Electronic Records; Electronic Signatures

SUMMARY: The Food and Drug Administration (FDA) is issuing regulations

that provide criteria for acceptance by FDA, under certain

circumstances, of electronic records, electronic signatures, and

handwritten signatures executed to electronic records as equivalent to

paper records and handwritten signatures executed on paper. These

regulations, which apply to all FDA program areas, are intended to

permit the widest possible use of electronic technology, compatible

with FDA's responsibility to promote and protect public health. The use

of electronic records as well as their submission to FDA is voluntary.

Elsewhere in this issue of the Federal Register, FDA is publishing a

document providing information concerning submissions that the agency

is prepared to accept electronically .

DATES: Effective August 20, 1997. Submit written comments on the

information collection provisions of this final rule by May 19, 1997.

ADDRESSES: Submit written comments on the information collection

provisions of this final rule to the Dockets Management Branch (HFA-

305), Food and Drug Administration, 12420 Parklawn Dr., rm. 1-23,

Rockville, MD 20857.

The final rule is also available electronically via Internet:

http://www.fda.gov.

FOR FURTHER INFORMATION CONTACT:

Paul J. Motise, Center for Drug Evaluation and Research (HFD-325),

Food and Drug Administration, 7520 Standish Pl., Rockville, MD 20855,

301-594-1089. E-mail address via Internet: [email protected], or

Tom M. Chin, Division of Compliance Policy (HFC-230), Food and Drug

Administration, 5600 Fishers Lane, Rockville, MD 20857, 301-827-0410.

E-mail address via Internet: [email protected]

SUPPLEMENTARY INFORMATION:

I. Background

In 1991, members of the pharmaceutical industry met with the agency

to determine how they could accommodate paperless record systems under

the current good manufacturing practice (CGMP) regulations in parts 210

and 211 (21 CFR parts 210 and 211). FDA created a Task Force on

Electronic Identification/Signatures to develop a uniform approach by

which the agency could accept electronic signatures and records in all

program areas. In a February 24, 1992, report, a task force subgroup,

the Electronic Identification/Signature Working Group, recommended

publication of an advance notice of proposed rulemaking (ANPRM) to

obtain public comment on the issues involved.

In the Federal Register of July 21, 1992 (57 FR 32185), FDA

published the ANPRM, which stated that the agency was considering the

use of electronic identification/signatures, and requested comments on

a number of related topics and concerns. FDA received 53 comments on

the ANPRM. In the Federal Register of August 31, 1994 (59 FR 45160),

the agency published a proposed rule that incorporated many of the

comments to the ANPRM, and requested that comments on the proposed

regulation be submitted by November 29, 1994. A complete discussion of

the options considered by FDA and other background information on the

agency's policy on electronic records and electronic signatures can be

found in the ANPRM and the proposed rule.

FDA received 49 comments on the proposed rule. The commenters

represented a broad spectrum of interested parties: Human and

veterinary pharmaceutical companies as well as biological products,

medical device, and food interest groups, including 11 trade

associations, 25 manufacturers, and 1 Federal agency.

II. Highlights of the Final Rule

The final rule provides criteria under which FDA will consider

electronic records to be equivalent to paper records, and electronic

signatures equivalent to traditional handwritten signatures. Part 11

(21 CFR part 11) applies to any paper records required by statute or

agency regulations and supersedes any existing paper record

requirements by providing that electronic records may be used in lieu

of paper records. Electronic signatures which meet the requirements of

the rule will be considered to be equivalent to full handwritten

signatures, initials, and other general signings required by agency

regulations.

Section 11.2 provides that records may be maintained in electronic

form and electronic signatures may be used in lieu of traditional

signatures. Records and signatures submitted to the agency may be

presented in an electronic form provided the requirements of part 11

are met and the records have been identified in a public docket as the

type of submission the agency accepts in an electronic form. Unless

records are identified in this docket as appropriate for electronic

submission, only paper records will be regarded as official

submissions.

