All of the records required by the QS/GMP are to be maintained at the manufacturing facility or other location that is reasonably accessible to responsible officials of the manufacturer and employees of FDA designated to perform inspections. These records are to be made readily available for review and copying by FDA employees. These records must be legible, and stored in a manner that minimizes deterioration and loss. Automated record or document management systems shall be backed up.
The firm should be encouraged to mark records they feel are confidential to assist FDA in determining what information may be disclosed under the Freedom of Information Act (FOIA). Impress upon manufacturers that marking all copies of records and documents confidential does not aid FDA in making its FOIA determination.
Records required by the QS/GMP must be retained by the manufacturer for a period of time equivalent to the design and expected life of the device, but in no case less than 2 years from the date of release for commercial distribution by the manufacturer. This does not mean that stability data is needed for all devices to determine "expected life of the device." Manufacturers may use service records, marketing analyses or other methods to determine this expected lifetime. Stability studies are only needed to support labeled expiration dates.
21 CFR 820.180 General Requirements for Subpart M-Records does not pertain to the reports required by 21 CFR 820.20(c) Management review; 820.22 Quality audits; and supplier audit reports under 820.50(a) Evaluation of suppliers, contractors and consultants. It does apply to the procedures required under those sections.
- one or more files or volumes, or
- a list referring to the location of all documentation required by the master record, reflecting the latest revisions, and signed and dated as having been checked for accuracy and approved, or;
- any combination thereof.
Ensure all the following documentation required by the QS/GMP is included or referenced in the device master record and that there is a formal method for approving and making changes to this documentation, including procedures:
- device specifications (e.g. drawings, composition, formulation, component specifications, and software specifications)
- production process specifications (e.g. equipment specifications, production methods, production procedures, and production environment specifications)
- quality assurance procedures and specifications (e.g. acceptance and reject criteria, test methods, and quality assurance equipment to be used)
- packaging and labeling specifications (e.g. labels and packaging to be used, and methods and processes to be used)
- installation, maintenance, and servicing procedures and methods
Device history record (DHR) - Verify history records representing individual devices or lots of devices exist for all finished devices manufactured. The history record should reflect that all operations, processes, etc., described in the master record have been accomplished. In addition, the history record is specifically required to contain, or refer to the location of, the following information:
- date(s) of manufacturing,
- quantity manufactured,
- quantity released for distribution,
- any device identification(s) and control number(s) used,
- the primary identification label and labeling used for each production unit, and,
- the acceptance records which demonstrate the device is manufactured in accordance with the DMR.
The QS/GMP does not require control numbers or traceability for all devices. Control numbers/traceability are, however, required for in vitro diagnostics (IVD's) subject to the labeling requirements of 21 CFR 809.10 and devices subject to the Radiation Control for Health and Safety Act. The QS/GMP does require control numbers/traceability for high risk (previously described as critical) devices. Verify history records contain evidence that labeling was examined prior to actual use.
The GMP does not require device history records be maintained at one location. For example, the history record for an operation may be maintained at that operation location in logbook form. However, history records should be maintained in a form where they can be readily reviewed and signed prior to device distribution as required by 21 CFR 820.80.