Compliance Zen

5 Helpful Data Integrity Resources

Looking for reliable, "how to" information around data integrity on the web can be a bit of a challenge. One man's "data integrity" is another man's "data quality" is another man's "data governance."  Without delving into the minutiae of each of these perspectives, I thought I'd offer up five of the resources I frequently call upon when conducting data integrity audits and data integrity training.

 

MHRA Inspectorate Blog on cGMP Topics

Recently, the UK's MHRA has run a series of blog postings on data integrity - what it is and what it ain't from the regulators perspective.  Here are the three worth reviewing:

• GMP Data Integrity: A New Look at an Old Topic, Part 1
• GMP Data Integrity: A New Look at an Old Topic, Part 2
• Inspecting Clinical Trials - the Trial Master File

The last one is of particular importance because so often cGCP compliance gets the short end of the stick when it comes to public data integrity enforcement.  While GMP warning letters get media attention, when clinical data integrity fails, firms can actually go out of business as FDA and other regulators reject significant parts of submissions such as multiple investigator sites or send back complete response letters that jeopardize investments and raise the ire of shareholders.  Clinical data integrity issues don't make the news often, but just one clinical trial with poor data integrity can easily cost a company years of effort and millions of dollars down the drain.

 

FDA Guidance on BECS Computerized System Validation

If you've been wondering why people are reopening and reviewing FDA's 2013 guidance, Blood Establishment Computer Validation in the User's Facility, then the short answer is that it offers fairly concise information and guidance on what FDA expects around modern computerized system validation when it comes to testing and ensuring data integrity.  Be aware that way back in the preamble to 21 CFR 11 Electronic Records; Electronic Signatures, question #65, FDA strongly suggested that this guidance (the draft version at least) was essential reading for all industries.

 

Responsible Conduct of Research at Northern Illinois University

This collection of webpages includes a nice summary of data integrity control points around data collection for scientists and researchers. It includes elements of both quality control and quality assurance, and provides additional reference documents.

 

HHS HIPAA Security Series

Whether your organization is regulated by HIPAA or not, a review of the HIPAA Security Series #4 Security Standards: Technical Safeguards newsletter from 2007 is well worth your time. The 17-page newsletter walks through specific technical security safeguards to put in place and test around data; safeguards that look remarkably (or not so remarkably, depending on your perspective) like those found in 21 CFR 11, Annex 11 and multiple guidance documents.

 

FDA's Application Integrity Policy - Points to Consider

Primarily used for submission-related data integrity concerns, parts of FDA's Application Integrity Policy are important to review regardless of where you sit on the cGXP continuum.  In particular, review FDA's Points to Consider for Internal Reviews and Corrective Action Operating Plans (caution: this FDA link can sometimes take forever to open). Even though this is from 1991, there is a lot of good information within this section of the policy (e.g., it's an oldie but a goodie).

 

Of course, this all presumes you haven't already bookmarked Cerulean's resource library for data integrity-related articles, case studies, interviews, and so on.

Parsing Data Integrity Definitions

Earlier this year, the UK’s MHRA published GMP Data Integrity Definitions and Guidance for Industry. This sixteen page document lays out definitions of various data integrity terms such as “data lifecycle” and “metadata” and “primary record” used by MHRA regulators and inspectors. Whether your firm sells medicinal products in the UK or not, this guidance document is well worth the time to read. Embedded throughout the document are multiple suggestions and expectations of real-world regulated data integrity controls that MHRA expects – and that FDA expects (at least according to public FDA Warning Letters issued over the past five years).

Amongst the various definitions and example controls set out by MHRA, are these four:

• Data integrity
• Data lifecycle
• Raw data
• Original record/True copy

Just these four terms have caused a great deal of consternation and confusion in the industry, and MHRA sets out to provide a framework within which to consider controlling the conversation and the data integrity expectations.

 

Data Integrity is “The extent to which all data are complete, consistent and accurate throughout the data lifecycle.”

Real-World Implication:  In order to ensure data accuracy, legibility, consistency, originality, attributability, completeness, etc. throughout the data lifecycle, data integrity controls need to exist all along the data chain-of-custody – from initial data creation, data processing and manipulation and usage, data transmission and/or interim storage, and then finally through long-term data archival and retention.  Computerized system validation is only going to go so far. Firms need data integrity policies, procedures, audits, training, and so on throughout all four stages of the data lifecycle.

 

Data Lifecycle is “All phases in the life of the data (including raw data) from initial generation and recording through processing (including transformation or migration), use, data retention, archive/retrieval and destruction.”