Section 11.3 defines terms used in part 11, including the terms:

Biometrics, closed system, open system, digital signature, electronic

record, electronic signature, and handwritten signature.

Section 11.10 describes controls for closed systems, systems to

which access is controlled by persons responsible for the content of

electronic records on that system. These controls include measures

designed to ensure the integrity of system operations and information

stored in the system. Such measures include: (1) Validation; (2) the

ability to generate accurate and complete copies of records; (3)

archival protection of records; (4) use of computer-generated, time-

stamped audit trails; (5) use of appropriate controls over systems

documentation; and (6) a determination that persons who develop,

maintain, or use electronic records and signature systems have the

education, training, and experience to perform their assigned tasks.

Section 11.10 also addresses the security of closed systems and

requires that: (1) System access be limited to authorized individuals;

(2) operational system checks be used to enforce permitted sequencing

of steps and events as appropriate; (3) authority checks be used to

ensure that only authorized individuals can use the system,

electronically sign a record, access the operation or computer system

input or output device, alter a record, or perform operations; (4)

device (e.g., terminal) checks be used to determine the validity of the

source of data input or operation instruction; and (5) written policies

be established and adhered to holding individuals accountable and

responsible for actions initiated under their electronic signatures, so

as to deter record and signature falsification.

Section 11.30 sets forth controls for open systems, including the

controls required for closed systems in Sec. 11.10 and additional

measures such as document encryption and use of appropriate digital

signature standards

[[Page 13431]]

to ensure record authenticity, integrity, and confidentiality.

Section 11.50 requires signature manifestations to contain

information associated with the signing of electronic records. This

information must include the printed name of the signer, the date and

time when the signature was executed, and the meaning (such as review,

approval, responsibility, and authorship) associated with the

signature. In addition, this information is subject to the same

controls as for electronic records and must be included in any human

readable forms of the electronic record (such as electronic display or

printout).

Under Sec. 11.70, electronic signatures and handwritten signatures

executed to electronic records must be linked to their respective

records so that signatures cannot be excised, copied, or otherwise

transferred to falsify an electronic record by ordinary means.

Under the general requirements for electronic signatures, at

Sec. 11.100, each electronic signature must be unique to one individual

and must not be reused by, or reassigned to, anyone else. Before an

organization establishes, assigns, certifies, or otherwise sanctions an

individual's electronic signature, the organization shall verify the

identity of the individual.

Section 11.200 provides that electronic signatures not based on

biometrics must employ at least two distinct identification components

such as an identification code and password. In addition, when an

individual executes a series of signings during a single period of

controlled system access, the first signing must be executed using all

electronic signature components and the subsequent signings must be

executed using at least one component designed to be used only by that

individual. When an individual executes one or more signings not

performed during a single period of controlled system access, each

signing must be executed using all of the electronic signature

components.

Electronic signatures not based on biometrics are also required to

be used only by their genuine owners and administered and executed to

ensure that attempted use of an individual's electronic signature by

anyone else requires the collaboration of two or more individuals. This

would make it more difficult for anyone to forge an electronic

signature. Electronic signatures based upon biometrics must be designed

to ensure that such signatures cannot be used by anyone other than the

genuine owners.

Under Sec. 11.300, electronic signatures based upon use of

identification codes in combination with passwords must employ controls

to ensure security and integrity. The controls must include the

following provisions: (1) The uniqueness of each combined

identification code and password must be maintained in such a way that

no two individuals have the same combination of identification code and

password; (2) persons using identification codes and/or passwords must

ensure that they are periodically recalled or revised; (3) loss

management procedures must be followed to deauthorize lost, stolen,

missing, or otherwise potentially compromised tokens, cards, and other

devices that bear or generate identification codes or password

information; (4) transaction safeguards must be used to prevent

unauthorized use of passwords and/or identification codes, and to

detect and report any attempt to misuse such codes; (5) devices that

bear or generate identification codes or password information, such as

tokens or cards, must be tested initially and periodically to ensure

that they function properly and have not been altered in an

unauthorized manner.

