Y2K on steroids

Steve Tinson and Brian Hatton from Bovis Lend Lease Pharmaceutical and Geoff Tovey, GTA Associates, discuss the merits of the FDA's 21CFR Part 11 rule

The pharmaceutical industry has always relied heavily on paper-based records, many of which are required by law to be signed by properly qualified personnel. In fact, regulations with which the industry must comply in order to market drugs in particular countries demand hand-written signatures on paper records.

In 1991, the industry suggested to the FDA that it would like to use electronic signatures instead, and would the FDA care to regulate this. The FDA saw the opportunity to extend this scope to include all electronic records, and how electronic systems ('paperless manufacturing') could be used within the existing current Good Manufacturing Practice (cGMP) regulations.

rule applicability

An FDA task force was formed which, in consultation with industry, developed a new set of regulations - 21CFR Part 11 - that came into force on 20 August 1997. Nearly five years later, many healthcare companies are still coming to terms with the effect this rule has on the use of computer systems within the FDA-regulated (pharmaceutical, biological and medical device) industries.

So why has industry taken so long to come to terms with the rule? First, there has been some confusion as to the applicability of Part 11 and the full scope is only just being realised by many companies. In addition, considerable effort was directed at Year 2000 compliance during the late nineties. Now this problem has been overcome, resources are becoming available to tackle Part 11 issues. 'One of the problems within the industry is that Part 11 requires a major re-education of all the users,' commented Brian Hatton, compliance manager at Bovis Lend Lease. 'Currently, it is probably seen as a constraint, but there must come a time when it will be a big step forward, and industry will see it differently.'

GTA Consultant Geoff Tovey suggested that complying fully with the rules would have benefits, such as better data handling and a workplace that is paperless leading to better work flows. 'In principle, things should be done better via a computer screen than using the written form. Better communication should mean that everyone knows instantly.'

Computer systems have been an integral part of pharmaceutical manufacturing for many years, but while many systems produce data in electronic form, the primary output of the system is a printed, paper record, signed by hand if required.

A common misconception is that Part 11 applies only to the use of electronic signatures in cGMP critical applications i.e. where the hand-written, pen-on-paper signature is replaced by an electronic equivalent, such as the entry of a unique ID/password combination.

While Part 11 does cover use of electronic signatures it also applies to electronic records, i.e. the original data file from which the printed copy is traditionally made. Part 11 thus affects every cGMP critical computer system currently producing electronic records (e.g. data files) regardless of age or validated status!

Currently, 21CFR Part 11 also applies only to companies whose products are for sale within the US. But regulatory bodies in other countries are watching closely and are likely to adopt the standard.

retaining data

Part 11 applies to all GXP (i.e. GMP, GLP and GCP) regulated areas and all industries under FDA jurisdiction. So whether it is a pharmaceutical, biological or medical device manufacturer, Part 11 applies.

'From a strictly regulatory point of view, the decision the company has to make is: "Do I need to retain this data for FDA purposes?" If the answer is yes, then Part 11 applies, if the answer is no, it doesn't,' explained Steve Tinson, a consultant with Bovis Lend Lease, who trains people in understanding the regulation.

not yet mandatory

The major problem is likely to come when a company introduces the rule because with existing systems, there are going to be very large costs involved. Estimates suggest US$100m (€106m) for a medium to large pharma company. Companies will either have to upgrade the system to ensure they comply with Part 11, or they will decide that the system has to be scrapped and replaced. Hatton commented: 'For new equipment, if a company puts the Part 11 programme in early enough, by saying to its supplier "This must comply with 21CFR Part 11", then some of the cost is spread around the industry - through the supplier. However, it has to do that very early, because once that part or system, eg a LIMS system, has been supplied, there is no legal basis to turn round and say that doesn't meet Part 11.' Part 11 is not mandatory.

Tinson commented: 'When buying a new system, the company needs to build in Part 11 specifications. Obviously, do to this it needs to talk to the vendor. That said, most companies who have dealings with the pharmaceutical industry are claiming that Part 11 applies to its equipment or they will have a version out.'

There are still problems, though, because 21CFR Part 11 is not prescriptive. 'Thus, a vendor's understanding of how Part 11 applies can differ substantially from that of the buyer. So the first thing a company going out to buy these systems needs to have is an interpretation of the rule as it applies to them.

'The company needs to be sure that what the vendor is telling them meets its understanding, so it does need to look at the Rule in detail.

'Another thing to note is that the FDA does not endorse products. So if a vendor has "FDA approved software for 21CFR Part 11" on its product, it probably means that it has sold the equipment to a client that has passed an FDA inspection. The FDA will not approve one particular software package over another.'

Usually, with such bespoke packages the buyer will carry out a vendor audit, which needs the right people to ask the right questions on the subject. 'Some companies will have the wherewithal to do that, but others may prefer to outsource the audit, which is where independent experts such as Bovis Lend Lease come in,' Tovey commented. 'They can assess different solutions and rate them against the user's specific criteria.'

guideline documents

This leads to the question 'What does Part 11 actually demand?' The Part 11 Final Rule is a 38-page document, only the last three pages of which contain the rule itself. Most of the preceding 35 pages summarise the results of the correspondence between FDA and interested companies during the development of the rule. The FDA stresses that the rule should be read as a whole and, possibly as a result of this, there has been considerable discussion within the industry as to exactly what the rule demands. In response to industry requests, the FDA has begun to issue a series of guidance documents on specific aspects of the rule (see Table 1), while Table 2 gives an overall impression of the scope of the Rule.

In addition, Part 11 defines systems as either 'closed' or 'open'. Briefly, a closed system is one where access is controlled by those responsible for the content of the e-records contained on the system. The majority of affected electronic systems will be closed.

An example of an open system is where transport or access is via the internet and Part 11 demands additional controls to those for closed systems, such as data encryption, for example.

The impact of Part 11 on manufacturers is potentially huge - some have compared it to Year 2000 compliance.

Indeed, many firms are using the system inventories prepared for Y2K as a starting point for system assessment for Part 11 compliance.

In May 1999 the FDA issued a Compliance Policy Guide (CPG 7153.17), which described current FDA thinking on Part 11. In it, the FDA recognised that companies will take some time to introduce the technological changes required by Part 11 into many existing ('legacy') systems .

But it is also stated that the procedural controls required should already be in place! Companies should also have a plan in place with a 'reasonable timetable' for ensuring system compliance.

The message seems to be that while the FDA does not expect 100% compliance it does expect companies to have a plan to achieve compliance and be working to that plan.

At the end of the day, Part 11 compliance 'is going to cost companies more than it cost them to get Y2K compliance.'

At the moment the rule relates only to pharma healthcare companies in the US, or to companies selling into that market. But, given the global nature of trade and the necessity for vendors to have equipment that complies, how long will it be before the tentacles of 21CFR Part 11 spread through all industries that use computer systems.

As Hatton quipped: 'It's Y2K plus, because as Y2K finished there, this is ongoing. Companies will have to ensure that all new equipment complies, and if a new supplier comes into the market, that equipment will have to meet the criteria.' Y2K on steroids indeed.