Real-World Implication:  All four stages of the data lifecycle need to be controlled, especially if the firm has a supplier create, manage, use, store, transmit, et al regulated data on its behalf. Data integrity controls must exist within – and a firm must audit – suppliers dealing in regulated data. Firms may want to obtain help from a data integrity expert to identify appropriate data chain-of-custody controls to insist upon at suppliers. Not all data integrity controls are created equal, and more data integrity should exist at a contract manufacturer or clinical research organization than at a supplier who simply prints product inserts.

 

Raw Data is “Original records and documentation, retained in the format in which they were originally generated (i.e. paper or electronic), or as a ‘true copy’. Raw data must be contemporaneously and accurately recorded by permanent means. In the case of basic electronic equipment which does not store electronic data, or provides only a printed data output (e.g. balance or pH meter), the printout constitutes the raw data.”

Real-World Implication:  Conversely, for data that are used to generate chromatographs, spectrographs, and other visual analyses, the raw data will likely need to be retained in its original, digital form.  As FDA notes, “The printed paper copy of the chromatogram would not be considered a “true copy” of the entire electronic raw data used to create that chromatogram, as required by 21 CFR 211.180(d). The printed chromatogram would also not be considered an “exact and complete” copy of the electronic raw data used to create the chromatogram, as required by 21 CFR 211.68. The chromatogram does not generally include, for example, the injection sequence, instrument method, integration method, or the audit trail, of which all were used to create the chromatogram or are associated with its validity. Therefore, the printed chromatograms used in drug manufacturing and testing do not satisfy the predicate rule requirements in 21 CFR Part 211. The electronic records created by the computerized laboratory systems must be maintained under these requirements” [see FDA's Level 2 FAQs on cGMPs].

In other words, there is no getting around the need for data integrity controls in the 21^st century.

 

Original Record/True Copy is “Data as the file or format in which it was originally generated, preserving the integrity (accuracy, completeness, content and meaning) of the record, e.g. original paper record of manual observation, or electronic raw data file from a computerized system; a True Copy is an exact verified copy of an original record.”

Real-World Implication:  This definition and its attended verification expectations is not just an MHRA expectation, it’s been a legal and regulatory expectation since the early 1990s, embedded in FDA 21 CFR § 11 (e.g., Part 11), the US Uniform Electronic Transactions Act of 1999, the international legal concept of a “certified copy,” parts of FDA’s Application Integrity Policy of 1991, and the most recent, internationally accepted British Standard 10008 Evidential Weight and Legal Admissibility of Information Stored Electronically (2014) that I was responsible for reviewing, editing, and verifying late last year.

 

MHRA’s data integrity definition guidance is one of many examples of insight into how data integrity controls allow the regulator – and thus the patient – to trust and rely upon your data claiming product safety and efficacy. While digital data integrity has been an established legal and regulatory principle for several decades now, the controls around data integrity are constantly evolving as technology, businesses processes, and organizations evolve. As should be evident from just the above four definitions, data integrity is not just an IT concern or a quality concern or a regulatory concern.

Data integrity is an issue of trust.  Either all the regulated day your organization generates, obtains from suppliers, uses, relies upon, and archives is trustworthy or it isn’t.  You can’t have a little bit of data integrity just as you can’t be a little bit pregnant.  Your data is either trustworthy or it isn’t.

 

If you need help with regulated data integrity chain-of-custody controls on any or all of the four stages of the data lifecycle, contact a data integrity expert through my firm’s website, Ceruleanllc.com.

 

FDA Training Records - Three Risky Challenges

Companies train their personnel in all sorts of FDA-related activities, from quality system SOPs to core regulatory requirements to company policies. Training is a common requirement of nearly all FDA regulations, from Part 11 to 21 CFR 820.

• What about training should be documented?
• What should be retained and for how long?
• Should training records be tied to individual personnel files or can we simply record group training?
• How do I go about figuring out who should be trained on what?

These questions carry with them significant risks - for FDA compliance, for product liability litigation, and for personnel-related allegations. When I give FDA compliance training workshops, webinars and speeches, many questions about training and training records often boil down to these tricky issues. Below, I'll answer a few aspects:

 

What specifically does FDA require us to document about training?

In only one place does FDA spell out specific items to document, in 21 CFR 111.14(b)(2) Current Good Manufacturing Practices for Dietary Supplements. FDA states:  “You must make and keep the following records:  Documentation of training, including the date of the training, the type of training, and the person(s) trained.”

At minimum, I suggest that ALL firms, irrespective of industry, follow the minimum specifics listed in 21 CFR 111.14. All the other regulations provide a summary statement similar to the one in 21 CFR 820.25(b):  “Training shall be documented.”

Unfortunately, in part because of these ambiguous requirements, a bad habit of using group attendance sheets has arisen over the years. Such group attendance sheets are easy, they get passed around, people sign their name, and voila – regulatory requirements met…right?

No.

