Part 11 Electronic Records Electronic Signatures Answers to

Part 11; Electronic Records, Electronic Signatures Answers to Frequently Asked Questions P. Motise

We will cover l Scope u l l Typewriter excuse Open vs. Closed systems Audit trails/time stamps Certification Enforcement u Legacy systems

Scope, 21 CFR 11. 1 l Q. Does part 11 apply to all of our electronic records?

Scope, 21 CFR 11. 1 l Q. Does part 11 apply to all of our electronic records? u l Ref: 11. 1(b) A. No Only per codified records requirements u (For submissions) - Per statute u

Scope, 21 CFR 11. 1 l Predicate rule/law requires record: Creation u Contents u Signature(s) u Archiving u n Original vs copy

Scope, 21 CFR 11. 1 l Q. Apply only to signed records? u l Ref: 11. 1(c), (d); comment para 26 A. No u Any e-record per codified requirement

Scope, 21 CFR 11. 1 l Q. Apply to signatures not required but in required record? u l Ref: comment para 100 A. Yes; they also need to be trustworthy and reliable.

Scope, 21 CFR 11. 1 l Q. Must e-records have e-sigs? What about hybrids?

Scope, 21 CFR 11. 1 l Q. Must e-records have e-sigs? What about hybrids? u l Ref: 11. 1(c), 11. 2; 11. 70; A. No; hybrids are possible u Hybrids problematic link h-sig to e-record n non-repudiation n

Scope, 21 CFR 11. 1 l Q. Apply to e-record systems that generate paper? (Typewriter excuse) u l Ref. Comment para 22 A. Yes (unless system=typewriter) u Printouts don’t exempt e-records from part 11

Scope, 21 CFR 11. 1 l Paper printout of e-record is NOT traditional paper record u E-record controls determine Paper: trustworthiness n reliability n differ from true paper (typewriter) paper system n

Scope, 21 CFR 11. 1 l Printouts and e-records differ re: u Content n u e. g. , meta data (audit trail), hidden text, e-sigs. Auditing properties n search/sort/send features

Part 11 more. . .

Part 11 Applies Process In Process Out Changes

Scope, 21 CFR 11. 1 l What is an electronic record? u Ref: 11. 3(b)(6)

Electronic Record 11. 3(b)(6) any combination of text, graphics, data, audio, pictorial, or other information representation in digital form that is created, modified, maintained, archived, retrieved, or distributed by a computer system

Scope, 21 CFR 11. 1 l When do “data” become an electronic record, per part 11? u l Ref: comment paras 22, 45, 72 A. When “saved” to durable medium E. g. , disk or tape u Retention per predicate regulation u

Scope, 21 CFR 11. 1 l Q. Different e-sigs for types of signing (e. g. , initials vs full name)? u l Ref. 11. 1(c), Comment para 28 A. No u Any e-sig good for any signing

Scope, 21 CFR 11. 1 l Q. Will FDA certify/approve part 11 products/services? u l Ref. Comment para 5 A. No u Be wary of endorsement claims

Definitions, 21 CFR 11. 3 l Q. Are all h-sigs biometric? u l Ref. 11. 3(b)(3) Comment para 39 A. No Biometric = unique/measurable action or physical feature is measured u Image is NOT an Action u

§ 11. 3 Definitions l Closed system “an environment in which system access is controlled by persons who are responsible for the content of electronic records that are on the system. ” more. . .

§ 11. 3 Definitions l Open system “an environment in which system access is not controlled by persons who are responsible for the content of electronic records that are on the system. ”

Definitions, 21 CFR 11. 3 Open v. Closed System l Q. Does phone access make system open? u l Ref. 11. 3(b)(4) Comment para 44 A. No u If persons responsible for record content control access to system holding record

Company A A’s Records System A For A - System is CLOSED more. . .

Company A A’s Records System A For A - System is CLOSED more. . .

Company A Company B A’s Records B’s Records System A For A - System is CLOSED For B - System is OPEN

Archiving, 21 CFR 11. 10(c) l Q. Can firms archive e-records as paper printouts only? u l Ref. 11. 10(b)&(c), Comment para 71 A. No Saved record must be electronic u Must be able to generate e-copies u

Archiving, 21 CFR 11. 10(c) l Q. Need firms save equipment needed to read e-archives? u l Ref. 11. 10(c); Comment para 70/71 A. No Transcriptions OK for accurate/ complete copies. u Keep meta data and e-sig links u

Audit Trails, 21 CFR 11. 10(e) l Q. What must audit trail contain? u l A. Date/time of operator entries or actions that: u l Ref. 11. 10(e); Comment paras 72, 75 create, modify, or delete record A. Who did what/wrote what & when

Audit Trails, 21 CFR 11. 10(e) l Q. Can audit trail be paper? u l Ref. 11. 10(e) Comment paras 72, 73 A. No u Must be computer generated (e-record)

Audit Trails, 21 CFR 11. 10(e) l Q. Must audit trail be signed? u l Ref. 11. 10(e) Comment paras 73, 75 A. No Must be independent of operator u Operators should not be able to sign audit trail u

Time Stamps, 21 CFR 11. 10(e)/11. 50(a) l Q. Must time stamps synchronize to trusted 3 rd party? u l Ref. 11. 10(e) Comment para 73 A. No u Ensure clock accuracy - no abuse

Time Stamps, 21 CFR 11. 10(e)/11. 50(a) l Q. Must time be local to activity/ signer? What format? u l Ref. 11. 50; Comment para 101 A. Yes Can have remote time, too u Unambiguous format u

Signature Manifestations, 21 CFR 11. 50 l Q. Can codes substitute for printed name (e. g. , people having same name)? u l Ref. 11. 50(a)(1), Comment para 102 A. No. Need unambiguous printed name u Augment w/other codes, optional u

Signature to Record Linking, 21 CFR 11. 70 l Q. Must encryption based links be re -set, records signed anew, should outdated algorithm break? u l Ref. 11. 70; Comment para 113 A. No. u Need reasonable, not bulletproof, security levels.

Certifications, 21 CFR 11. 100(c) l Q. One per employee or facility? Personnel updates? u l Ref. 11. 100(c), Comment paras 52, 119 A. No. Person = organization or individual u Institutional certification, global u

Certifications, 21 CFR 11. 100(c) l Q. Example of certification? u l Ref. 11. 100(c), Comment para 120, pg. 13456, 62 FR, No. 54, 3/20/97 A. Yes

Pursuant to Section 11. 100 of Title 21 of the Code of Federal Regulations, this is to certify that [name of organization] intends that all electronic signatures executed by our employees, agents, or representatives, located anywhere in the world, are the legally binding equivalent of traditional handwritten signatures.

Continuous Sessions, 21 CFR 11. 200(a) l Q. Can system logon be 1 st signing? u l Ref. 11. 200(a), Comment para 124 A. Yes u When e-record is signed.

Controls for ID/PWs; Device Testing, 21 CFR 11. 300(e) l Q. Can token/card security negate need for periodic testing? u l Ref. 11. 300(e), Comment para 138 A. No Cards not foolproof u Test for unauthorized account changes, not just id info. u

Part 11 Enforcement l Will “legacy systems” really have to comply with part 11?

Part 11 Enforcement l Will “legacy systems” really have to comply with part 11? u l Ref. Comment para 9 A. Yes. u No “grandfathering”

Part 11 Enforcement (Default for all regs. ) l l Nature/extent of deviation Impact on product quality/data integrity Adequacy/timeliness of corrective action plan Compliance history

Part 11 Enforcement l Intensified surveillance u l Customary option At worst: u E-records not usable for predicate rule n Predicate rule violated

Part 11 Adopters? l l l Patent and Trademark Office Environmental Protection Agency Drug Enforcement Admin. Internal Revenue Service Social Security Administration more. . .

Part 11 Adopters? l l l Justice Department General Services Admin. Health Care Financing Admin. u 45 CFR 142 (Security & E-Sig Standards)

HCFA l 45 CFR Part 142 Security and E- Signature Standards u Individual health info and e-sigs u l Covers: Health plans n Health care clearinghouses n Health care providers n

HCFA v. FDA (Similarities) l Same areas of concern ID & authentication u Authorization & access control u Accountability u Integrity & availability u Communication security u Security administration u

HCFA v. FDA (Differences) l Overall emphasis HCFA - Confidentiality/privacy u FDA - Record integrity/auditability u l Digital signatures HCFA - Mandatory for required sigs. u FDA - Optional u more. . .

HCFA v. FDA (Differences) l Certification HCFA - Compliance w/standards u FDA - Intent re: h-sig/e-sig legally binding equivalence u l Self Audits HCFA - Required u FDA - Not mentioned u more. . .

HCFA v. FDA (Differences) l General requirements u l FDA - 2 Specific requirements u l HCFA - 25 HCFA - 64 FDA - 32 Optional controls u HCFA - 15 FDA - 2

HCFA Mapped Standards l Practices taken from: u 55 standards (including part 11) n Issued by 12 organizations: ANSI s FDA s IETF s Do. D s ASTM NIST ISO/IEC NRC/NAS CEN IEEE PKCS HMAC more. . .

Part 11 Controls/Concepts l l AIIM/ANSI MS 64 - re: Audit trail info NAS/NRC - Report on Health Care Records - Security/Privacy Italy: Bassanini Act - e-records Germany: Info & Comm. Services Act - d -signatures more. . .

Part 11 Controls/Concepts l l Do. D; 5015. 2 std - e-rec. mgmt State Digital Signature Laws u l l UT, FL, GA, MI, CA, VA, WA, IL, et al ABA Digital Signature Guideline Canada - Univ. of BC, e-rec. archiving u http: //www. slais. ubc. ca/users/duranti/

Part 11 Internet Sites l Part 11 Notices/reports u l http: //www. fda. gov/cder/esig/part 11. htm E-Submissions docket u http: /www. fda. gov/ohrms/dockets

We have covered l Scope u l l Typewriter excuse Open vs. Closed systems Audit trails/time stamps Certification Enforcement u Legacy systems

7520 Standish Place Rockville, MD 20855 Paul J. Motise Consumer Safety Officer Division of Manufacturing and Product Quality, HFD-320 Center for Drug Evaluation and Research Phone: 301 594 -0098 Fax: 301 594 -2202 E-mail: Motise@cder. fda. gov