III. Comments on the Proposed Rule

A. General Comments

1. Many comments expressed general support for the proposed rule.

Noting that the proposal's regulatory approach incorporated several

suggestions submitted by industry in comments on the ANPRM, a number of

comments stated that the proposal is a good example of agency and

industry cooperation in resolving technical issues.

Several comments also noted that both industry and the agency can

realize significant benefits by using electronic records and electronic

signatures, such as increasing the speed of information exchange, cost

savings from the reduced need for storage space, reduced errors, data

integration/trending, product improvement, manufacturing process

streamlining, improved process control, reduced vulnerability of

electronic signatures to fraud and abuse, and job creation in

industries involved in electronic record and electronic signature

technologies.

One comment noted that, when part 11 controls are satisfied,

electronic signatures and electronic records have advantages over paper

systems, advantages that include: (1) Having automated databases that

enable more advanced searches of information, thus obviating the need

for manual searches of paper records; (2) permitting information to be

viewed from multiple perspectives; (3) permitting determination of

trends, patterns, and behaviors; and (4) avoiding initial and

subsequent document misfiling that may result from human error.

There were several comments on the general scope and effect of

proposed part 11. These comments noted that the final regulations will

be viewed as a standard by other Government agencies, and may strongly

influence the direction of electronic record and electronic signature

technologies. One comment said that FDA's position on electronic

signatures/electronic records is one of the most pressing issues for

the pharmaceutical industry and has a significant impact on the

industry's future competitiveness. Another comment said that the rule

constitutes an important milestone along the Nation's information

superhighway.

FDA believes that the extensive industry input and collaboration

that went into formulating the final rule is representative of a

productive partnership that will facilitate the use of advanced

technologies. The agency acknowledges the potential benefits to be

gained by electronic record/electronic signature systems. The agency

expects that the magnitude of these benefits should significantly

outweigh the costs of making these systems, through compliance with

part 11, reliable, trustworthy, and compatible with FDA's

responsibility to promote and protect public health. The agency is

aware of the potential impact of the rule, especially regarding the

need to accommodate and encourage new technologies while maintaining

the agency's ability to carry out its mandate to protect public health.

The agency is also aware that other Federal agencies share the same

concerns and are addressing the same issues as FDA; the agency has held

informal discussions with other Federal agencies and participated in

several interagency groups on electronic records/electronic signatures

and information technology issues. FDA looks forward to exchanging

information and experience with other agencies for mutual benefit and

to promote a consistent Federal policy on electronic records and

signatures. The agency also notes that benefits, such as the ones

listed by the comments, will help to offset any system modification

costs that persons may incur to achieve compliance with part 11.

B. Regulations Versus Guidelines

2. Several comments addressed whether the agency's policy on

electronic signatures and electronic records should be issued as a

regulation

[[Page 13432]]

or recommended in a guideline. Most comments supported a regulation,

citing the need for a practical and workable approach for criteria to

ensure that records can be stored in electronic form and are reliable,

trustworthy, secure, accurate, confidential, and authentic. One comment

specifically supported a single regulation covering all FDA-regulated

products to ensure consistent requirements across all product lines.

Two comments asserted that the agency should only issue guidelines or

``make the regulations voluntary.'' One of these comments said that by

issuing regulations, the agency is shifting from creating tools to

enhance communication (technological quality) to creating tools for

enforcement (compliance quality).

The agency remains convinced, as expressed in the preamble to the

proposed rule (59 FR 45160 at 45165), that a policy statement,

inspection guide, or other guidance would be an inappropriate means for

enunciating a comprehensive policy on electronic signatures and

records. FDA has concluded that regulations are necessary to establish

uniform, enforceable, baseline standards for accepting electronic

signatures and records. The agency believes, however, that supplemental

guidance documents would be useful to address controls in greater

detail than would be appropriate for regulations. Accordingly, the

agency anticipates issuing supplemental guidance as needed and will

afford all interested parties the opportunity to comment on the

guidance documents.