Group sign-in sheets have multiple inherent weaknesses that - as many firms have discovered -  undermine compliance. For instance:

•  When did the individual sign?  Did they walk into training 5 minutes before the session ended and sign the sheet?   Did they walk out of training as soon as they signed the sheet to “take a quick call” and never return?
•  Was it actually that individual?  How often does someone match the signatures against a signature log?
•  How does signing a group “I showed up” sheet prove “I understand the training and I agree to abide by the training” with any level of accountability?

The reality is that most group attendance sheets go into a file drawer and are never seen again. FDA investigators understand that group attendance sheets prove little. In fact, in 32% of product recalls, FDA traced the root cause to ineffective training (US Federal Register, Vol 78, Iss. 11, 16 January 2013).

The proposed 21 CFR 117 specifically ties training to individual personnel records, eliminating the ability to use group sign-in sheets to prove FDA compliance. Supervisors are to be trained differently than line workers. And supervisors will have a responsibility to “ensure” that employees understand their obligations. Group sign-in sheets will not accomplish this.

Group sign-in sheets carry further risks for a company in two increasingly common situations:

• Product liability litigation
• Personnel discrimination or wrongful termination allegations.

Multiple US laws and regulations tie retention of training records to individual personnel files and roles performed. A 2008 SCOTUS ruling (CBOCS West, Inc. v. Humphries) on the statute of limitations in Section 1981 of Title VII (42 USC 1981) determined that job-related training records – such as training on SOPs – are examples of proof that can be used to show a company discriminated (or conversely, used to prove that a company did not discriminate) for several years after an employee's departure. As a result, firms now keep job-related training records for the duration of an employee’s term with the company plus at least two years (e.g., "date of departure + 2 years").

So how does your Quality group track the employment durations of each individual with your company?  Or perhaps they are planning to keep every single group sign-in sheet for at least 30+ years?

These are just some of the reasons why group sign-in sheets for training now cause more risks and problems than they solve.

 

What record(s) should I retain to prove personnel were trained appropriately and understood the training?

With my clients that I help either in FDA quality system consulting or in FDA recordkeeping consulting, I recommend retaining two record types:

1. Training Matrix
2. Individual Certificate of Acknowledgement

 

About the Training Matrix

A Training Matrix can be as simple or as complex as you desire, from a basic Excel spreadsheet to an Oracle or SQL database of some sort. Using an Excel spreadsheet, the left-hand column should list all the organization’s personnel; the top row should list all the potential training that could be received (specific SOPs or policies, regulations, etc.). The grid is then filled in either with the date last trained or with a shaded cell to indicate “not necessary.” Feel free to come up with other designations for date scheduled, type of training (“in person” vs. computer-based vs. “read-and-review”), and so on.

The purpose of the Training Matrix is two-fold:

1. Tracking who needs to be trained on what versus who has already completed training; AND
2. Quickly and easily showing an outside auditor or regulatory investigator the current “state of training.”

From a retention standpoint, the Training Matrix is what’s termed a “living” document. It’s constantly updated.

That said, from a risk-mitigation standpoint, I suggest my clients take an annual snapshot of the Training Matrix and archive that annual snapshot for a period of years equal to their local state statute of limitations such as 3 years or 6 years. Such a snapshot of a "living document" is not required under any regulation, it’s simply a precaution to allow the firm to quickly and easily trace who had training on what and when without having to cull through individual personnel records. It's a reminder that the Training Matrix is designed to be practical and user-friendly throughout.

With any luck, the Training Matrix is as far as the FDA investigator will need to go. However, deeper dives into specifics of what a person was trained on within a particular training session as well as the how the supervisor ensured the training was effective look to Individual Certificates of Acknowledgement.

 

About Individual Certificates of Acknowledgement

In each individual personnel record is the Individual Certificate of Acknowledgement.

An example Certificate of Acknowledgement documents the following items:

•  Topic of training session
• Date of training session
• Key responsibilities/requirements covered in the session
• Individual’s acknowledgement that he/she understands his/her obligations
• Individual’s agreement to comply with the requirements/obligations
• Supervisor’s review and agreement to supervise the individual to the requirements/obligations.

Not only does this comply with both the intent of the regulatory requirements, it also has a critical added benefit:  since the 1950s, studies have shown that this type of written, individual acknowledgement consistently improves compliance by up to 89%.

This is why the individual Certificate of Acknowledgement (or “Commitment” or “Understanding” or whatever word you want) is so powerful:

• Improves compliance by 89%
• Complies with all current US laws, court interpretations and regulations associated with training records.

One tool to comply with multiple regulations and strengthen compliance at the same time:  that’s a lean compliance technique.

 

How do I begin to create role-based training assignments when there might be hundreds or thousands of SOPs and policies?

The key challenge is to avoid getting lost in the details. Training everyone on everything is nice in theory, but breaks down quickly in practice; the larger an organization, the more unwieldy and ineffective the training will become.

