March 20, 1997 federal register - labcompliance.de

1 federal register Thursday March 20, 1997. Part II. Department of Health and Human Services Food and Drug Administration 21 CFR Part 11. electronic Records; electronic Signatures;. Final Rule electronic Submissions; Establishment of Public Docket; Notice 13429. 13430 federal register / Vol. 62, No. 54 / Thursday, March 20, 1997 / Rules and Regulations DEPARTMENT OF HEALTH AND I. Background other general signings required by HUMAN SERVICES agency regulations. In 1991, members of the Section provides that records Food and Drug Administration pharmaceutical industry met with the may be maintained in electronic form agency to determine how they could and electronic signatures may be used 21 CFR Part 11 accommodate paperless record systems in lieu of traditional signatures.

2 Records under the current good manufacturing and signatures submitted to the agency [Docket No. 92N 0251] practice (CGMP) regulations in parts 210 may be presented in an electronic form and 211 (21 CFR parts 210 and 211). provided the requirements of part 11 are RIN 0910 AA29 FDA created a Task Force on electronic met and the records have been electronic Records; electronic Identification/Signatures to develop a identified in a public docket as the type Signatures uniform approach by which the agency of submission the agency accepts in an could accept electronic signatures and electronic form. Unless records are AGENCY: Food and Drug Administration, records in all program areas. In a identified in this docket as appropriate HHS. February 24, 1992, report, a task force for electronic submission, only paper ACTION: Final rule.

3 Subgroup, the electronic Identification/ records will be regarded as official Signature Working Group, submissions. SUMMARY: The Food and Drug recommended publication of an Section defines terms used in Administration (FDA) is issuing advance notice of proposed rulemaking part 11, including the terms: Biometrics, regulations that provide criteria for (ANPRM) to obtain public comment on closed system, open system, digital acceptance by FDA, under certain the issues involved. signature, electronic record , electronic circumstances, of electronic records, In the federal register of July 21, signature, and handwritten signature. electronic signatures, and handwritten 1992 (57 FR 32185), FDA published the Section describes controls for signatures executed to electronic ANPRM, which stated that the agency closed systems, systems to which access records as equivalent to paper records was considering the use of electronic is controlled by persons responsible for and handwritten signatures executed on identification/signatures, and requested the content of electronic records on that paper.

4 These regulations, which apply comments on a number of related topics system. These controls include to all FDA program areas, are intended and concerns. FDA received 53 measures designed to ensure the to permit the widest possible use of comments on the ANPRM. In the integrity of system operations and electronic technology, compatible with federal register of August 31, 1994 (59 information stored in the system. Such FDA's responsibility to promote and FR 45160), the agency published a measures include: (1) Validation; (2) the protect public health. The use of proposed rule that incorporated many of ability to generate accurate and electronic records as well as their the comments to the ANPRM, and complete copies of records; (3) archival submission to FDA is voluntary.

5 Requested that comments on the protection of records; (4) use of Elsewhere in this issue of the federal proposed regulation be submitted by computer-generated, time-stamped audit register , FDA is publishing a document November 29, 1994. A complete trails; (5) use of appropriate controls providing information concerning discussion of the options considered by over systems documentation; and (6) a submissions that the agency is prepared FDA and other background information determination that persons who to accept electronically . develop, maintain, or use electronic on the agency's policy on electronic DATES: Effective August 20, 1997. records and signature systems have the records and electronic signatures can be Submit written comments on the education, training, and experience to found in the ANPRM and the proposed information collection provisions of this perform their assigned tasks.

6 Rule. Section also addresses the final rule by May 19, 1997. FDA received 49 comments on the security of closed systems and requires ADDRESSES: Submit written comments proposed rule. The commenters that: (1) System access be limited to on the information collection provisions represented a broad spectrum of authorized individuals; (2) operational of this final rule to the Dockets interested parties: Human and system checks be used to enforce Management Branch (HFA 305), Food veterinary pharmaceutical companies as permitted sequencing of steps and and Drug Administration, 12420 well as biological products, medical events as appropriate; (3) authority Parklawn Dr., rm. 1 23, Rockville, MD device, and food interest groups, checks be used to ensure that only 20857. including 11 trade associations, 25 authorized individuals can use the The final rule is also available manufacturers, and 1 federal agency.

7 System, electronically sign a record , electronically via Internet: http:// II. Highlights of the Final Rule access the operation or computer system input or output device, alter a record , or FOR FURTHER INFORMATION CONTACT: The final rule provides criteria under perform operations; (4) device ( , Paul J. Motise, Center for Drug which FDA will consider electronic terminal) checks be used to determine Evaluation and Research (HFD records to be equivalent to paper the validity of the source of data input 325), Food and Drug records, and electronic signatures or operation instruction; and (5) written Administration, 7520 Standish Pl., equivalent to traditional handwritten policies be established and adhered to Rockville, MD 20855, 301 594 signatures. Part 11 (21 CFR part 11) holding individuals accountable and 1089.

8 E-mail address via Internet: applies to any paper records required by responsible for actions initiated under or statute or agency regulations and their electronic signatures, so as to deter Tom M. Chin, Division of Compliance supersedes any existing paper record record and signature falsification. Policy (HFC 230), Food and Drug requirements by providing that Section sets forth controls for Administration, 5600 Fishers Lane, electronic records may be used in lieu open systems, including the controls Rockville, MD 20857, 301 827 of paper records. electronic signatures required for closed systems in 0410. E-mail address via Internet: which meet the requirements of the rule and additional measures such as will be considered to be equivalent to document encryption and use of SUPPLEMENTARY INFORMATION: full handwritten signatures, initials, and appropriate digital signature standards federal register / Vol.

9 62, No. 54 / Thursday, March 20, 1997 / Rules and Regulations 13431. to ensure record authenticity, integrity, in combination with passwords must perspectives; (3) permitting and confidentiality. employ controls to ensure security and determination of trends, patterns, and Section requires signature integrity. The controls must include the behaviors; and (4) avoiding initial and manifestations to contain information following provisions: (1) The subsequent document misfiling that associated with the signing of electronic uniqueness of each combined may result from human error. records. This information must include identification code and password must There were several comments on the the printed name of the signer, the date be maintained in such a way that no two general scope and effect of proposed and time when the signature was individuals have the same combination part 11.

10 These comments noted that the executed, and the meaning (such as of identification code and password; (2) final regulations will be viewed as a review, approval, responsibility, and persons using identification codes and/ standard by other Government agencies, authorship) associated with the or passwords must ensure that they are and may strongly influence the signature. In addition, this information periodically recalled or revised; (3) loss direction of electronic record and is subject to the same controls as for management procedures must be electronic signature technologies. One electronic records and must be included followed to deauthorize lost, stolen, comment said that FDA's position on in any human readable forms of the missing, or otherwise potentially electronic signatures/ electronic records electronic record (such as electronic compromised tokens, cards, and other is one of the most pressing issues for the display or printout).