Title 21 CFR Part 11: What is it and why is it important?

January 13, 2012 by
Filed under: Business, Healthcare, Regulatory 


What is it?

The FDA is a government regulatory authority and CFR is short for “Code of Federal Regulations” which is basically another work for Federal Law.  Each Cabinet in government and governmental body has a Title in the CFR that dictates the laws that apply to a particular governmental body so the first part of this CFR 21 is basically CFR Title 21, which is the body of laws under which the FDA is regulated.  the second part (“Part 11”) is a sub-section under the law that is applied to specific circumstances.  Part 11 in this case applies to Clinical Trials and electronic record keeping for clinical trials.

Sec. 11.1 Scope.

(a) The regulations in this part set forth the criteria under which the agency considers electronic records, electronic signatures, and handwritten signatures executed to electronic records to be trustworthy, reliable, and generally equivalent to paper records and handwritten signatures executed on paper.

(b) This part applies to records in electronic form that are created, modified, maintained, archived, retrieved, or transmitted, under any records requirements set forth in agency regulations. This part also applies to electronic records submitted to the agency under requirements of the Federal Food, Drug, and Cosmetic Act and the Public Health Service Act, even if such records are not specifically identified in agency regulations. However, this part does not apply to paper records that are, or have been, transmitted by electronic means.

An interesting thing about CFR 21 Part 11 or more specifically and generally referred to as Part 11 compliance is that there are 2 points of view.

1 – it is just a law and has some ambiguity at that, you can see the law here: Law :and information here:  Title 21 CFR Part 11, it is very small barley fits on 2 pieces of paper and has enormous consequences for software used in the regulated area of Clinical Trials.

2 – Whenever you have a legal area there is what the law says and second is the interpretation of the law, or more specially the interpretation and enforcement of the law. 
You have cases that have been taken to court and interestingly enough have had impact on how things are enforced and what you need to do to come under compliance.  One such court case : here, essentially explains that you cannot grand-father electronic systems into compliance because of the risks and downstream effect, so this court case says that any systems that fall into compliance need to meet the new laws circa 1998.


What is this important?

If you wanted to innovate and differentiate yourself in this industry there is a big barrier to entry and interestingly enough regulatory compliance is expensive and also risky business so it creates a value moat if you can understand and use regulatory compliance to your advantage. 

If you can pass a Part 11 Audit it has extreme value to show not only that your software does what it says it does, it does what the law requires, which ensures safety, security and proper function. 

The most important part of this regulation is that you need to be certain that data in a clinical trial are true and exact, this impacts whether people live or die.  Because of high risk and importance of the software systems once you get a system compliant it reaps enormous benefits in that you charge more money for the software, training, and validation of the system setups.


2 Comments on Title 21 CFR Part 11: What is it and why is it important?

  1. Richard Soltero on Mon, 23rd Jan 2012 4:39 pm
  2. The FDA’s enforcement of Part 11 compliance was REVOKED per the Federal Register dated February 25, 2003.

  3. Lucas on Mon, 23rd Jan 2012 9:01 pm
  4. You raise a very important point which was not included in the write up about what part 11 is. There are 2 things which I will ellaborate on in a future blog post, one is
    1 – The FDA law.
    2 – The FDA guidance.

    Having been through many Part 11 audits with large pharmaceutical companies running large clinical trials, the things that the FDA revoked was there two Guidance documents which were essentially copies of Electronic Validation procedures written by the IEEE for building, testing and maintaining electronic devices (medical devices you could argue) while the Part 11 is geared toward eletronic software systems, so the guidance was seriously out of the normal process for software development having this “recommendation” on how to get part 11 compliance refer to testing hardware rather than software. You can think of it like this, the FDA withdrew the guidance on how to be part 11 compliance because part 11 is a law, they open themselves up for lawsuits if people meet the law or “intent of the law” without following the specific guidance the FDA has released.

    Here is an exceprt from the widthdrawl I have highlighted the fact that part 11 is indeed required by law, but they even said they will enforce this law with a wider lense than what the guidance they had published would have allowed. The first step many part 11 compliance specialists say when they audit you is and you have the draft guidance papers “throw it out and understand the intent of the law” because what the guidance was for is hardware systems and is not really designed for software systems.

    As you can see below, they withdrew the guidance that was also confusing other regulated areas what cover record retention, audit trails and validation where there is overlap with other regulations and the guidance was designed more for hardware, but the law states clear requirements and this also ties into the Predicate Rules which I will go over in more detail as welll.

    This draft guidance announces that
    we intend to exercise enforcement
    discretion with respect to the validation,
    audit trail, record retention, and record
    copying requirements of part 11.

    However, records must still be
    maintained or submitted in accordance
    with the underlying predicate rules.
    also intend to exercise enforcement
    discretion and will not normally take
    regulatory action to enforce part 11 with
    regard to systems that were operational
    before August 20, 1997, the effective
    date of part 11 (commonly known as
    existing or legacy systems) while we are
    reexamining part 11.
    It is important to note that FDA’s
    exercise of enforcement discretion as
    described in this guidance is limited to
    the specified part 11 requirements.

    intend to enforce all other provisions of
    part 11 including, but not limited to,
    certain controls for closed systems in
    § 11.10, the corresponding controls for
    open systems (§ 11.30), and
    requirements related to electronic
    signatures (e.g., §§ 11.50, 11.70, 11.100,
    11.200, and 11.300). We expect
    continued compliance with these
    provisions, and we will continue to
    enforce them.

    In the Federal Register of February 4,
    2003 (68 FR 5645), we announced the
    withdrawal of the draft guidance
    entitled ‘‘Guidance for Industry, 21 CFR
    Part 11; Electronic Records; Electronic
    Signatures, Electronic Copies of
    Electronic Records’’
    because we wished
    to limit the time spent by industry
    reviewing and commenting on the
    guidance, which might not have been
    representative of FDA’s approach under
    the CGMP initiative.
    At this time, we are also announcing
    the withdrawal of CPG 7153.17 and
    previously published part 11 draft
    guidance documents on validation,
    glossary of terms, time stamps, and
    maintenance of electronic records.
    has determined that it might cause
    confusion to leave standing these other
    draft guidances on part 11 and CPG
    7153.17. FDA received valuable public
    comment on the draft guidances and
    plans to use that information to inform
    the agency’s future decisionmaking with
    respect to part 11

Tell me what you're thinking...
and oh, if you want a pic to show with your comment, go get a gravatar!

%d bloggers like this: