management
(see ADDRESSES). You should annotate and organize your comments to
identify the specific sections of part 11 and/or topics to which they
refer. Two copies of any mailed comments are to be submitted, except
that individuals may submit one copy. Comments are to be identified
with the docket number found in brackets in the heading of this
document. The received comments may be seen at the Division of Dockets
Management between 9 a.m. and 4 p.m., Monday through Friday.
Transcripts of the public meeting also will be available for review at
the Division of Dockets Management.
Dated: April 2, 2004.
Jeffrey Shuren,
Assistant Commissioner for Policy.
[FR Doc. 04-7942 Filed 4-7-04; 8:45 am]
BILLING CODE 4160-01-S