[Federal Register: April 8, 2004 (Volume 69, Number 68)]
[Notices]               
[Page 18591-18593]
From the Federal Register Online via GPO Access [wais.access.gpo.gov]
[DOCID:fr08ap04-63]                         

-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Food and Drug Administration

[Docket No. 2004N-0133]

 
Electronic Record; Electronic Signatures; Public Meeting

AGENCY: Food and Drug Administration, HHS.

ACTION: Notice of public meeting; request for comments.

-----------------------------------------------------------------------

SUMMARY: The Food and Drug Administration (FDA) is announcing a public 
meeting to discuss various topics concerning our regulations on 
electronic records and electronic signatures in part 11 (21 CFR part 
11). FDA has begun to re-examine part 11 as it applies to all FDA-
regulated products. We will consider the input from the public meeting 
and comments on the topics presented in this document as we evaluate 
potential changes to part 11.

DATES: The public meeting will be held on June 11, 2004, from 8 a.m. to 
4:30 p.m. Submit written or electronic requests to speak plus a 
presentation abstract by May 12, 2004. Although written or electronic 
comments on the issues presented in this document will be accepted 
until July 9, 2004, to have your comments considered at the meeting, 
submit them by May 12, 2004.

ADDRESSES: The public meeting will be held at the National 
Transportation Safety Board Boardroom and Conference Center, 429 
L'Enfant Plaza, SW., Washington, DC 20594, 202-314-6421. The center may 
be reached by Metro, using the L'Enfant Plaza Station on the green, 
yellow, blue, and orange lines; for further information see http://frwebgate.access.gpo.gov/cgi-bin/leaving.cgi?from=leavingFR.html&log=linklog&to=http://www.ntsb.gov/events/newlocation.htm.
 (FDA has verified the Web site 

address, but FDA is not responsible for any subsequent changes to the 
Web site after this document publishes in the Federal Register.)
    You may submit comments, identified by Docket No. 2004N-0133, by 
any of the following methods:
     Federal eRulemaking Portal: http://frwebgate.access.gpo.gov/cgi-bin/leaving.cgi?from=leavingFR.html&log=linklog&to=http://www.regulations.gov.
 Follow the instructions for submitting comments.

     Agency Web site: http://frwebgate.access.gpo.gov/cgi-bin/leaving.cgi?from=leavingFR.html&log=linklog&to=http://www.fda.gov/dockets/ecomments.
 Follow the instructions for submitting comments on the 

agency Web site.
     E-mail: fdadockets@oc.fda.gov. Include Docket 
No. 2004N-0133 in the subject line of your e-mail message.
     FAX: 301-827-6870.
     Mail/Hand delivery/Courier [For paper, disk, or 
CD-ROM submissions]: Division of Dockets Management (HFA-305), Food and 
Drug Administration, 5630 Fishers Lane, rm. 1061, Rockville, MD 20852.
    Instructions: All submissions received must include the agency name 
and Docket No. for this rulemaking. All comments received will be 
posted without change to http://frwebgate.access.gpo.gov/cgi-bin/leaving.cgi?from=leavingFR.html&log=linklog&to=http://www.fda.gov/dockets/ecomments, 

including any personal information provided. For detailed instructions 
on submitting comments and additional information on the rulemaking 
process, see the ``Request for Comments'' heading in the SUPPLEMENTARY 
INFORMATION section of this document.
    Docket: For access to the docket to read background documents or 
comments received, go to http://frwebgate.access.gpo.gov/cgi-bin/leaving.cgi?from=leavingFR.html&log=linklog&to=http://www.fda.gov/dockets/ecomments and/or 

the Division of Dockets Management, 5630 Fishers Lane,rm. 1061, 
Rockville, MD 20852.
    Transcripts of the public meeting will be available for review at 
the Division of Dockets Management (see ADDRESSES) and on the Internet 
at http://frwebgate.access.gpo.gov/cgi-bin/leaving.cgi?from=leavingFR.html&log=linklog&to=http://www.fda.gov/ohrms/dockets.


