Depending on whom you talk to, medical device companies have either embraced or avoided going to an electronic records system because of 21 CFR Part 11, the FDA’s rule governing electronic signatures and records.
While large medical device companies that have $40 million or more in revenues have pretty much saddled up to an electronic system to keep their records, the approach of smaller device companies are mixed because many are unsure about taking the leap by incorporating 21 CFR Part 11 into their recordkeeping, according to software vendors familiar with the issue.
“If they are working in an FDA-regulated environment, we usually don’t have to convince them to look at the system that at least provides them the option to go paperless,” said Bill Taliaferro, director of global sales for State College, PA-based Blue Mountain Quality Resources. “I think almost any FDA-regulated company realizes at some point the interpretation may change or they may head down a new path that may be a little more stringent. Everyone who is FDA regulated would like to become Part 11 compliant at least in some fashion and therefore move in that direction.”
But some of the costs associated with complying could reach millions of dollars and force many companies to stay with paper trails. It’s a problem that has continually played a role in the ongoing saga that has become Part 11.
|A cornucopia of software packages, such as EtQ’s Reliance management system, have come on the market to help OEMs become Part 11 compliant. Photo courtesy of EtQ.|
21 CFR Part 11 was introduced in 1997 to establish criteria under which electronic records and signatures would be considered equivalent to paper records and handwritten signatures in manufacturing processes regulated by the FDA. The regulation was originally proposed in August 1994 with the final rule published in August 1997.
The FDA did not begin aggressively enforcing the rules until January 2000, when many software companies started releasing compatible programs. During the seven years since it first published the regulations, the FDA has struggled to clarify its position on compliance with electronic documentation. This, in turn, has kept many companies from committing to converting their systems as they waited for one clarification after another.
“We have several smaller clients who haven’t made any real effort to go electronic because it doesn’t make bottom-line sense,” said Dan Matlis, vice president of business development for Bensalem, PA-based Stelex. “It’s just very expensive to get a quality Part 11 system developed, and it is just as expensive to buy something and try to make it Part 11 compliant off the shelves. It is not an inexpensive endeavor, and a lot of our smaller clients are thinking, ‘You know, paper records aren’t bad. They’re a lot more transparent to monitor as a user so we are going to stick with it.’”
Indeed, compliance costs remain one of the biggest obstacles for medical device OEMs. Because of the complexity of integrating Part 11 software, outside consulting is nearly a must. Additionally, integrating many legacy networks—sometimes pieced together when companies merge—into a coherent system can be a daunting task. Some medical device manufacturers say a scaled approach would best serve their needs.
Ken Perino, manager of product and supplier quality for Bothell, WA-based SonoSite, a maker of hand-carried ultrasounds, observed that over the years more software has become affordable for smaller medical device companies. Because much of the software is modular, manufacturers can add modules as needed.
“I know a couple of the startups that have taken advantage of the pricing schemes,” said Perino. “It’s a good deal on both sides. If electronic-type companies want to get in at the startup level, they need to gear their pricing structure so they can get in at the ground level. As the company grows, more licenses will be bought and more modules will be bought.”
He added that this was the case with SonoSite, which increased its demand for compliant software as its own business expanded.
Complexities of Part 11
Complexities of Part 11
A challenge for small medical device companies looking to meet Part 11 requirements is understanding it. A 2001 survey compiled by NuGenesis Technologies found that 38% of respondents did not fully understand the implications of Part 11 as it affected their companies. At the same time, 75% said they had started to implement Part 11 measures but only 11% said that they were entirely compliant in at least some of the areas.
While some companies are opting not to go fully electronic, many software companies are advocating a risk-based approach.
“What has primarily changed is the FDA’s enforcement of Part 11 and that it is telling people to do a risk-based approach to going Part 11. That’s what we have been saying all along for several years,” said Tamar June vice president of strategic marketing for Morgan Hill, CA-based AssurX. “But if you are going to take a risk-based approach (you must) figure out how you are going to do this, what it is going to cost you and what are the risks and benefits of going compliant.”
An Easy of Rules
An Easy of Rules
Becoming Part 11 compliant may become easier. The most recent guidance released by the FDA in August of 2003 has attracted more companies to electronic documentation as the agency eased up on some of the rules.
“We have been seeing acceptance and growth of automated (electronic) systems, like Pilgrim’s, take an accelerated approach over the past year,” said Nikki Willett, director of products for Tampa, FL-based Pilgrim Software. “I think part of that has been a result of changes that have been going on in the FDA for more enforcement.”
One major area that changed in the 2003 guidance was the grandfathering of legacy systems.
“Some of the companies were still using old VAX and DEC machines to handle a lot of their record retention,” said Bo Preising, director of Life Sciences Industry for San Jose, CA-based Datasweep. “Lot of those machines had to be replaced by new types of systems.”
Carolyn Hughes, marketing director of Datasweep, added that some companies chose not to go electronic at all because of the cost of replacing legacy systems.
“Part of it is that the systems are very expensive in the first place. It is a big investment for these organizations to buy them,” said Hughes. “The standards that they used for data management retrieval were so archaic that it was hard to form fit it to what the FDA wanted in terms of the requirements, and it was also hard to change those systems.”
Peter Belisito, director of software development for Plymouth, MN-based ASI DataMyte, said 21 CFR Part 11 was a natural progression in sync with the rest of the business world. He noted that the agency became aware of its deficiencies in electronic recordkeeping guidance when the manufacturing sector started moving in that direction. Part 11 was meant to supplement its guidelines on paper documentation.