Traditionally, there are two choices in how to tackle role-based training:

• Work with your local HR/personnel department to idenfity overall training requirements for each functional group; OR
• Work with each functional leader (department heads, team leads, etc.) to do the same.

I advocate a more practical, flexible lean compliance approach:

Assemble a temporary, working group of representatives from each functional area and HR to carve out initial sets of "buckets." In essence, everyone in functional group X gets trained on SOPs 1 and 2; everyone in functional group Z gets trained on SOPs 2, 3, and 4; everyone in functional group A, gets trained on SOPs 4, 5, and 6; and so on.

That's the core initial population of the Training Matrix.

Then, I take that initial populated draft of the Training Matrix and go to each department head to review, tweak, answer questions, and verify. After the quick verification sessions with the department heads, the Training Matrix is now fully populated, the functional heads and their direct reports are happy, and so is HR. It's a win-win-win.

And I don't worry about "is the Training Matrix perfect?" because it is - as I noted above - a "living document" that will get modified as time goes on.

This can also help reduce the drag of training on productivity. The more time spent in training, the less revenue-generating work is completed. Thus, the goal of the business is to have the minimum amount of training necessary; in other words, to balance compliance with profitability.

 

FDA lean compliance provides a company defensibility with records while reducing overhead, strengthening compliance, and improving profitability.

To learn more, visit my firm's website at www.ceruleanllc.com or read previous client stories and testimonials.

Medical Apps, FDA and Patient Data Integrity

Two recent articles - one in the Washington Post entitled Health-care Apps of Smartphones Pit FDA Against Tech Industry and one in the Wall Street Journal entitled There's a Medical App for That-Or Not - have raised the spectre of how smartphone medical apps imply an imminent trainwreck between today's rapid-pace innovation and last century's slower-going FDA regulation.

 

  vs? 

What's the real question?

As I note in Get to Market Now!, new innovations and technologies emerge on average every 6 months while new or revised regulations take 12-14 years. Today, there are over 13,000 medical apps available for you and me; another 5,000 are available just for physicians and healthcare providers. By the time you finish reading this post, another medical app will have been published.

From a business perspective, the thought of FDA dragging down innovation to the rate of regulation is frightening. And while there is also the need to protect the public - and physicians - from medical apps that are unreliable, faulty, and just plain poor, is new regulation the answer? Is treating a $1.99 app like an MRI the answer? Innovation wouldn't stop. The price would just go up. Instead of paying $1.99, you'd just pay $1,990 for the app.

So, assuming that's not our goal, then what's the answer? Well, maybe we should step back from racing to find an answer, and reframe the question. Afterall, there's no point in arguing over the answer if we're not all answering the same question.

I suggest the real question has little to do with speeding innovation, keeping the public safe, enabling informed healthcare consumers, or making healthcare professionals more efficient. Those are all wonderful points, but they are not the core question behind how to, or even whether, we should regulate a medical app.

The real question is simpler:  How do we - as a society - ensure that patients and healtcare providers can rely upon the health data used/maintained in a medical app?

Think about it. Would you want one of the regular updates to an app on your smartphone to corrupt all the previous data you had in it?

In today's video game market, data corruption is a painful reality becoming more and more common - patches and updates to games increasingly have to be withdrawn and redone because they accidentally corrupted and destroyed people's previous game data. It's too late for those consumers whose data files were destroyed.

"Well, sure," you say, "but those are game files. I mean, come on." And then think about it:  is that what you want for your smartphone health app?  You'd be hard-pressed to find a patient or a physician okay with running that risk for all their health data. Are you okay with all your health data and trends over the past year being wiped out while an update to your app is downloaded as you sit at Starbucks sipping that latte?

So this is the core question:  how do we ensure that data entered into a medical app stays trustworthy?

And if we reframe it in this way, then we can cast about for already existing regulations, controls and tools. And yes, we already have them.

 

Today's Medical App Controls

I see four significant controls available today. The first two are pure market-driven, the second two are more "guiding hand" industry best practice combined with existing regulation:

1. Consumer reviews.  Admittedly, there are some drawbacks to this as we don't know if the person writing the review is knowledgeable, and sites that rely on consumer reviews are usually fairly easy to game. So, consumer reviews are not a stand-alone control, only a piece of the control puzzle.

2. Product liability litigation.  Yes, it's coming if not already occurring. Face it, if you can find a lawyer able to beat a restaurant for serving too hot a cup of coffee, you can find a lawyer able to beat a medical app for allowing your medical data to become corrupt. Still, because it can take up to two years for such product liability litigation to emerge, this is not a preventative except in the long, long-term. Product liability litigation is only another piece of the control puzzle. If nothing else, right now, medical app makers will want to include some level of documented risk assessment to patient data as part of their development process, otherwise, expect to defend why you didn't when you sit before the court in 18 months.

