After issuing its controversial Guidance for Industry — Part 11, Electronic Records; Electronic Signatures — Scope and Application1 20 years ago, the FDA struggled with consistent enforcement of the guidance. At the time, industry countered with feedback that the new guidance presented an overhead model that was untenable from a business perspective. We have gained little insight into the FDA’s thinking since their 2003 commitment to revisit the guidance. What can we expect now that the agency has issued an update that tackles 28 questions, intended as a framework for inspection and regulation? How does this address the many innovations adopted by our industry? What are the implications for the agency and sponsors?

Procedures and a risk-based approach

The overarching goal is to encourage and facilitate the use of electronic records and systems to improve the quality and efficiency of clinical investigations, and that is the spirit of the guidance.

The scope of the update is to provide guidance to sponsors, clinical investigators, institutional review boards 18 (IRBs), contract research organizations (CROs), and other interested parties on the use of electronic records and electronic signatures in clinical investigations of medical products under 21 CFR Part 11, Electronic Records; Electronic Signatures.

This update clarifies the procedures that may be followed to help ensure that electronic records and electronic signatures meet FDA requirements, and that the records and signatures are considered trustworthy, reliable, and generally equivalent to paper records and handwritten signatures executed on paper.

Another new emphasis is the expanded use of a risk-based approach when deciding to validate electronic systems, implement audit trails for electronic records, and archive records that are pertinent to clinical investigations conducted under parts 312 and 812, and described in the 2003 Part 11 guidance.

New questions and answers Specifically, the draft guidance covers 28 Questions & Answers2 spanning several important topics:

• Electronic Systems Owned or Managed by Sponsors and Other Regulated Entities. These include electronic case report forms (eCRFs); electronic data capture (EDC) systems, electronic trial master files (eTMFs), electronic Clinical Data Management Systems (eCDMS), electronic Clinical Trial Management System (eCTMS), Interactive Voice Response System (IVRS), Interactive Web Response System (IWRS), centralized, Web-based electronic patient-reported outcomes (ePRO) portals, and electronic institutional review board (IRB) human subject application systems (eIRBs).
• Outsourced Electronic Services. 
These are data management services, including cloud-computing services. When electronic services are used to process data for FDA-regulated clinical investigations, sponsors, and other regulated entities should consider whether there are adequate controls in place to ensure the reliability and confidentiality of the data.

• Electronic Systems Primarily Used in the Provision of Medical Care. 
For the purposes of this guidance, this refers generally to systems that are (1): designed for medical care of patients not enrolled in a clinical investigation, and (2): owned and managed by the institutions providing medical care (e.g., electronic health records (EHRs)). These electronic systems may produce additional electronic records during the course of patients’ care (e.g., hospital admission records, electronic health records, pharmacy records, laboratory records, imaging records, electronic consultation records) that may be useful for providing data in clinical investigations.

• Mobile Technology. For the purposes of this guidance, mobile technology refers to portable electronic technology used in clinical investigations that allows for off-site and remote data capture directly from study participants. This includes mobile platforms, mobile applications (mobile apps), wearable biosensors, and other remote and ingestible sensors, and other portable and implantable electronic devices.

• Telecommunications Systems. Clinical investigators and study personnel may use many different types of telecommunication systems, such as telephones, email, live chat, and telemedicine or video conferencing systems to communicate with study participants during the conduct of clinical investigations.

Electronic health records exclusion  The new guidance makes a point of excluding the systems managing electronic health records (EHRs) from Part 11 expectations, presumably because these requirements are captured in a separate guidance.3Feedback from industry seems to indicate that further clarifi cation is required. Comments from industry were closed in August 2017 and the final guidance will need to provide a clear description of whether or not EHRs fall under Part 11.

Mobile technology and EDC  Few developments have matched the impact that mobile data capture has had on clinical trial management. However, at clinical research sites, where personal devices are being used for data collection, there are additional complications relating to patient reported outcome data. Managing data input and documenting that device access has been restricted to a particular patient is impractical. Obtaining a signed affirmation from the patient that access to the device has been restricted to the patient is a moot point to some extent. Consistent with current practice, whether an attestation is obtained or not, it is expected that the data will be considered valid and accepted for analyses.

Electronic or digital signatures  Electronic signatures are central to moving a documentation and quality management system (QMS) to a paperless process. The guidance document reveals how FDA inspectors can be expected to approach an organization to assure compliance is addressed. Th e use and validation of electronic signatures in documents intended for the FDA has long been a point of discussion by experts. Organizations that adopt industry-recognized standard solutions such as DocuSign or SAFE-Biopharma could realize the efficiency of e-signatures without incurring additional regulatory overhead.  

Cybersecurity A common theme throughout the guidance document is the emphasis on cybersecurity, extending the definition to subsume privacy considerations. Any e-signature or e-record solution that doesn’t have this issue at the forefront is likely to run into both compliance and business challenges downstream.

Conclusion This welcome update to the 2003 guidance addresses many of the challenges faced in today’s development and commercial environments. Our hope is that the agency and its inspectors will look to this set of questions and answers as a baseline for inspection, which in turn drives industry to a common understanding of the prerequisites to compliance.

References
1. Guidance for Industry Part 11, Electronic Records; Electronic Signatures — Scope and Application, August 2003
2. Use of Electronic Records and Electronic Signatures in Clinical Investigations Under 21 CFR Part 11 – Questions and Answers: https://www.fda.gov/downloads/drugs/guidancecomplianceregulatoryinformation/guidances/ucm563785.pdf
3. Use of Electronic Health Records Data in Clinical Investigations: https://www.fda.gov/downloads/Drugs/GuidanceComplianceRegulatoryInformation/Guidances/UCM501068.pdf
Bikash Chatterjee is President and Chief Science Officer of Pharmatech Associates, a Hayward, Calif.-based company that provides consulting and services to the regulated life science industry. Bikash has been involved in the biopharmaceutical, pharmaceutical, medical device, and diagnostics industry for over 30 years. His expertise includes site selection, project management, design, and validation of facilities for U.S. and European regulatory requirements.