21 CFR Part 11: When Does It Apply?

Quincy J. Byrdsong, Ed.D., CIM, CIP, CCRPExecutive Director of Research Administration

Virginia Commonwealth UniversityMedical Center

Research Coordinator 4th FridayLunch and LearnMay 28, 2010

Quincy J. Byrdsong, Ed.D., CIM, CIP, CCRPExecutive Director of Research Administration for the Virginia Commonwealth University Medical Center 2

Objectives• To provide the overall scope and implementation

focus of 21 CFR Part 11 and specifically Subpart B• To discuss applicability and describe the concept of

predicate rules• To identify the FDA-stipulated controls for closed

systems which create, maintain, or transmit electronic records

• To consider the research context of both VCU and the VCU Health System relative to electronic medical records and part 11 compliance

Quincy J. Byrdsong, Ed.D., CIM, CIP, CCRPExecutive Director of Research Administration for the Virginia Commonwealth University Medical Center 3

Scope and Implementation • March 1997-intended to permit the widest possible use of

electronic technology compatible with FDA’s responsibility to protect public health

• Focused on Good Manufacturing Practice (GMP) and Good Laboratory Practice (GLP)-more equipment intensive and greater emphasis on record integrity

• Good Clinical Practice (GCP)-focus on continued data integrity throughout the drug submission/approval process

21 CFR Part 11• Established criteria under which FDA considers electronic

records, electronic signatures, and handwritten signatures executed to electronic records to be “trustworthy, reliable, and generally equivalent to paper records.”

Quincy J. Byrdsong, Ed.D., CIM, CIP, CCRPExecutive Director of Research Administration for the Virginia Commonwealth University Medical Center 4

Applicability

• Applies to records in electronic form that are created, modified, maintained, archived, retrieved, or transmitted, under any record requirements set forth by FDA regulations (e.g. FD&C Act and PHS Act)

• Does not apply to paper records that are, or have been, transmitted by electronic means

Quincy J. Byrdsong, Ed.D., CIM, CIP, CCRPExecutive Director of Research Administration for the Virginia Commonwealth University Medical Center

Common Violations

• No correlation between e-records and paper print-outs

• Missing procedures, e.g., access control

• No back-up of data• No prevention of data

deterioration during archiving• No or inadequate computer

system validation

5

•No individual passwords•Insufficient system security•No electronic audit trail•(Electronic) raw data notsaved or lost

•Electronic records, including audit trail, not reviewed

Quincy J. Byrdsong, Ed.D., CIM, CIP, CCRPExecutive Director of Research Administration for the Virginia Commonwealth University Medical Center 6

FDA Guidance-August 2003

• Confusion regarding part 11– Scope too broad– Unnecessary controls and costs– Discouraged innovation and technological

advances• Guidance established a more streamline

approach and narrowed the scope so that fewer records would be subject to part 11

Quincy J. Byrdsong, Ed.D., CIM, CIP, CCRPExecutive Director of Research Administration for the Virginia Commonwealth University Medical Center 7

Part 11 Records•Records that are required to be maintained under predicate rule requirements and are maintained in electronic format in place of paper format. (i.e. records not required by predicate rules to be retained, but are still in electronic format, are not part 11 records)

•Records that are required to be maintained under predicate rules, that are maintained in electronic format in addition to paper format and that are relied on to perform regulated activities. (SOP may dictate.)

•Records submitted to the FDA, under predicate rules, in electronic format. Records used for the submission but not actually submitted are not part 11 records unless otherwise required by predicate rules.

Quincy J. Byrdsong, Ed.D., CIM, CIP, CCRPExecutive Director of Research Administration for the Virginia Commonwealth University Medical Center

Definitions

• Predicate rule-any FDA regulation which requires companies to maintain certain records and submit information to the FDA as part of compliance

• Example: 21 CFR 211.180 Records shall be kept for all components, drug products…

• Challenge: GCP lacks specific predicate rule record requirements in some areas

8

Quincy J. Byrdsong, Ed.D., CIM, CIP, CCRPExecutive Director of Research Administration for the Virginia Commonwealth University Medical Center

Subpart B-Electronic Records Controls for closed

systems• Limiting systems

access to authorized individuals

• Use of operational system checks

• Use of authority checks• Use of device checks

• Determination of training

• Written policies• Appropriate controls

over systems documentation

• Controls for open systems corresponding to controls for closed systems

9

Quincy J. Byrdsong, Ed.D., CIM, CIP, CCRPExecutive Director of Research Administration for the Virginia Commonwealth University Medical Center

VCU/VCUHS – Electronic Record

• VCUHS uses a Hybrid System• Hybrid System-an environment consisting of

both Electronic and Paper-based Records• Example: The system does not have an

electronic signature option, so the user prints the report and signs the paper copy. Hence, there is an electronic record with a paper/handwritten signature.

10

Quincy J. Byrdsong, Ed.D., CIM, CIP, CCRPExecutive Director of Research Administration for the Virginia Commonwealth University Medical Center

Cerner/Millennium• Millennium is primarily intended as an electronic health

record solution to support the activities of patient care delivery

• Millennium has capabilities that enable aspects of compliance with parts of part 11 but, does not make a representation of enabling compliance with Part 11

• The primary burden of compliance falls on the entity engaged in research activities that fall under Part 11– Millennium is used as an EHR as a source of data –

the process which follows ensures part 11 compliance.

Quincy J. Byrdsong, Ed.D., CIM, CIP, CCRPExecutive Director of Research Administration for the Virginia Commonwealth University Medical Center

Is Cerner/Millennium Part 11 Complaint?

• Each site configures Millennium to suit its intended use as an EMR at that site

• Since each clinical trial sponsor conducts its own audit, to include the EMR in the scope of audit would place significant burden on a site’s IT resources as well as compromise the protections of human subjects

– Audit scope could become quite invasive towards the EMR not primarily intended for use as a research database

• The objective should be to have a well defined and contained research information management process

Quincy J. Byrdsong, Ed.D., CIM, CIP, CCRPExecutive Director of Research Administration for the Virginia Commonwealth University Medical Center

VCU/VCUHS Options

1. Assume a risk-based approach for using the EMR source

2. Implement a manual paper-based process that includes the printing, signing, and archiving of EMR pages to meet the letter of current 21 CFR Part 11 requirements

3. Implement a site-developed process/system that incorporates human intervention for data validation/quality checks of EMR-derived data

4. PowerTrials

Quincy J. Byrdsong, Ed.D., CIM, CIP, CCRPExecutive Director of Research Administration for the Virginia Commonwealth University Medical Center

Human Protections Considerations: Confidentiality

• Access to Protected Health Information

• Contact with potential research subjects

• Confidentiality of subjects’ participation in clinical trials

• Database roles and privileges

Quincy J. Byrdsong, Ed.D., CIM, CIP, CCRPExecutive Director of Research Administration for the Virginia Commonwealth University Medical Center 15

Questions

Quincy J. Byrdsongqbyrdsong@vcu.edu804.628-3343