3. Software quality control practices.  Great in theory, often poor in practice. The reality is that often companies cut quality control in order to rush products to market. When a medical app can be written and quality checked by the same person all in the span of a 14-hour day, software quality control is not a stand-alone data integrity control to rely upon. Nonetheless, I'd argue it is still a part of today's control puzzle. Everything from ISO to CMM should be on the table here, and it'd be nice if we could start to see some sort of reference by medical app makers to the software quality coding method used to make their app and its inevitable updates.

4. Part 11.  Yes, I said it. 21 CFR 11 Electronic Records; Electronic Signatures. Now, before you bring up the spectre of "validate everything" (and trust me, as a recovering "validate everything" addict, I've got a lot of personally painful, embarrasing stories), I'm discussing how Part 11 (and the EU's Annex 11) are interpreted and enforced today. Today, Part 11 is all about data integrity - ensuring that data that is trustworthy. And isn't that the core question we just defined above?

So if a medical app provider can show that his/her medical app maintains data with integrity (i.e., is Part 11 compliant), isn't that enough for the vast majority of the 18,000+ medical apps out there?

Coincidentally, Sweden's Medical Products Agency just released a guide to the EU's medical device directives that discusses controls, risks, and expectations for medical software - including medical apps. Download a PDF of Sweden's guide here. It's approach seems quite reasonable. Makers of medical apps are to conduct a risk assessment of their app that includes risk to the patient (see control #2 above), and be able to demonstrate that the app meets its intended performance goals (see controls #3 and #4 above). Finally, the guide notes that smartphones and tablets, etc., will never be considered (and regulated as) medical devices unless they are specifically converted to be a medical device.

If only we in the States could be so reasonable....

From the Medtech QA/RA Global Conference

New European medical device regulations are due within 18 months. The new rules will update the current Medical Device Directives (MDDs) for the 21st century, and close the gaps so brutally uncovered by the PIP scandal and the metal-on-metal issues. Industry is proactively adjusting their quality systems and regulatory compliance programs while key executives are encouraging EU regulators to avoid US-style over-regulation.

These were the principle themes infusing the two-day Medtech QA/RA Global Access 2012 conference hosted by the Irish Medical Device Association (IMDA) in Galway, Ireland last week. With over 250 medical technology companies calling Ireland home, including 11 of the top 13 device firms in the world, Ireland has become Europe's center of excellence for devices. And IMDA's Medtech meeting is Ireland's flagship conference.

Much of Day One was devoted to discussions of the planned MDD revisions, with speakers from the European Commission, the European Parliament, the Irish Medicines Board (IMB), Eucomed (the Advamed of Europe), and industry. Europe encourages "responsible innovation" by relying more upon vigorous postmarket surveillance, inspections and adverse event reporting rather than any pre-approval scheme such as the FDA's 510k. Instead, the EU has only pre-market assessments and the CE mark. IMB's Ann O'Conner noted that 65% of vigilence reporting leads to product recall and removal. This state of affairs, with its regulatory burden primarily on the postmarket stage, allows for rapid inclusion of new technology, and new scientific and engineering innovation, an approach I advocated in my latest book, Get to Market Now.

The EU's new MDDs will require a number of elements that are outlined in Global Hamonization Task Force (GHTF) guidelines such as:

• Summary technical evaluation document (STED);
• Unique device identifiers; and
• Adoption of the GHTF's four risk categories for medical devices.

For readers of my client newsletter, SmarterCompliance, adoption of GHTF guidelines should come as no surprise. FDA is moving to GHTF inclusion as well, albeit a bit more slowly than Europe. Whether FDA's "slowly but surely" pace of harmonized rule adoption will inadvertently put US-based device makers at a disadvantage on the global marketplace remains to be seen. European parliamentary elections are scheduled for June 2014, so expect the new MDDs to be in place by then if not sooner.

In addition to a high-level presentation by FDA on "possible, eventual 510k updates," the rest of Day One was taken up with surveys of the state of device regulations in India, China, Russia, the Middle East and North Africa.

Day Two of the conference saw speakers delve more deeply into practical implications and challenges behind the new rules. One set of challenges will be the new clinical rules in the updated MDDs. The IMDA is hosting a two-day conference later this year to address the new EU clinical evidence rules.

I had the privilege of presenting on elements of a defensible record-keeping program for complaint handling and medical device reporting. The message I had for attendees was two-fold:

First, it is clear that complaint handling records and complaint files hold both regulatory and legal risks. Focusing only on quality system compliance can leave a firm vulnerable to disgruntled customers increasingly willing to file a lawsuit to get monetary compensation. Thus, quality auditors must also assess the content of complaint records to help minimize risk to their companies.

