Upload
vonhu
View
216
Download
0
Embed Size (px)
Citation preview
21 CFR Part 11: When Does It Apply?
Quincy J. Byrdsong, Ed.D., CIM, CIP, CCRPExecutive Director of Research Administration
Virginia Commonwealth UniversityMedical Center
Research Coordinator 4th FridayLunch and LearnMay 28, 2010
Quincy J. Byrdsong, Ed.D., CIM, CIP, CCRPExecutive Director of Research Administration for the Virginia Commonwealth University Medical Center 2
Objectives• To provide the overall scope and implementation
focus of 21 CFR Part 11 and specifically Subpart B• To discuss applicability and describe the concept of
predicate rules• To identify the FDA-stipulated controls for closed
systems which create, maintain, or transmit electronic records
• To consider the research context of both VCU and the VCU Health System relative to electronic medical records and part 11 compliance
Quincy J. Byrdsong, Ed.D., CIM, CIP, CCRPExecutive Director of Research Administration for the Virginia Commonwealth University Medical Center 3
Scope and Implementation • March 1997-intended to permit the widest possible use of
electronic technology compatible with FDA’s responsibility to protect public health
• Focused on Good Manufacturing Practice (GMP) and Good Laboratory Practice (GLP)-more equipment intensive and greater emphasis on record integrity
• Good Clinical Practice (GCP)-focus on continued data integrity throughout the drug submission/approval process
21 CFR Part 11• Established criteria under which FDA considers electronic
records, electronic signatures, and handwritten signatures executed to electronic records to be “trustworthy, reliable, and generally equivalent to paper records.”
Quincy J. Byrdsong, Ed.D., CIM, CIP, CCRPExecutive Director of Research Administration for the Virginia Commonwealth University Medical Center 4
Applicability
• Applies to records in electronic form that are created, modified, maintained, archived, retrieved, or transmitted, under any record requirements set forth by FDA regulations (e.g. FD&C Act and PHS Act)
• Does not apply to paper records that are, or have been, transmitted by electronic means
Quincy J. Byrdsong, Ed.D., CIM, CIP, CCRPExecutive Director of Research Administration for the Virginia Commonwealth University Medical Center
Common Violations
• No correlation between e-records and paper print-outs
• Missing procedures, e.g., access control
• No back-up of data• No prevention of data
deterioration during archiving• No or inadequate computer
system validation
5
•No individual passwords•Insufficient system security•No electronic audit trail•(Electronic) raw data notsaved or lost
•Electronic records, including audit trail, not reviewed
Quincy J. Byrdsong, Ed.D., CIM, CIP, CCRPExecutive Director of Research Administration for the Virginia Commonwealth University Medical Center 6
FDA Guidance-August 2003
• Confusion regarding part 11– Scope too broad– Unnecessary controls and costs– Discouraged innovation and technological
advances• Guidance established a more streamline
approach and narrowed the scope so that fewer records would be subject to part 11
Quincy J. Byrdsong, Ed.D., CIM, CIP, CCRPExecutive Director of Research Administration for the Virginia Commonwealth University Medical Center 7
Part 11 Records•Records that are required to be maintained under predicate rule requirements and are maintained in electronic format in place of paper format. (i.e. records not required by predicate rules to be retained, but are still in electronic format, are not part 11 records)
•Records that are required to be maintained under predicate rules, that are maintained in electronic format in addition to paper format and that are relied on to perform regulated activities. (SOP may dictate.)
•Records submitted to the FDA, under predicate rules, in electronic format. Records used for the submission but not actually submitted are not part 11 records unless otherwise required by predicate rules.
Quincy J. Byrdsong, Ed.D., CIM, CIP, CCRPExecutive Director of Research Administration for the Virginia Commonwealth University Medical Center
Definitions
• Predicate rule-any FDA regulation which requires companies to maintain certain records and submit information to the FDA as part of compliance
• Example: 21 CFR 211.180 Records shall be kept for all components, drug products…
• Challenge: GCP lacks specific predicate rule record requirements in some areas
8
Quincy J. Byrdsong, Ed.D., CIM, CIP, CCRPExecutive Director of Research Administration for the Virginia Commonwealth University Medical Center
Subpart B-Electronic Records Controls for closed
systems• Limiting systems
access to authorized individuals
• Use of operational system checks
• Use of authority checks• Use of device checks
• Determination of training
• Written policies• Appropriate controls
over systems documentation
• Controls for open systems corresponding to controls for closed systems
9
Quincy J. Byrdsong, Ed.D., CIM, CIP, CCRPExecutive Director of Research Administration for the Virginia Commonwealth University Medical Center
VCU/VCUHS – Electronic Record
• VCUHS uses a Hybrid System• Hybrid System-an environment consisting of
both Electronic and Paper-based Records• Example: The system does not have an
electronic signature option, so the user prints the report and signs the paper copy. Hence, there is an electronic record with a paper/handwritten signature.
10
Quincy J. Byrdsong, Ed.D., CIM, CIP, CCRPExecutive Director of Research Administration for the Virginia Commonwealth University Medical Center
Cerner/Millennium• Millennium is primarily intended as an electronic health
record solution to support the activities of patient care delivery
• Millennium has capabilities that enable aspects of compliance with parts of part 11 but, does not make a representation of enabling compliance with Part 11
• The primary burden of compliance falls on the entity engaged in research activities that fall under Part 11– Millennium is used as an EHR as a source of data –
the process which follows ensures part 11 compliance.
Quincy J. Byrdsong, Ed.D., CIM, CIP, CCRPExecutive Director of Research Administration for the Virginia Commonwealth University Medical Center
Is Cerner/Millennium Part 11 Complaint?
• Each site configures Millennium to suit its intended use as an EMR at that site
• Since each clinical trial sponsor conducts its own audit, to include the EMR in the scope of audit would place significant burden on a site’s IT resources as well as compromise the protections of human subjects
– Audit scope could become quite invasive towards the EMR not primarily intended for use as a research database
• The objective should be to have a well defined and contained research information management process
Quincy J. Byrdsong, Ed.D., CIM, CIP, CCRPExecutive Director of Research Administration for the Virginia Commonwealth University Medical Center
VCU/VCUHS Options
1. Assume a risk-based approach for using the EMR source
2. Implement a manual paper-based process that includes the printing, signing, and archiving of EMR pages to meet the letter of current 21 CFR Part 11 requirements
3. Implement a site-developed process/system that incorporates human intervention for data validation/quality checks of EMR-derived data
4. PowerTrials
Quincy J. Byrdsong, Ed.D., CIM, CIP, CCRPExecutive Director of Research Administration for the Virginia Commonwealth University Medical Center
Human Protections Considerations: Confidentiality
• Access to Protected Health Information
• Contact with potential research subjects
• Confidentiality of subjects’ participation in clinical trials
• Database roles and privileges
Quincy J. Byrdsong, Ed.D., CIM, CIP, CCRPExecutive Director of Research Administration for the Virginia Commonwealth University Medical Center 15
Questions
Quincy J. [email protected]