FOR FURTHER INFORMATION CONTACT:
    For General Information: Joseph C. Famulare, Center for Drug 
Evaluation and Research (HFD-320), Food and Drug Administration, 11919 
Rockville Pike, Rockville, MD 20852, 301-827-8940, part11@cder.fda.gov; 
or
    David Doleski, Center for Biologics Evaluation and Research (HFM-
676), Food and Drug Administration, 1401 Rockville Pike, Rockville, MD 
20852-1448, 301-827-3031, doleski@cber.fda.gov; or
    John Murray, Center for Devices and Radiological Health (HFZ-340), 
Food and Drug Administration, 9200 Corporate Blvd., Rockville, MD 
20850, 301-594-4659, jfm@cdrh.fda.gov; or
    Vernon D. Toelle, Center for Veterinary Medicine (HFV-234), Food 
and Drug Administration, 7500 Standish Pl., Rockville, MD 20855, 301-
827-0312, vtoelle@cvm.fda.gov; or
    JoAnn Ziyad, Center for Food Safety and Applied Nutrition (HFS-
206), Food and Drug Administration, 5100 Paint Branch Pkwy., College 
Park, MD 20740-3835, 202-418-3116, jziyad@cfsan.fda.gov; or
    Scott MacIntire, Office of Regulatory Affairs (HFC-240), Food and 
Drug Administration, 5600 Fishers Lane, Rockville, MD 20857-1706, 301-
827-0386, smacinti@ora.fda.gov.
    For Registration Information: Anne M. Henig, Center for Drug 
Evaluation and Research (HFD-6), Food and Drug Administration, 5600 
Fishers Lane, Rockville, MD 20857, 301-443-5576, heniga@cder.fda.gov.

SUPPLEMENTARY INFORMATION:

I. Background

    Part 11 provides the criteria under which FDA considers electronic 
records, electronic signatures, and handwritten signatures executed to 
electronic records as equivalent to paper records, and handwritten 
signatures executed on paper (62 FR 13430, March 20, 1997). These 
regulations, which apply to all FDA program areas, were intended to 
permit the widest possible use of electronic technology, consistent 
with FDA's responsibility to protect the public health.
    After part 11 became effective in August 1997, significant 
discussions ensued among industry, contractors, and the agency 
concerning the scope, interpretation, and implementation of the 
regulations. Concerns were raised that some interpretations of the part 
11 requirements would do the following: (1) Unnecessarily restrict the 
use of electronic technology in a manner inconsistent with FDA's stated 
intent in issuing the rule, (2) significantly increase the costs of 
compliance to an extent that was not contemplated at the time the rule 
was drafted, and (3) discourage innovation and technological advances 
without providing a

[[Page 18592]]

significant public health benefit. In particular, concerns were raised 
regarding part 11 requirements for validation, audit trails, record 
retention, record copying, and legacy systems.
    As an outgrowth of our current good manufacturing practice (CGMP) 
initiative for human and animal drugs and biologics, we have begun to 
re-examine part 11 as it applies to all FDA regulated products. We 
recently articulated our current thinking on part 11 in the guidance 
for industry entitled ``Part 11, Electronic Records; Electronic 
Signatures--Scope and Application'' (part 11 guidance) issued on 
September 5, 2003 (68 FR 52779). We explained in the part 11 guidance 
that we anticipate rulemaking to change part 11 as a result of our re-
examination and that while we are re-examining part 11, we will 
narrowly interpret the scope of the regulation. By narrowly 
interpreting the scope of part 11, we mean that fewer records will be 
considered to be subject to part 11. For those records that remain 
subject to part 11, we intend to exercise enforcement discretion with 
regard to part 11 requirements for validation, audit trails, record 
retention and record copying in the manner described in the part 11 
guidance and with regard to all part 11 requirements for systems that 
were operational before the effective date of part 11 under the 
circumstances described in the part 11 guidance. As noted in the part 
11 guidance, we will enforce all predicate rule requirements\1\.
---------------------------------------------------------------------------

    \1\ As noted in the part 11 guidance, the underlying 
requirements set forth in the Federal Food, Drug, and Cosmetic Act, 
the Public Health Service Act, and FDA regulations (other than part 
11) are referred to as ``predicate rules.''
---------------------------------------------------------------------------

II. Purpose of Public Meeting

    The purpose of the public meeting is to obtain input from the 
regulated industry and other stakeholders on the topics outlined in 
this document. Stakeholders include, but are not limited to, 
manufacturers of products regulated by FDA, suppliers of software 
products, consultants to regulated industries, and consumer groups.

