21 CFR Part 11 Compliance

Introduction

21 CFR Part 11 became law on August 20, 1997. The objective of these FDA regulations is to enhance the security of electronic signatures and records. For more information on the regulations, visit some of the links to the right. Although it's been several years since the regulations were put into law, currently the pharmaceutical industry is struggling to comply. Compliant data systems and other equipment used in the manufacture and testing of pharmaceutical raw materials and finished products are only now becoming available.

This article describes the current status of compliance for electronic records at WCAS as well as future plans for implementation. Currently WCAS does not use electronic signatures.

Last Updated: 11/10/2008

21 CFR Part 11 Final Rule

FDA Guidance Aug 2003

21CFRPart11.com

Data System Compliance

Data systems should generate audit trails for raw data and metadata as well as logs for file creation, modification, and deletion. The status of our data systems is as follows:

A. Compliant software is now available for ICPMS systems. We plan to evaluate the software in 2006.

B. UV-Vis, FTIR, GFAA, and ICP-OES are not compliant and we have no immediate plans. These are used in limited capacity. It is unlikely that upgrades will be available for this hardware; these systems will probably require replacements to comply with Part 11.

C. Most or our chromatography data systems use Dionex PeakNet 5.1 and 5.2 which is non-compliant. We currently have 3 HPLC systems with Dionex Chromeleon and two Agilent HPLCs which are compliant.

D. Our GCMS systems and 2 of our GC data systems use Agilent ChemStation. Upgrades for the 3 GCMS systems (Agilent 5973s) need to be evaluated. Two GCs used for OVI analyses and gas analysis have been upgraded to ChemStation Plus and are compliant.

Part of the problem in upgrading is not just simply upgrading the software, but hardware also. The newer systems have changed from GPIB communications (Level 3 communications) to TCP/IP over a network (Level 4). This requires a significant hardware as well as a software change. In some cases vendors will not offer upgrades in the instrument that will be required for Level 4 communications, the only systems now compatible with Part 11 compliant data system software.

Given the costs for upgrades where they may exist, it is unlikely that we will be able to comply with Part 11 until we replace older systems with newer, compliant systems. Given the life time of systems, this may take ~5-10 years. Of course new systems may be ordered with Part 11 compliance in mind.

LIMS Compliance

Our LIMS system (which is called Job Tracking or WinJT) is not a traditional or commercially available LIMS . It is untraditional in the sense that results are not entered into a data base nor does it perform any calculations on data. Instead it is a file handling system. Results are place in ASCII text files, and the LIMS system creates and manages the files. Lotus 123 is used to transform raw data to preliminary reports. Lotus WordPro (LWP) is used to create the draft and final reports.

A. An audit trail for reports is generated using script in WinJT and LWP. A new version is created within the file each time the file is opened. Each version is time stamped and it’s creator identified. Versions cannot be overwritten.

Versions can be deleted but they are numbered so that the deletion of versions is easily detected.

Implemented for Final Reports, Validated 4-2002

Implemented for Draft Reports, Validated 7-2002

B. Security levels within WinJT are password protected. Analysts are permitted access to draft reports within their groups. Client Services has read-only access to these drafts. Conversely, Client Services creates and modifies the final reports, and analysts may have read-only access to the final reports.

Implemented, Validated 4-2002

Network Security

Network access is limited by passwords. The network is protected from internet hacking through the use of a hardware router/firewall.

User accounts and passwords are currently set up by the System Administrator. In 2003, Netware Enhanced Passwords was installed for most desktops running Windows XP. Password policies were changed to increase security. This feature incorporates numeric and special characters so that passwords will not be common words found in a dictionary. Users are required to

change their assigned password on their 1st log-on and after every 6 months. A 5X password history file is used to limit re-use of old passwords. The number of log-on attempts is limited to 3. Workstations automatically logoff after a period of inactivity.

Personnel were trained at the Jan 2003 QA meeting about the new password policies and sharing.

The new password policies have not been installed on most instrument data systems which use a generic logon or run under operating systems other than Win XP.

Data Back-up and Archive

Currently, back-ups of raw data are made daily from work stations to a server. Back-up data is kept on the server for the last 6 months. Raw data is retained on workstations for at least a month or more, until the data has been archived. The back-up procedure creates an audit trail.

Currently, the data is archived monthly onto 2 copies of CD-ROMs. One is stored on-site, the other is stored off-site. Paper records (chromatograms, etc.) are stored for 5 years in a locked, concrete bunker. Copies are supplied to clients to satisfy their own data retention requirements.

Retrieval of archived data and regeneration of original data has been validated for the following systems:

Software Validation

Vendor software is not validated by WCAS, although it must satisfy it’s intended use and generate accurate data for known reference samples. Where possible, WCAS obtains vendor certificates that the software has been validated.

Software developed by WCAS is validated by documenting that the software produces the same results as an independent hand or spreadsheet calculation.

Currently all new spreadsheets are created with equations in locked cells and password protected. Version #’s are in each spreadsheet. All print-outs from the spreadsheet also contain this version number. Spreadsheets are validated against hand or independent spreadsheet calculations.

	9240 Santa Fe Springs Rd Santa Fe Springs, CA 90670
info-wcas@bodycote.com	562.948.2225 Fax 562.948.5850