04-7942. Electronic Record; Electronic Signatures; Public Meeting

AGENCY:

Food and Drug Administration, HHS.

ACTION:

Notice of public meeting; request for comments.

SUMMARY:

The Food and Drug Administration (FDA) is announcing a public meeting to discuss various topics concerning our regulations on electronic records and electronic signatures in part 11 (21 CFR part 11). FDA has begun to re-examine part 11 as it applies to all FDA-regulated products. We will consider the input from the public meeting and comments on the topics presented in this document as we evaluate potential changes to part 11.

DATES:

The public meeting will be held on June 11, 2004, from 8 a.m. to 4:30 p.m. Submit written or electronic requests to speak plus a presentation abstract by May 12, 2004. Although written or electronic comments on the issues presented in this document will be accepted until July 9, 2004, to have your comments considered at the meeting, submit them by May 12, 2004.

ADDRESSES:

The public meeting will be held at the National Transportation Safety Board Boardroom and Conference Center, 429 L'Enfant Plaza, SW., Washington, DC 20594, 202-314-6421. The center may be reached by Metro, using the L'Enfant Plaza Station on the green, yellow, blue, and orange lines; for further information see http://www.ntsb.gov/​events/​newlocation.htm. (FDA has verified the Web site address, but FDA is not responsible for any subsequent changes to the Web site after this document publishes in the Federal Register.)

You may submit comments, identified by Docket No. 2004N-0133, by any of the following methods:

• Federal eRulemaking Portal: http://www.regulations.gov. Follow the instructions for submitting comments.
• Agency Web site: http://www.fda.gov/​dockets/​ecomments. Follow the instructions for submitting comments on the agency Web site.
• E-mail: [e-mail]. Include Docket No. 2004N-0133 in the subject line of your e-mail message.
• FAX: [phone].
• Mail/Hand delivery/Courier [For paper, disk, or CD-ROM submissions]: Division of Dockets Management (HFA-305), Food and Drug Administration, 5630 Fishers Lane, rm. 1061, Rockville, MD 20852.

Instructions: All submissions received must include the agency name and Docket No. for this rulemaking. All comments received will be posted without change to http://www.fda.gov/​dockets/​ecomments, including any personal information provided. For detailed instructions on submitting comments and additional information on the rulemaking process, see the “Request for Comments” heading in the SUPPLEMENTARY INFORMATION section of this document.

Docket: For access to the docket to read background documents or comments received, go to http://www.fda.gov/​dockets/​ecomments and/or the Division of Dockets Management, 5630 Fishers Lane,rm. 1061, Rockville, MD 20852.

Transcripts of the public meeting will be available for review at the Division of Dockets Management (see ADDRESSES) and on the Internet at http://www.fda.gov/​ohrms/​dockets.

FOR FURTHER INFORMATION CONTACT:

For General Information: Joseph C. Famulare, Center for Drug Evaluation and Research (HFD-320), Food and Drug Administration, 11919 Rockville Pike, Rockville, MD 20852, 301-827-8940, [e-mail]; or

David Doleski, Center for Biologics Evaluation and Research (HFM-676), Food and Drug Administration, 1401 Rockville Pike, Rockville, MD 20852-1448, 301-827-3031, [e-mail]; or

John Murray, Center for Devices and Radiological Health (HFZ-340), Food and Drug Administration, 9200 Corporate Blvd., Rockville, MD 20850, 301-594-4659, [e-mail]; or

Vernon D. Toelle, Center for Veterinary Medicine (HFV-234), Food and Drug Administration, 7500 Standish Pl., Rockville, MD 20855, 301-827-0312, [e-mail]; or

JoAnn Ziyad, Center for Food Safety and Applied Nutrition (HFS-206), Food and Drug Administration, 5100 Paint Branch Pkwy., College Park, MD 20740-3835, 202-418-3116, [e-mail]; or

Scott MacIntire, Office of Regulatory Affairs (HFC-240), Food and Drug Administration, 5600 Fishers Lane, Rockville, MD 20857-1706, 301-827-0386, [e-mail].

For Registration Information: Anne M. Henig, Center for Drug Evaluation and Research (HFD-6), Food and Drug Administration, 5600 Fishers Lane, Rockville, MD 20857, 301-443-5576, [e-mail].

SUPPLEMENTARY INFORMATION:

I. Background

Part 11 provides the criteria under which FDA considers electronic records, electronic signatures, and handwritten signatures executed to electronic records as equivalent to paper records, and handwritten signatures executed on paper (62 FR 13430, March 20, 1997). These regulations, which apply to all FDA program areas, were intended to permit the widest possible use of electronic technology, consistent with FDA's responsibility to protect the public health.

After part 11 became effective in August 1997, significant discussions ensued among industry, contractors, and the agency concerning the scope, interpretation, and implementation of the regulations. Concerns were raised that some interpretations of the part 11 requirements would do the following: (1) Unnecessarily restrict the use of electronic technology in a manner inconsistent with FDA's stated intent in issuing the rule, (2) significantly increase the costs of compliance to an extent that was not contemplated at the time the rule was drafted, and (3) discourage innovation and technological advances without providing a significant public health benefit. In particular, concerns were raised regarding part 11 requirements for validation, audit trails, record retention, record copying, and legacy systems.

As an outgrowth of our current good manufacturing practice (CGMP) initiative for human and animal drugs and biologics, we have begun to re-examine part 11 as it applies to all FDA regulated products. We recently articulated our current thinking on part 11 in the guidance for industry entitled “Part 11, Electronic Records; Electronic Signatures—Scope and Application” (part 11 guidance) issued on September 5, 2003 (68 FR 52779). We explained in the part 11 guidance that we anticipate rulemaking to change part 11 as a result of our re-examination and that while we are re-examining part 11, we will narrowly interpret the scope of the regulation. By narrowly interpreting the scope of part 11, we mean that fewer records will be considered to be subject to part 11. For those records that remain subject to part 11, we intend to exercise enforcement discretion with regard to part 11 requirements for validation, audit trails, record retention and record copying in the manner described in the part 11 guidance and with regard to all part 11 requirements for systems that were operational before the effective date of part 11 under the circumstances described in the part 11 guidance. As noted in the part 11 guidance, we will enforce all predicate rule requirements^[1] .

II. Purpose of Public Meeting

The purpose of the public meeting is to obtain input from the regulated industry and other stakeholders on the topics outlined in this document. Stakeholders include, but are not limited to, manufacturers of products regulated by FDA, suppliers of software products, consultants to regulated industries, and consumer groups.

III. FDA's Objectives in Re-Examining Part 11

FDA's re-examination of part 11 includes the following objectives:

• To prevent unnecessary controls and costs, yet retain the objectives of the rule.
• To clarify the scope of part 11 (e.g., how it relates to other FDA regulations).
• To ensure that part 11 provides an adequate level of record security, authenticity, and integrity, and encourages innovation and technological advances.
• To further these objectives, we are seeking to accomplish the following:
• Identify areas where part 11 could be less prescriptive and detailed, and
• Clarify the relationship between part 11 and other FDA regulations (predicate rules) with respect to record and recordkeeping requirements.

IV. Topics for Discussion and Comment

FDA would like public input to assist with our re-examination of part 11. We invite discussion on the scope of part 11, risk-based approaches, validation, audit trails, record retention, record copying, and legacy systems. We present the following specific issues and questions for comment in the public meeting.

A. Part 11 Subpart A—General Provisions

Within the context of subpart A of part 11, we would like interested parties to address the following:

1. In the part 11 guidance document, we clarified that only certain records would fall within the scope of part 11. For example, we stated that under the narrow interpretation of its scope, part 11 would apply where records are required to be maintained under predicate rules or submitted to FDA, and when persons choose to used records in electronic format in place of paper format. On the other hand, when persons use computers to generate paper printouts of electronic records, those paper records meet all the requirements of the applicable predicate rules, and persons rely on the paper records to perform their regulated activities, FDA would generally not consider persons to be “using electronic records in lieu of paper records” under § 11.2(a) and (b). In these instances, the use of computer systems in the generation of paper records would not trigger part 11. We are interested in comments on FDA's interpretation of the narrow scope of part 11 as discussed in the part 11 guidance and whether part 11 should be revised to implement the narrow interpretation described in the guidance.

2. We are interested in comments on whether revisions to definitions in part 11 would help clarify a narrow approach and suggestions for any such revisions.

3. In the part 11 guidance we announced that we did not intend to take enforcement action to enforce compliance with the validation, audit trail, record retention, and record copying requirements of part 11 in the manner described in the part 11 guidance. We emphasized that records must still be maintained or submitted in accordance with the underlying predicate rules, and the agency could take regulatory action for noncompliance with such predicate rules. We are interested in comments on the need for clarification in part 11 regarding which records are required by predicate rules and are therefore required to be part 11 compliant?

B. Part 11 Subpart B—Electronic Records

Within the context of subpart B, the agency wants to solicit ideas on how to ensure that controls to safeguard records are appropriate and reasonable. There may be instances where persons believe that there are acceptable alternative approaches for implementing controls, with appropriate justification. We want to solicit ideas about how decisions for using alternative controls should be made, such as using a risk assessment. We would like interested parties to address the following:

1. As mentioned previously, the part 11 guidance identified four areas where we do not intend to take enforcement action under the circumstances described in the part 11 guidance, including the validation, audit trail, record retention, and record copying requirements of part 11. The part 11 guidance further recommends that decisions on whether or not to implement part 11 requirements on validation, audit trail, record retention, and record copying should be based on a justified and documented risk assessment and a determination of the potential of the system to affect product quality and safety, and record integrity. We are interested in comments on whether there are other areas of part 11 that should incorporate the concept of a risk-based approach, detailed in the part 11 guidance (e.g., those that require operational system and device checks).

