Tamara M. June
According to Ken Miles of the Food and Drug Administration: "One of the biggest challenges facing companies today is migrating from paper-intensive systems to paperless electronic systems. The more involved companies get with their paper systems, the more they open themselves up to mistakes."
In March of 1997, the FDA published its final rule on electronic records, electronic signatures and audit trails. This rule--known as 21 CFR Part 11--establishes the criteria under which the FDA recognizes electronic records and electronic signatures as the equivalent of paper records and traditional handwritten signatures.
Electronic records are all of the quality records that you maintain, as well as other records you're required to submit to the FDA. An electronic signature is defined as "a computer data compilation of any symbol or series of symbols executed, adopted or authorized by an individual to be the legally binding equivalent of the individual's handwritten signature." Electronic signatures must include the signer's printed name, a date-and-time stamp of signing, as well as the meaning of the signature (e.g., review, approval or acknowledgement). Companies need to ensure that their employees understand the implications of electronic signatures and that any false activity on company records could result in criminal penalties.
When electronic records are in use, 21 CFR Part 11 requires that an audit trail be maintained automatically by the system. An audit trail provides a view-only archive of all changes to the records. Users must not be allowed to circumvent it under any circumstances.
Simply entering data or information into Microsoft Word or Excel files doesn't constitute an acceptable electronic record according to the FDA's definition. Systems must comply with all of the provisions set forth in the 21 CFR Part 11 regulations, which mandate authenticity as well as security of the data. Systems must be validated to establish that they're suitable for their intended use.
Medical device companies are finding that it's not an easy task to convert from paper-based record keeping to electronic records, nor do they fully understand the final Part 11 rules issued by the FDA. The results of a 2001 survey conducted by NuGenesis Technologies Corp. show that: "Thirty-eight percent of the respondents admitted they did not fully understand the implications of Part 11 as it affected their companies. And while 75 percent of respondents claimed they had begun putting Part 11 measures in place, only 11 percent said they were fully Part 11-compliant in at least some areas."
The regulations are subject to interpretation, and FDA inspectors have been inconsistent with the enforcement of these regulations. They tend to enforce Part 11 when other problems are found during a broader inspection, rather than look for Part 11 violations directly. However, as FDA inspectors become more experienced with Part 11 requirements, they're spotting deficiencies in systems on a much more regular basis--a trend likely to continue.
Miles points out that the FDA is facing the same challenges as the organizations it regulates. "We're implementing electronic quality systems for our field people, managers and laboratories," he notes. "We're performing audits, collaborating between different groups, validating our systems--basically adhering to the same standards that we place on regulated industry."
Miles suggests that organizations convert to paperless systems sooner rather than later. "Efficiency will be improved, and the error rate will be reduced tremendously," he states. "It's a form of quality assurance and has long-range effects on better product, higher profits, and fewer mistakes and product recalls. When you have better control of your records, and can distribute and share your information in a timely manner, it can only have positive effects on quality."
In 2001, Guidant Corp. took the same view. The company was operating on a hybrid system comprising both paper and electronic records, with some of the facilities operating on paper-based systems only. The decision to combine all of these processes into a single centralized system was initiated by Myrna Santos, regulatory and compliance auditor for Guidant Puerto Rico. Santos was looking for a 21 CFR Part 11-compliant corrective and preventive action system that could provide the flexibility the company required. As a world leader in the design, development and manufacture of cardiovascular medical products, Guidant required accessibility for all of its locations around the globe.
Since the company incorporated in 1994, Guidant revenues have grown to $3.2 billion, and it employs more than 10,000 people worldwide. Corporate headquarters are in Indianapolis, with major operations in California, Minnesota, Texas, Washington, Puerto Rico and Ireland. Other locations include Canada, Europe, Japan and Latin America.
Guidant is composed of four business units:
Cardiac Rhythm Management--produces implantable cardioverter defibrillators used to treat unhealthy heart rhythms.
Cardiac Surgery--focuses on less-invasive procedures for patients requiring bypass surgery. The CS division's products enable surgeons to perform bypass surgery without stopping the heart or making a large incision in the patient's leg to harvest veins typically used in bypass surgery.
Web-based. All functionality, including administration and configuration screens, should be available via a standard Web browser. The system should support Web browsers from a variety of manufacturers running on a variety of operating systems.
Electronic signatures. The software must prompt the user for at least one unique identification component (e.g., password) each time a signature is applied, or use a biometric means of authentication. Signatures must show the printed name of the signer, the date and time the signature was applied, and the meaning of the signature.