“The FDA was trying to do something equivalent for electronic documents so they set the specifications that tells how you have to acquire the data and keep the data so that these electronic records can be sent and are acceptable to the FDA,” said Belisito.
The problem that industry has with FDA’s implementation, however, is that the rules are subject to interpretation, and its inspectors have been inconsistent in their enforcement. AssurX’s June further noted that they tend to enforce Part 11 when other problems are found during a broader inspection rather than look for direct Part 11 violations.
“However, as FDA inspectors become more experienced with Part 11 requirements, they’re spotting deficiencies in systems on a much more regular basis, a trend likely to continue,” she said.
Glenn McCarty, CEO of Farmingdale, NY-based EtQ, pointed out that the guidance document in August 2003 clarified the FDA’s interpretation of Part 11 and narrowed its applicability.
“We have heard from our customers that some of the major changes involve the guidelines for long-term storage and record-retention,” said McCarty. “Another issue our customers come across is the concept of logging into systems. There are cases where our customers have five different systems with five different user names and passwords, and it can become a time-intensive task to log into all five.”
Stefanie Kyle, a software developer at Blue Mountain, said the FDA loosened the regulation with the August 2003 guidance.
“One of the problems they have had is that many of the interpretations were a little bit too specific and made it nearly impossible for companies to comply with the regulations,” said Kyle. “Many of the companies were avoiding going paperless mainly because of difficulties around it. It seems to me that they took a more common sense approach and said ‘Go back to the predicate rules that you are trying to satisfy and use the electronic signature requirements.’”
“When the FDA first came out with this regulation back in ‘97 and ‘98, it was feared like everyone fears the IRS because that was the kind of militant attitude that it was taking,” June added. “But what was scary about it was they did not really explain the regulation properly. It was kind of vague.”
Taliaferro agreed that the FDA has provided a broader adaptation for medical device and pharma companies with the new guidance.
“What the latest interpretation lends itself to is the running of the hybrid system for your combined electronic signature with handwritten signatures within the same environment,” said Taliaferro. She noted that initially the FDA mandated strictly a paperless system, but many companies found it too daunting. The agency now realizes that hybrid systems with a combination of paper and digital documents is acceptable in the near term.
Even so, industry is clamoring for more transparency. An informational meeting that had been scheduled by the FDA for industry in June was cancelled because of former President Ronald Reagan’s funeral. Industry is waiting for a rescheduled event, but it’s not clear if one will be held. Crystal Rice, trade media liaison for the Center for Drug Evaluation and Research, said a meeting has not been scheduled, but the agency is currently receiving written input from industry members about the August 2003 guidance.
“Our aim is to clarify the issue of records within scope and any others that have been posed. We have not yet established a timeline, but when the docket closes, we can make an assessment based on the number and type of comments received and address our next steps in the anticipated September cGMP initiative announcement,” said Rice.
One vendor speculated that the FDA might make significant changes or merge Part 11 into GMP.
“There have been some hints from the agency that 21 CFR Part 11 would be incorporated in the GMPs of the 21st Century, which they are rewriting,” said Jay Wigley, vice president of Washington, D.C.-based Analex.
Other software company representatives also hinted at the possibility that the FDA might incorporate Part 11 into parts 210, 211 or the Electric Commerce Act, which other industries turn to for guidance on electronic recordkeeping and specifically electronic signatures and transactions.
Observers point out that the revisions will give the FDA an opportunity to correct its initial mistakes. They added that the agency from the start failed to understand the complexities of electronic documentation and how difficult it would be for widespread industry adoption. Still, it’s clear that regulatory officials appear willing to make concessions.
“Some of the recent changes are due to that,” said Preising. “I think the biggest heartburn for a lot of the industry people was the legacy system requirements. They were saying that you had to replace legacy systems in a certain period of time, and a lot of the companies could not do that fast enough with the right set of costs and make sure that they could cover all the guidance issues that the FDA put out for Part 11.”
For all of its headaches, Part 11 will provide real benefits to those willing to adopt it. One immediate gain is easier CAPA management.
“CAPA is cited in a significant number of FDA warning letters,” said June. “If you don’t have a proper corrective and preventive action plan put in place you must address that issue. That comes up often.”
And Preising added that an integrated CAPA system is preferable especially if a company has several sources of record input.
“If you have a good CAPA system in place, usually it means you also have a good Quality System in place. It provides the FDA with a way to do its own risk-based approach to auditing companies,” said Preising. “When you really want to collect the power of the CAPA system, if it is integrated into things like our manufacturing shop floor modules, the quality of the data provides the company with a quick way of reporting on issues. Those issues could be possibly a recall situation or a global production system problem that a normal CAPA standalone system could not do.”
But beware: buying software alone will not help companies more competently embrace Part 11. They need to shop carefully and purchase the right package.
“It’s my perspective that they (medical device companies) can better manage with paper than with a software that does not comply very well,” said Steve Wise, quality control software director of statistical methods for Manassas, VA-based Infinity QS. “They can procedurally manage a lot of paper trail, (but) it’s a big huge effort.
“With all procedural things that you have to put in place to compensate for the software inefficiencies or ineffectiveness, then you might as well stick with paper until a company can find software that can do it.”
While Part 11 is the main reason for going electronic, general business practicality should be a consideration as well.
“This is not really only a regulatory issue. You should really look at it as a best practice issue more than regulatory at this point,” said June. “It only makes sense to go from a paper-base system to electronic. That way you can quickly and easily draw from the data in real time and react to any kind of issues that may come up quickly.”