Medical Device Link.

Originally Published MDDI January 2004

Regulatory Outlook

FDA Enforcement Discretion

Barbara Immel
Immel Resources LLC

The following information is abstracted from FDA’s final Part 11 guidance on scope and application, which applies during FDA’s reexamination of Part 11 for expected revision. Please read the guidance document thoroughly for further detail.²

Validation. Even though FDA has said that it intends to exercise enforcement discretion regarding Part 11 validation requirements, all organizations must still comply with all predicate rule requirements on validation. In its latest guidance document, FDA says that even if no predicate rule requires validating a computer system, it may still be important to validate that system. Any system that can have a major effect on patient safety—such as those used for product disposition, manufacturing, product testing, and so on—should be validated and should also be among the first assessed for Part 11 compliance. FDA adds in its latest guidance document that a word processor used only to generate SOPs (i.e., a computer used to generate paper) would most likely not need to be validated.

Audit Trails. FDA says it intends to exercise enforcement discretion regarding Part 11 requirements for computer-generated, time-stamped audit trails. Organizations must still comply with all predicate rules regarding the documentation of date, time, and sequencing of events. FDA adds that even if predicate rules do not require documentation of, for example, the date, time, or sequence of events in a particular case, it may still be important to have audit trails or other physical, logical, or procedural security measures to ensure the trustworthiness and reliability of the records. FDA adds that audit trails are particularly important when users are expected to create, modify, or delete regulated records during normal operation of a system.

Legacy Systems. FDA intends to exercise enforcement discretion with respect to all Part 11 requirements for systems that were operational before August 20, 1997 (the effective date of Part 11), as follows. FDA does not intend to take enforcement action to enforce Part 11 compliance if the following criteria are met for a specific system:

• The system was operational before the effective date.
• The system met all applicable predicate rule requirements before the effective date.
• The system now meets all applicable predicate rule requirements.
• The company has documented evidence and justification that the system is fit for its intended use (including having an acceptable level of record security and integrity, if applicable).

FDA states that if a system has been changed since August 20, 1997 (which is true for most systems), and if the changes would prevent the system from meeting predicate rule requirements, Part 11 controls should be applied to Part 11 records and signatures per the enforcement policy outlined in FDA’s final scope and application guidance. On a separate note, one current FDA staffer thinks that the requirement to review any legacy system for Part 11 requirements may be dropped when FDA publishes the results of its reexamination of the rule.

Copies of Records. Although FDA intends to exercise enforcement discretion regarding Part 11 requirements for generating copies of records, obviously a company must provide FDA investigators with reasonable and useful access to its records during an inspection. All records it holds to satisfy predicate rules are subject to inspection.

FDA recommends that companies supply copies of electronic records to it by producing copies of records held in common portable formats (like Word or Excel) when records are kept in those formats. It will also accept established automated conversions or export methods, where available, to make copies in a more common format (such as PDF, XML, or SGML files).

FDA also recommends that companies ensure that the copying process used produces copies that preserve the content and meaning of the records. FDA adds that if a company has the ability to search, sort, or trend records, then copies given to FDA should provide the same capability if technically feasible. Obviously, manufacturers must allow the inspection, review, and copying of records in human-readable form on-site, using the company’s hardware and software, and following SOPs and techniques for accessing those records.

Record Retention. Finally, FDA intends to exercise enforcement discretion regarding Part 11 requirements for records to enable their accurate and ready retrieval throughout the record retention period. Companies must still comply with all applicable predicate rule requirements for record retention and availability.

FDA does not intend to object if a company decides to archive required records in electronic format to nonelectronic media such as microfilm, microfiche, and paper, or to standard electronic file format, such as PDF, XML, or SGML. Companies must still comply with all predicate rules, and the records themselves and any copies of required records should preserve content and meaning.

FDA states that “as long as predicate rule requirements are fully satisfied and the content and meaning of the records are preserved and archived, you can delete the electronic version of the records.” (Yes, that’s a direct quote.) Obviously, paper and e-record and signature components can coexist (a hybrid situation) as long as the predicate rule requirements are met and the content and meaning of the records are preserved. 

Copyright ©2004 Medical Device & Diagnostic Industry