III. FDA's Objectives in Re-Examining Part 11

    FDA's re-examination of part 11 includes the following objectives:
     To prevent unnecessary controls and costs, yet 
retain the objectives of the rule.
     To clarify the scope of part 11 (e.g., how it 
relates to other FDA regulations).
     To ensure that part 11 provides an adequate 
level of record security, authenticity, and integrity, and encourages 
innovation and technological advances.
     To further these objectives, we are seeking to 
accomplish the following:
     Identify areas where part 11 could be less 
prescriptive and detailed, and
     Clarify the relationship between part 11 and 
other FDA regulations (predicate rules) with respect to record and 
recordkeeping requirements.

IV. Topics for Discussion and Comment

    FDA would like public input to assist with our re-examination of 
part 11. We invite discussion on the scope of part 11, risk-based 
approaches, validation, audit trails, record retention, record copying, 
and legacy systems. We present the following specific issues and 
questions for comment in the public meeting.

A. Part 11 Subpart A--General Provisions

    Within the context of subpart A of part 11, we would like 
interested parties to address the following:
    1. In the part 11 guidance document, we clarified that only certain 
records would fall within the scope of part 11. For example, we stated 
that under the narrow interpretation of its scope, part 11 would apply 
where records are required to be maintained under predicate rules or 
submitted to FDA, and when persons choose to used records in electronic 
format in place of paper format. On the other hand, when persons use 
computers to generate paper printouts of electronic records, those 
paper records meet all the requirements of the applicable predicate 
rules, and persons rely on the paper records to perform their regulated 
activities, FDA would generally not consider persons to be ``using 
electronic records in lieu of paper records'' under Sec.  11.2(a) and 
(b). In these instances, the use of computer systems in the generation 
of paper records would not trigger part 11. We are interested in 
comments on FDA's interpretation of the narrow scope of part 11 as 
discussed in the part 11 guidance and whether part 11 should be revised 
to implement the narrow interpretation described in the guidance.
    2. We are interested in comments on whether revisions to 
definitions in part 11 would help clarify a narrow approach and 
suggestions for any such revisions.
    3. In the part 11 guidance we announced that we did not intend to 
take enforcement action to enforce compliance with the validation, 
audit trail, record retention, and record copying requirements of part 
11 in the manner described in the part 11 guidance. We emphasized that 
records must still be maintained or submitted in accordance with the 
underlying predicate rules, and the agency could take regulatory action 
for noncompliance with such predicate rules. We are interested in 
comments on the need for clarification in part 11 regarding which 
records are required by predicate rules and are therefore required to 
be part 11 compliant?

B. Part 11 Subpart B--Electronic Records

    Within the context of subpart B, the agency wants to solicit ideas 
on how to ensure that controls to safeguard records are appropriate and 
reasonable. There may be instances where persons believe that there are 
acceptable alternative approaches for implementing controls, with 
appropriate justification. We want to solicit ideas about how decisions 
for using alternative controls should be made, such as using a risk 
assessment. We would like interested parties to address the following:
    1. As mentioned previously, the part 11 guidance identified four 
areas where we do not intend to take enforcement action under the 
circumstances described in the part 11 guidance, including the 
validation, audit trail, record retention, and record copying 
requirements of part 11. The part 11 guidance further recommends that 
decisions on whether or not to implement part 11 requirements on 
validation, audit trail, record retention, and record copying should be 
based on a justified and documented risk assessment and a determination 
of the potential of the system to affect product quality and safety, 
and record integrity. We are interested in comments on whether there 
are other areas of part 11 that should incorporate the concept of a 
risk-based approach, detailed in the part 11 guidance (e.g., those that 
require operational system and device checks).
    2. Is additional clarity needed regarding how predicate rule 
requirements related to subpart B can be fulfilled?
    3. Under the current part 11, the controls that apply to electronic 
records that are maintained also apply to electronic records that are 
submitted to FDA. Should the requirements for electronic records 
submitted to FDA be separate from electronic records maintained to 
satisfy predicate rule requirements?
    4. The controls for electronic records in subpart B distinguish 
between open systems (an environment where system access is not 
controlled by persons who are responsible for the content of electronic 
records that are on the system) and closed systems (an environment 
where system access is

