Memo of Meeting
Date: March 30, 2001
Location: Rockville, MD
Subject: Implementation of 21 Code of Federal Regulations, Part 11; Electronic Records; Electronic Signatures; Scope of the rule
Representing the Industry Coalition on 21 CFR Part 11:
Mr. William Bradley, Vice President, Technical Affairs, Consumer Health Care Products Association
Mr. Christopher Allen, Vice President. Operations, Northern Americas Region, Bayer Corporation
Mr. Bernie Liebler, Director, Technology & Regulatory Affairs, Advanced Medical Technology Association
Mr. Dave Everson, IT Management Solutions, Inc.
Mr. Will Robinson, Staff VP, CR Bard, Inc.
Mr. Johnny Long, Director, Quality Management, Baxter Healthcare Corp.
Mr. Philip Loftus, Senior Vice President, Global Strategy & Applications, Pharmaceutical Research and Manufacturers Association/Glaxo Smith Kline
Mr. Krishan Arora, Vice President Technical Operations, Pharmacia
Representing the Food and Drug Administration, FDA Part 11 Compliance Committee:
Mr. John Taylor, Director, Office of Enforcement
Mr. Paul J. Motise, Consumer Safety Officer, Office of Enforcement
Dr. James McCormack, Consumer Safety Officer, Office of Enforcement
Ms. Sonal Vaid, General Attorney, Office of Chief Counsel
Mr. Mark Hackman, Consumer Safety Officer, Center for Food Safety and Applied Nutrition
Mr. Stewart Crumpler, Regulatory Officer, Center for Devices and Radiological Health
Ms. Christine Nelson, Supervisory Consumer Safety Officer, Office of Health and Industry Programs, Center for Devices and Radiological Health
Dr. Vernon Toelle, Math Statistician, Center for Veterinary Medicine
Ms. Karen Moksnes, Consumer Safety Officer, Office of Compliance, Center for Drug Evaluation and Research
Mr. Charles Ahn, Consumer Safety Officer, Office of Regional Operations
Ms. Jennifer Thomas, Associate Director for Policy, Office of Compliance and Biologics Quality, Center for Biologics Evaluation and Research
The meeting was requested by the industry coalition to discuss the scope of 21 CFR Part 11. This meeting was a follow up to the one we had with the group in February of 2001. This meeting was intended to focus on the issue of scope, with attendance by a subgroup of the coalition.
Mr. Taylor explained that we wanted this meeting to focus on matters relating to the scope of part 11 that would affect individual industries in the coalition as well as all industries.
Mr. Bradley said his group did not expect final agency decisions at this meeting, but that he hoped to clarify some misunderstandings. He also said it was not industry’s intent to avoid compliance with the rule but the coalition wanted to make known its concerns and difficulties.
Mr. Bradley explained that Mr. Loftus and Mr. Arora chair the coalition’s sub-group on the subject of part 11’s scope.
Our discussions then focused on the following points that the coalition prepared in a one-page document. Excerpts are quoted.
What constitutes a required record?
“1. Our understanding of the regulation is that 21 CFR Part 11 applies to those records in electronic form, as explicitly defined in the predicate rules, that are created, maintained, and/or submitted in electronic form. As stated in the latter part of §11.1(b), it applies to those records set forth in agency regulations or those records submitted under the requirements of the Federal Food, Drug, and Cosmetic Act and the Public Health Service Act, when submitted in electronic form.”
During our discussions the coalition representatives said that they generate a great number of electronic documents and records and were concerned with the high volume that would come under the rule.
We explained that for purposes of the scope of the rule, we made no distinction between document and record, or whether or not a record was signed. Ms. Vaid explained that we define record in a very broad legal sense.
We explained that a record could be required not only on a primary basis by explicit wording in a regulation or law, but also on a secondary basis. We gave the example of a standard operating procedure, explicitly required by regulation in which a firm says it will record and preserve certain information; the recorded information may not be explicitly identified in a regulation, but the firm imposes the requirement upon itself by virtue of its standard operating procedure. We explained that as a rule of thumb, if not having a record would be a violation of FDA law or regulation, the record would be considered required and would be covered by part 11 when in electronic form.
Mr. Bradley commented that not all records have a direct bearing on product quality and safety and that those that do not should not be covered by the rule. Mr. Taylor said that the significance of a required record would not affect its coverage under part 11, but could affect a firm’s priority in bringing the relevant systems into compliance. Mr. Taylor emphasized that these were separate matters.
Records held for short periods of time
“2. We also understand that the regulation applies to required electronic records stored on durable media, such as magnetic disk or tape, and not to temporary records stored on non-durable media, such as flash memory in PDAs, or devices intended for short term data capture, such as programmable logic controllers and data loggers, which have little or no ability to provide audit trails or to export data to other systems in electronic form.”
We explained that the question was really addressing the issue of audit trails, and not whether a record is covered by part 11. We commented that, as explained in the final rule preamble, the requirement for audit trails does not apply to actions of devices, but to actions of human operators. We explained that programmable logic controllers and data loggers that record information to required records without human intervention need not have audit trails, but they must meet other relevant portions of part 11.
We commented that whether or not the recording media was
durable, and whether or not a system had the capacity to generate an audit trail
did not determine part 11 applicability. We
explained that the question appeared to relate to a preamble comment that
clarified the agency’s intent that audit trails need not capture every
keystroke stored in a temporary buffer.
Changing the rule’s scope via guidance
“3. If and when there is an intent to extend the scope of the regulation to cover electronic records other than those explicitly required by the predicate rules then this should be accomplished via the normal rule making process and not through the issuance of guidance documents.”
Mr. Taylor explained that any changes in the rule’s scope would be made through notice and comment rulemaking, not by guidance. We added that, as explained above, the rule currently covers records in electronic form that FDA law or regulation require.
Records retention