Second, complaints can come into a device company through more than just "official" channels. Whether a complaint is made to the saleswoman manning a conference booth or to the company vice-president speaking to a patient advocacy group, each person dealing with the public must receive some level of complaint handling training.

As with any in-person compliance speech or workshop I provide, I gave attendees handouts to help with both of these issues:  an internal quality auditor checklist for reviewing complaint files and a list of complaint documentation do's and dont's.

The next IMDA Medtech conference is scheduled for 2014 just as the new EU MDDs come into force. It promises to be an exciting event, so keep an eye out for announcements.

In the meantime, consider attending some of these events where I'll be offering advice on optimizing your quality system and regulatory compliance programs:

• June 14 teleconference on defensible documents
• June 22 speech on the role of IT departments in effective regulatory compliance
• July 25 teleconference on effectively managing an FDA inspection
• July 31 workshop on 21st century supplier management and qualification

More upcoming lean compliance events can be found on my upcoming events page on the Cerulean website.

Recent 21 CFR 11 Questions & Answers

Since FDA announced its intent to vigorously enforce 21 CFR 11, I've collected various questions posed by attendees at my workshops and speeches on 21 CFR 11 compliance. Now, one year later and a year's track record of Part 11-related FDA Warning Letters, I thought it might be time to walk through a few of the most common questions and answers. Hopefully, this will help you stay on the right track when it comes to validating non-product software, computerized systems and Part 11 validation.

Q:  Will the FDA cite you for 21 CFR 11 non-compliance?

Yes...and no. Unfortunately, despite FDA's intent to raise the enforcement profile of Part 11, no Warning Letters actually cite 21 CFR 11, only the predicate rules. That said, the agency is trying to make clear the responsibility of firms to comply with Part 11 rules for electronic information:

You are responsible for the accuracy and integrity of the data generated by your firm. Provide a more comprehensive corrective action plan to ensure the integrity of all data used to assess the quality and purity of all drugs manufactured at your facility, including any registration lots. (Warning Letter to Cadila Healthcare, June 2011)

Or this one:

You are responsible for the accuracy and integrity of the data generated by your firm. A firm must maintain all raw data generated during each test, including graphs, charts, and spectra from laboratory instrumentation. These records should be properly identified to demonstrate that each released batch was tested and met release specifications. Appropriate record retention policies should also be in place. … Should product quality or safety concerns arise in the future, the original records pertaining to batches listed in an application may be integral in providing reasonable assurances to the Agency regarding a product and integrity of data submitted to support it.  (Warning Letter to Ningbo Smart Pharmaceutical Co., February 2011)

As should be clear from the above Warning Letter excerpts, FDA’s enforcement emphasis for Part 11 compliance is all about how companies ensure — or fail to ensure — record integrity (including, as in the Ningbo situation, appropriate FDA records and document retention).

Q:  Does the FDA conduct random 21 CFR 11 only inspections?

No.  The FDA does not conduct random Part 11-only inspections. The only reason a stand-alone, "for cause" or PAI-type of Part 11 audit occurs is because the agency has very serious concerns regarding data integrity directly impacting product safety (i.e., impacting public safety).  Since 1997, the only examples of stand-alone Part 11 audits that I know of involved one the following:

• whistleblower complaint alleging data fraud (triggered a "for cause" inspection)
• submission with serious data integrity issues (triggered a pre-approval inspection)
• meta-analysis of adverse event reports, clinical trial data, etc. led to a "for cause" inspection of a contract research organization

The problem, of course, is that these situations ended up blind-siding the firms involved and their management. Thus it seemed like it was random. Executives had zero idea that these inspections would occur because the data in question was in a submission, in an adverse event report, or was part of a whistleblower complaint from a disgruntled former employee. This was all data and historical documents that the firm thought it was "done with" and there were no more risks when the FDA knocked on the door.

As I point out to my clients when I help them put in place lean Part 11 controls, the records and documents that trigger Part 11 concerns tend to be all the stuff that people have completed. You are no longer paying attention to such historical info. Ironically, once you're "done with" the processes and projects that generated the data, that's when FDA actually starts paying attention. So the key is to have Part 11 controls such as validation, qualification, electronic security, qualified IT vendors, and a FDA records retention policy that work for both active and archived records.

Q:  Do I need to validate commercial software like Microsoft Word or Excel?

No. Nor will you be able to without significant input from Microsoft - input you will not get unless you can write a multi-million dollar check (and not have it bounce). Here's what George Smith, the chair of FDA's internal Part 11 working group has to say on this:

Validation is to intended use. Thus, the exact same two computers or two exact same software installations at two different companies produce two different sets of records.

In other words, you validate the process in which you use Word or Excel (or any other commercial software) for its intent (production and maintenance of a record, computation of a formula, etc.). The degree of risk associated with the process/data will drive the level of validation needed and the degree of Part 11 controls necessary on the automation involved and the records generated.