The need for regulations is underscored by several opinions

expressed in the comments. For example, one comment asserted that it

should be acceptable for supervisors to remove the signatures of their

subordinates from signed records and replace them with their own

signatures. Although the agency does not object to the use of a

supervisor's signature to endorse or confirm a subordinate's actions,

removal of an original signature is an action the agency views as

falsification. Several comments also argued that an electronic

signature should consist of only a password, that passwords need not be

unique, that it is acceptable for people to use passwords associated

with their personal lives (like the names of their children or their

pets), and that passwords need only be changed every 2 years. FDA

believes that such procedures would greatly increase the possibility

that a password could be compromised and the chance that any resulting

impersonation and/or falsification would continue for a long time.

Therefore, an enforceable regulation describing the acceptable

characteristics of an electronic signature appears necessary.

C. Flexibility and Specificity

3. Several comments addressed the flexibility and specificity of

the proposed rule. The comments contended that agency acceptance of

electronic records systems should not be based on any particular

technology, but rather on the adequacy of the system controls under

which they are created and managed. Some comments claimed that the

proposed rule was overly prescriptive and that it should not specify

the mechanisms to be used, but rather only require owners/users to

design appropriate safeguards and validate them to reasonably ensure

electronic signature integrity and authenticity. One comment commended

the agency for giving industry the freedom to choose from a variety of

electronic signature technologies, while another urged that the final

rule be more specific in detailing software requirements for electronic

records and electronic notebooks in research and testing laboratories.

The agency believes that the provisions of the final rule afford

firms considerable flexibility while providing a baseline level of

confidence that records maintained in accordance with the rule will be

of high integrity. For example, the regulation permits a wide variety

of existing and emerging electronic signature technologies, from use of

identification codes in conjunction with manually entered passwords to

more sophisticated biometric systems that may necessitate additional

hardware and software. While requiring electronic signatures to be

linked to their respective electronic records, the final rule affords

flexibility in achieving that link through use of any appropriate

means, including use of digital signatures and secure relational

database references. The final rule accepts a wide variety of

electronic record technologies, including those based on optical

storage devices. In addition, as discussed in comment 40 of this

document, the final rule does not establish numerical standards for

levels of security or validation, thus offering firms flexibility in

determining what levels are appropriate for their situations.

Furthermore, while requiring operational checks, authority checks, and

periodic testing of identifying devices, persons have the flexibility

of conducting those controls by any suitable method. When the final

rule calls for a certain control, such as periodic testing of

identification tokens, persons have the option of determining the

frequency.

D. Controls for Electronic Systems Compared with Paper Systems

4. Two comments stated that any controls that do not apply to

paper-based document systems and handwritten signatures should not

apply to electronic record and signature systems unless those controls

are needed to address an identified unique risk associated with

electronic record systems. One comment expressed concern that FDA was

establishing a much higher standard for electronic signatures than

necessary.

In attempting to establish minimum criteria to make electronic

signatures and electronic records trustworthy and reliable and

compatible with FDA's responsibility to promote and protect public

health (e.g., by hastening the availability of new safe and effective

medical products and ensuring the safety of foods), the agency has

attempted to draw analogies to handwritten signatures and paper records

wherever possible. In doing so, FDA has found that the analogy does not

always hold because of the differences between paper and electronic

systems. The agency believes some of those differences necessitate

controls that will be unique to electronic technology and that must be

addressed on their own merits and not evaluated on the basis of their

equivalence to controls governing paper documents.

The agency found that some of the comments served to illustrate the

differences between paper and electronic record technologies and the

need to address controls that may not generally be found in paper

record systems. For example, several comments pointed out that

electronic records built upon information databases, unlike paper

records, are actually transient views or representations of information

that is dispersed in various parts of the database. (The agency notes

that the databases themselves may be geographically dispersed but

linked by networks.) The same software that generates representations

of database information on a screen can also misrepresent that

information, depending upon how the software is written (e.g., how a

query is prepared). In addition, database elements can easily be

changed at any time to misrepresent information, without evidence that

a change was made, and in a manner that destroys the original

information. Finally, more people have potential access to electronic

record

[[Page 13433]]

systems than may have access to paper records.

