21 CFR Part 11

Hey everyone, I just finished an integration which was a 21 CFR part 11 compliant project. Just curious if anyone on here has traveled this road also? For those who don't know what this is, it's an FDA compliance when you are replacing handwritten signatures on legal process data with electronic signatures.

We integrated a paperless chart recorder, which replaced a paper strip chart recorder. The recorder met the 21 CFR part 11 compliance, but it was up to us to make the entire system compliant. We're in the aseptic food processing industry and we answer to the FDA and USDA. This is where this compliance applies. Anyone else been down this road yet?

Greg

Greg,

I love to hear more on this topic as well. The impression I have is that the food industry is not really paying attention to CFR Part 11, thinking that the FDA won't come knocking on their doors. There was a lot of talk in the trade press about it, at a level on par with the Y2K scene with a lot opionions about what it means but no body seems to know for sure.

Supposedly FDA did (will?) put out some clarification on what a system needs to be in order to be "compliant"... My understanding is that FDA can not say if you are "compliant" but can find you out of compliance... clear? ... I thought so...

Ahhhhhhhhh the Feds

Harryting -- you said
Supposedly FDA did (will?) put out some clarification on what a system needs to be in order to be "compliant"... My understanding is that FDA can not say if you are "compliant" but can find you out of compliance... clear? ... I thought so...

Sort of reminds me of OSHA. They (compliance officers) could not would not tell you how to get something in copliance but they sure could find you out of compliance. Was an Oregon state safety compliance officer for two years -- thankfully many years ago.

Dan Bentler

21 CFR part 11

Greg hi,
I work in a pharma company. Still have nightmares about part 11. When the FDA first came out wth 21CFR part11, they put the industry in a flat panic.The guidlines where very narrow and would have been very expensive to implemet.At a time when the US administration is looking to lower health care costs ,this was problematic.
They froze the implementation date and reviewded the guidlines.
Today the new guidlines are easier to live with ,but still cosly to implement.
Have just installed a system with 5 paperless recorders (Eurotherm-Chessell) that are part 11 compliant.

leitmotif -You are correct .The FDA issues guidlines which are the basis for defining what "you"(the company) want to implement.The company then has to perform a Validation to prove that they comply with the Validation protocol.

We are in the process of upgrading and changing a lot of HMI and SCADA systems in order to comply.


Steve

Interesting, and glad to hear from everyone......We're looking at integrating the Yokogawa DX/P recorders. I have 4 of them integrated so far, one in a critical process application. We have not gone through our first FDA audit as of yet, I'm excited for it actually. We've done everything, to what we think is the best of our ability to be in compliance. If you really pick apart the draft guidance document to 21 CFR part 11, there really isn't a lot to it. The scope is much wider than the origional document.

Steve, how do you like your paperless recorders? How are you handling the data? Our recorder automatically sends a data file to an FTP server we have set up, and then our internal auditor can review that data in the software package that was validated with the recorder. What kind of validations did you go through?

Take care,

Greg

I worked with part11 about 2-3 years ago when It was quite new and everyone was interpreting it their own way. Nightmare was an understatement back then working for different pharma companies with different interpretations.

Getting a bunch of SCADA/HMI compliant is a lot of work. Back then iFix was the best choice and Intellution put a lot of effort into it.

Part 11 - part II

Yes, everyone has their own interpretations.

Part of that is a fallout of the Y2K thing. Companies spent oodles of money on "compliance" that they realised that they didn't need. So each phara is determined to control their own "compliance standard".

This leads to all sorts of interesting questions, like:
"Is the program that resides in the PLC an "electronic record", under Part 11?

If the answer is "Yes", then you need to have an audit trail tracking changes to the program (and the data?) - who made the changes, when, why. Under that standard, almost no PLC is Part 11 complient.

So back in 2000-2001 or so, there was a lot of panic in the industry, because the usual interpretation was that everything with an electronic record of ANYTHING, needed to comply with Part 11.

But in 2003, the FDA issued a guidance (LINK) stating, in essence, that if you continuing to submit paper records, then you don't have to go wild about Part 11.

My (meager) understanding is that only records submitted to the FDA need to be Part 11 compliant.

So, just because you have a paperless chart recorder or a SCADA program which does historical trending on a bunch of points, as long as those trends are NOT part of the official batch record ensuring the quality of the product, then you don't need to worry about part 11.

If they are, then they had better be "tamper resistant" (I beleive the guidance also admitted that a determined and skilled hacker could fake anything, just a skilled forger could with the existing paper records. The trick is to keep out the "talented amatuer" hacker, who might be able to find the data, but would leave tracks if the data was altered.)

When that Guidance was issued, a small cottage industry of Part 11 consultants collapsed. Not by coincidence, I found myself in the ranks of the unemployed.

Sounds good that it has settled.

I have not been working at all with part11 for 2 years. I fully agree with you that this was a way to create work for consultants that had been working with the Y2K issues. Where I was working we had been working very intensive with Y2K issues during 98-99 and then when it was all over we needed something else to do. Now I work with some more down to earth automation and it feels much better than having to stay awake over part11 questions that no one had any answers to.

I only have a couple of seconds to write this note, but Allen, you are 100% correct with your last 4 paragraphs. Only data intended to be used as legal record, AND is replacing traditional hanwritten signatures is what needs to comply with part 11. I'll write more later when I have time.

Greg