Thus, if I use a spreadsheet macro in order to calculate a critical quality attribute of temperature, then I'd validate the macro itself and ensure a significant number of controls on the macro (so it wasn't accidentally messed up if an Excel patch is auto applied) and on the data results. I would not go about trying to validate Excel as a piece of software. Incidentally, a good resource on spreadsheet macro validation in laboratory environs is Ludwig Huber's LabCompliance.com site.

Likewise, if I use Word to author SOPs, I would not validate Word per se but rather validate my SOP process that happens to rely upon Word to automate some aspects (spelling, etc.). In this light, my validation efforts will likely be very light (afterall, how many of us have the money and time to spend conducting process validation on our SOP of SOPs process?).

The key is to view any commercial software as a tool. When it comes to off-the-shelf software, think of Part 11 validation as automated process validation rather than computer validation. The Part 11 controls then largely center around ensuring data integrity (i.e., data integrity tips or steps).

Q: How do I deal with a software vendor who issues automated patches (such as virus scan engine updates, bug fixes, hotfixes, etc.) and won't agree to notify us ahead of time?

This is why you cannot validate commercial software - you have zero control over it.  Without control, there is no validation.

And yet you still have to manage changes to the environment in which your electronic records exist.  Remember, your personnel perform various regulated actions, undertake specific processes, and make decisions using those records (which are, in turn, reliant upon an IT infrasctructure that is in a "state-of-control"). This is how IT compliance, and 21 CFR 11 compliance in particular, goes awry. Where do you start? How do you control an IT environ over which your vendors exert considerable influence?

In general, the best answer is make the decision that my clients have taken - to bring an outside expert to either run a Part 11 workshop for the firm, to help draft 21 CFR 11 validation protocols, to conduct a mock Part 11 audit, or some other means by which your site specific questions can be addressed.

In the context of dealing with a vendor who issues automated software updates, the best approach that I've seen over the past decade take a three-phase tact:

1. Compile a "pre-approved" change list that then goes through normal change control
2. Conduct quick, basic, retrospective testing when such updates are noticed AND they may have an impact to the electronic data
3. Have Quality audit to the above.

Number two - the quick, basic, retrospective testing - can get tedious and potentially allow for IT and Quality to start arguing over what should have been noticed, what should have been retrospectively tested, etc. Avoid this by agreeing on some common criteria.  For instance, any patch that states upfront it "affects data stability" (from an old Microsoft patch for Windows a few years back), should get some testing. Another example is large service packs (in other words, if the patch is big enough for the vendor to change its CD/DVD press labels, it's large enough for you to do some testing).

Next Steps

When was the last time you cringed after reading an email regarding Part 11 by someone in your organization? Or listened as someone listed off all the expensive, costly ways in which Part 11 was too much for your company? Maybe it was last week or last month.  It’s not that your colleagues and team members don’t care about Part 11, it’s that they just don’t know how to move from last century’s misinterpretations and frustrations to today’s lean Part 11 compliance.

Your Quality, Regulatory Affairs, IT, Records Management and other operational employees must know how to work effectively and productively under Part 11 rules.

I started Cerulean Associates LLC to provide this type of practical, lean compliance advice on 21 CFR 11 compliance. As an FDA inspector-trained Part 11 expert, I have 20 years of business expertise being accountable for regulatory compliance (and the costly mistakes to prove it). If you'd like to learn more about avoiding FDA Part 11 and business trouble, visit my Part 11 consultant page or simply contact me directly.

I look forward to your feedback.

FDA's New Focus on Part 11

FDA's renewed emphasis on 21 CFR Part 11 is the subject of my audio-conference on Thursday, November 4th.

This past summer, FDA announced that it would step up increased enforcement of its data integrity and quality regulations known as Part 11.

Is this a return to "validate everything"?

Validation, legacy systems, audit trails, record integrity, and record retention processes will be under scrutiny by the FDA.  With so many areas of focus and a short amount of time to prepare for increased enforcement, it’s essential to prepare now. But where should you start? Who should be involved?

Questions to be answered during the 90-minute Part 11 training program:

• What are the top compliance failures cited in Part 11-related inspections?
• What steps can you take to identify and address weaknesses in your electronic records?
• How can you prepare your legacy systems for inspection?
• What steps should you take to prove data quality and record integrity?
• When do you need to have an audit trail?
• What are the recent trends in FDA enforcement of Part 11?
• What should you expect from an inspection that will tackle Part 11 compliance?

I've designed this to largely focus on areas of GMP, GCP, and QSR-related processes and sites.

If you'd like to register, please visit  http://www.thompsoninteractive.com/site/offer.jsp?promo=FDAR4WC0&priority=FKYG90145

Hope to hear from you on the call, and please let me know if you've signed up - drop me a line!