[[Page 18593]]

controlled by persons who are responsible for the content of electronic 
records that are on the system). Should part 11 continue to 
differentiate between open systems and closed systems?
    For individual controls in subpart B, we request comments on the 
following:
    1. The part 11 guidance identified validation as one of the four 
areas where we intend to exercise enforcement discretion in the manner 
described in the guidance. Should we retain the validation provision 
under Sec.  11.10(b) required to ensure that a system meets predicate 
rule requirements for validation?
    2. The part 11 guidance identified record retention and record 
copying requirements as areas where we plan to exercise enforcement 
discretion in the manner described in the part 11 guidance. Are there 
any related predicate rule requirements that you believe are necessary 
to preserve the content and meaning of records with respect to record 
copying and record retention? What requirements would preserve record 
security and integrity and ensure that records are suitable for 
inspection, review, and copying by the agency?
    3. Should audit trail requirements include safeguards designed and 
implemented to deter, prevent, and document unauthorized record 
creation, modification, and deletion?
    4. Section 11.10(k) requires appropriate controls over systems 
documentation. In light of how technology has developed since part 11 
became effective, should part 11 be modified to incorporate concepts, 
such as configuration and document management, for all of a system's 
software and hardware?

C. Part 11 Subpart C--Electronic Signatures

    Within the context of subpart C, we would like interested parties 
to address the following: Section 11.10(d) requires that system access 
be limited to authorized individuals, but it does not address the 
handling of security breaches where an unauthorized individual accesses 
the system. Should part 11 address investigations and followup when 
these security breaches occur?

D. Additional Questions for Comment

    In addition, we invite comment on the following questions:
    1. What are the economic ramifications of modifying part 11 based 
on the issues raised in this document?
    2. Is there a need to clarify in part 11 which records are required 
by predicate rules where those records are not specifically identified 
in predicate rules? If so, how could this distinction be made?
    3. In what ways can part 11 discourage innovation?
    4. What potential changes to part 11 would encourage innovation and 
technical advances consistent with the agency's need to safeguard 
public health?
    5. What risk-based approaches would help to ensure that electronic 
records have the appropriate levels of integrity and authenticity 
elements and that electronic signatures are legally binding and 
authentic?
    6. The part 11 guidance announced that the agency would exercise 
enforcement discretion (during our re-examination of part 11) with 
respect to all part 11 requirements for systems that otherwise were 
operational prior to August 20, 1997 (legacy systems), the effective 
date of part 11. What are stakeholder concerns in regards to 
modifications made to legacy systems in use as of August 1997?
    Can the use of risk mitigation and appropriate controls eliminate 
concerns regarding legacy systems?
    7. Should part 11 address record conversion?
    8. Are there provisions of part 11 that should be augmented, 
modified, or deleted as a result of new technologies that have become 
available since part 11 was issued?

V. Registration and Requests for Oral Presentations

    Preregistration is not necessary if you are not speaking and plan 
only to attend. However, seating is limited and will be available on a 
first-come first-served basis.
    To speak at the public meeting, you must preregister by May 12, 
2004. Requests must be submitted electronically or in writing (see 
ADDRESSES). In your request to speak, you should provide the following 
information: (1) Specific issue that you intend to address; (2) names 
and addresses of all individuals that plan to participate; and (3) 
presentation abstract. Presentations should be limited to the topics 
addressed in this document. We will accept requests to speak based on 
the number of requests we receive, time constraints, and subjects 
covered. We will notify speakers of the scheduled time for their 
presentation before the meeting. Depending on the number of speakers, 
we may need to limit the time allotted for each presentation; at this 
point speakers should plan to limit their oral presentations to no more 
than 15 minutes. Speakers must submit two copies of each presentation 
by June 11, 2004. If you need special accommodations due to a 
disability, please inform the registration contact person at least 7 
days in advance of the meeting.

VI. Request for Comments

    Regardless of attendance at the public meeting, interested persons 
may submit written or electronic comments on the topics presented in 
this document by July 9, 2004, to the Division of Dockets Management 
(see ADDRESSES). You should annotate and organize your comments to 
identify the specific sections of part 11 and/or topics to which they 
refer. Two copies of any mailed comments are to be submitted, except 
that individuals may submit one copy. Comments are to be identified 
with the docket number found in brackets in the heading of this 
document. The received comments may be seen at the Division of Dockets 
Management between 9 a.m. and 4 p.m., Monday through Friday. 
Transcripts of the public meeting also will be available for review at 
the Division of Dockets Management.

    Dated: April 2, 2004.
Jeffrey Shuren,
Assistant Commissioner for Policy.
[FR Doc. 04-7942 Filed 4-7-04; 8:45 am]

BILLING CODE 4160-01-S