2. Is additional clarity needed regarding how predicate rule requirements related to subpart B can be fulfilled?

3. Under the current part 11, the controls that apply to electronic records that are maintained also apply to electronic records that are submitted to FDA. Should the requirements for electronic records submitted to FDA be separate from electronic records maintained to satisfy predicate rule requirements?

4. The controls for electronic records in subpart B distinguish between open systems (an environment where system access is not controlled by persons who are responsible for the content of electronic records that are on the system) and closed systems (an environment where system access is controlled by persons who are responsible for the content of electronic records that are on the system). Should part 11 continue to differentiate between open systems and closed systems?

For individual controls in subpart B, we request comments on the following:

1. The part 11 guidance identified validation as one of the four areas where we intend to exercise enforcement discretion in the manner described in the guidance. Should we retain the validation provision under § 11.10(b) required to ensure that a system meets predicate rule requirements for validation?

2. The part 11 guidance identified record retention and record copying requirements as areas where we plan to exercise enforcement discretion in the manner described in the part 11 guidance. Are there any related predicate rule requirements that you believe are necessary to preserve the content and meaning of records with respect to record copying and record retention? What requirements would preserve record security and integrity and ensure that records are suitable for inspection, review, and copying by the agency?

3. Should audit trail requirements include safeguards designed and implemented to deter, prevent, and document unauthorized record creation, modification, and deletion?

4. Section 11.10(k) requires appropriate controls over systems documentation. In light of how technology has developed since part 11 became effective, should part 11 be modified to incorporate concepts, such as configuration and document management, for all of a system's software and hardware?

C. Part 11 Subpart C—Electronic Signatures

Within the context of subpart C, we would like interested parties to address the following: Section 11.10(d) requires that system access be limited to authorized individuals, but it does not address the handling of security breaches where an unauthorized individual accesses the system. Should part 11 address investigations and followup when these security breaches occur?

D. Additional Questions for Comment

In addition, we invite comment on the following questions:

1. What are the economic ramifications of modifying part 11 based on the issues raised in this document?

2. Is there a need to clarify in part 11 which records are required by predicate rules where those records are not specifically identified in predicate rules? If so, how could this distinction be made?

3. In what ways can part 11 discourage innovation?

4. What potential changes to part 11 would encourage innovation and technical advances consistent with the agency's need to safeguard public health?

5. What risk-based approaches would help to ensure that electronic records have the appropriate levels of integrity and authenticity elements and that electronic signatures are legally binding and authentic?

6. The part 11 guidance announced that the agency would exercise enforcement discretion (during our re-examination of part 11) with respect to all part 11 requirements for systems that otherwise were operational prior to August 20, 1997 (legacy systems), the effective date of part 11. What are stakeholder concerns in regards to modifications made to legacy systems in use as of August 1997?

Can the use of risk mitigation and appropriate controls eliminate concerns regarding legacy systems?

7. Should part 11 address record conversion?

8. Are there provisions of part 11 that should be augmented, modified, or deleted as a result of new technologies that have become available since part 11 was issued?

V. Registration and Requests for Oral Presentations

Preregistration is not necessary if you are not speaking and plan only to attend. However, seating is limited and will be available on a first-come first-served basis.

To speak at the public meeting, you must preregister by May 12, 2004. Requests must be submitted electronically or in writing (see ADDRESSES). In your request to speak, you should provide the following information: (1) Specific issue that you intend to address; (2) names and addresses of all individuals that plan to participate; and (3) presentation abstract. Presentations should be limited to the topics addressed in this document. We will accept requests to speak based on the number of requests we receive, time constraints, and subjects covered. We will notify speakers of the scheduled time for their presentation before the meeting. Depending on the number of speakers, we may need to limit the time allotted for each presentation; at this point speakers should plan to limit their oral presentations to no more than 15 minutes. Speakers must submit two copies of each presentation by June 11, 2004. If you need special accommodations due to a disability, please inform the registration contact person at least 7 days in advance of the meeting.

VI. Request for Comments

Regardless of attendance at the public meeting, interested persons may submit written or electronic comments on the topics presented in this document by July 9, 2004, to the Division of Dockets Management (see ADDRESSES). You should annotate and organize your comments to identify the specific sections of part 11 and/or topics to which they refer. Two copies of any mailed comments are to be submitted, except that individuals may submit one copy. Comments are to be identified with the docket number found in brackets in the heading of this document. The received comments may be seen at the Division of Dockets Management between 9 a.m. and 4 p.m., Monday through Friday. Transcripts of the public meeting also will be available for review at the Division of Dockets Management.

Dated: April 2, 2004.

Jeffrey Shuren,

Assistant Commissioner for Policy.

Footnotes

1.  As noted in the part 11 guidance, the underlying requirements set forth in the Federal Food, Drug, and Cosmetic Act, the Public Health Service Act, and FDA regulations (other than part 11) are referred to as “predicate rules.”