FDA Part 11 and EU Annex 11 Discussion

FDA's renewed emphasis on enforcing 21 CFR Part 11 - along with the EU's re-issuance of Annex 11 - is the subject of my new webinar on Tuesday, October 12th.

If you're based in the US, clearly Part 11 is of concern, but if you're based outside the US yet sell products in the US, Part 11 needs to be on your radar.  The same holds true if you're based in the US and sell products in the EU - you'll be complying with Annex 11 as well.

What will this mean for you?

FDA has begun extending routine inspections to evaluate compliance with Part 11 requirements to ensure companies are maintaining electronic records and document controls with accuracy, integrity, and authenticity.  There are many questions about this effort, and worries that this presages a return to the days of "validate everything."

The EU recently issued its revised Annex 11 to the EU GMPs on electronic data integrity, and firms in the US are woefully unprepared.

During the program, I'll walk you through the scope of the new Part 11 enforcement program and compare it to Annex 11, offer insights into what inspectors are looking for, and provide suggestions on how to prepare your company for the upcoming inspections.

Overall agenda:

• New requirements in Annex 11 and FDA's reinterpretation of Part 11
• How to use risk-based decision-making to support your IT compliance plans
• Steps to take advantage of vendor efforts, documentation, and services
• FDA Part 11 citations associated with e-record integrity and data quality
• Cost-effective strategy for complying with Part 11 and Annex 11

Attendees will receive bonus documents, a trial subscription to my FDA client newsletter along with some other freebie downloads.  If you'd like to register, please visit the ExpertBriefings website at http://www.ExpertBriefings.com.

Hope to hear from you on the call, and please let me know if you've signed up - drop me a line!

September FDA Newsletter Available

Issue #45 of SmarterCompliance is now available.  Content includes:

• Challenges in retaining electronic data for FDA compliance
• Cost-effective GCP auditing (part two)
• Recent FDA 483 citations on certificates of analysis
• Trend watch
• Leadership quick-tips: Prioritizing projects
• Book of the month:  Making It All Work
  

Subscribers have access to newly published documents including:

• OIG report on how FDA-CMS collaboration can reduce drug and device costs
• FDA final guidance for lens manufacturers and distributors
• FDA-CMS collaboration notice from the Federal Register
• EMA guidance on clinical trial data retention and transfer

If you'd like to get an FDA newsletter like SmarterCompliance (ISSN: 1937-0776), along with hundreds of bonus downloads, templates, checklists, and regulatory agency advice, you may subscribe online by following this link.  Members of SQA, RAPS, FDLI, and AMDM can receive a significant discount.

Pfizer's Internal Documents Come Back to Haunt after $2.3 Billion Settlement

Blue Cross Blue Shield filed a lawsuit earlier this year against Pfizer in an effort to recover reimbursements for illegally promoted drugs such as Bextra. The lawsuit names individual Pfizer employees - all in management roles - and relies in large part of the internal Pfizer memos, reports, emails, presentations, promotional materials, and other records used to force the 2009 settlement with the US Department of Justice for $2.3 billion.

One of the points I make with my FDA records management clients is that if you are in a supervisory role - whether a district sales manager, a regulatory affairs director, or an executive vice-president - count on your emails, the meetings you attend, the notes you take, the expenses you approve, the drafts you review, and the presentations you give, becoming public knowledge when things go badly with your firm.  It does not matter how good your intent, your words and phrases will be twisted and turned in the public eye - and in the eyes of the court.

The only way to legitimately minimize the risk of an email or an SOP signature being taken out of context is to have a document retention and records management program that you follow.

To work with a records management compliance consultant, recognize that you want one who has experience both with FDA rules and how those regulations are evolving in the industry, as well as one who has had to defend records, SOPs, and policies to inspectors and lawyers alike.  Also, be clear - the larger the firm you work with, the higher the cost but NOT the lower the risk.  Therefore, start by finding an outside expert who's articles and workshops you agree with, whose writing you enjoy.  Make sure that their answer to any question is not a pat "outsource everything to us."

If you can't afford to work with an outside records compliance expert - or you want some "heads-up" advice so you know enough to see if you even need an outside advisor - then consider getting a copy of my recorded FDA records management seminar or asking me to conduct a one-day, on-site workshop for your management team on FDA document retention practices.  Depending on your requirements, I can also conduct this workshop with a former FDA and DoJ prosecutor who will happily walk you through how your best intentioned records will be used against you.

Records and document management is not sexy.  But it is necessary.  And in the public's fascination of who knew what when at your company, records management is how to minimize your exposure and risk when bad things happen.  Good records and document controls are proactive risk management.

The question isn't, will you implement good records controls, it's when.

Are you ready?