Therefore, controls are needed to ensure that representations of

database information have been generated in a manner that does not

distort data or hide noncompliant or otherwise bad information, and

that database elements themselves have not been altered so as to

distort truth or falsify a record. Such controls include: (1) Using

time-stamped audit trails of information written to the database, where

such audit trails are executed objectively and automatically rather

than by the person entering the information, and (2) limiting access to

the database search software. Absent effective controls, it is very

easy to falsify electronic records to render them indistinguishable

from original, true records.

The traditional paper record, in comparison, is generally a durable

unitized representation that is fixed in time and space. Information is

recorded directly in a manner that does not require an intermediate

means of interpretation. When an incorrect entry is made, the customary

method of correcting FDA-related records is to cross out the original

entry in a manner that does not obscure the prior data. Although paper

records may be falsified, it is relatively difficult (in comparison to

falsification of electronic records) to do so in a nondetectable

manner. In the case of paper records that have been falsified, a body

of evidence exists that can help prove that the records had been

changed; comparable methods to detect falsification of electronic

records have yet to be fully developed.

In addition, there are significant technological differences

between traditional handwritten signatures (recorded on paper) and

electronic signatures that also require controls unique to electronic

technologies. For example, the traditional handwritten signature cannot

be readily compromised by being ``loaned'' or ``lost,'' whereas an

electronic signature based on a password in combination with an

identification code can be compromised by being ``loaned'' or ``lost.''

By contrast, if one person attempts to write the handwritten signature

of another person, the falsification would be difficult to execute and

a long-standing body of investigational techniques would be available

to detect the falsification. On the other hand, many electronic

signatures are relatively easy to falsify and methods of falsification

almost impossible to detect.

Accordingly, although the agency has attempted to keep controls for

electronic record and electronic signatures analogous to traditional

paper systems, it finds it necessary to establish certain controls

specifically for electronic systems.

E. FDA Certification of Electronic Signature Systems

5. One comment requested FDA certification of what it described as

a low-cost, biometric-based electronic signature system, one which uses

dynamic signature verification with a parameter code recorded on

magnetic stripe cards.

The agency does not anticipate the need to certify individual

electronic signature products. Use of any electronic signature system

that complies with the provisions of part 11 would form the basis for

agency acceptance of the system regardless of what particular

technology or brand is used. This approach is consistent with FDA's

policy in a variety of program areas. The agency, for example, does not

certify manufacturing equipment used to make drugs, medical devices, or

food.

F. Biometric Electronic Signatures

6. One comment addressed the agency's statement in the proposed

rule (59 FR 45160 at 45168) that the owner of a biometric/behavioral

link could not lose or give it away. The comment stated that it was

possible for an owner to ``lend'' the link for a file to be opened, as

a collaborative fraudulent gesture, or to unwittingly assist a

fraudulent colleague in an ``emergency,'' a situation, the comment

said, that was not unknown in the computer industry.

The agency acknowledges that such fraudulent activity is possible

and that people determined to falsify records may find a means to do so

despite whatever technology or preventive measures are in place. The

controls in part 11 are intended to deter such actions, make it

difficult to execute falsification by mishap or casual misdeed, and to

help detect such alterations when they occur (see Sec. 11.10

(introductory paragraph and especially Secs. 11.10(j) and 11.200(b)).

G. Personnel Integrity

7. A few comments addressed the role of individual honesty and

trust in ensuring that electronic records are reliable, trustworthy,

and authentic. One comment noted that firms must rely in large measure

upon the integrity of their employees. Another said that subpart C of

part 11, Electronic Signatures, appears to have been written with the

belief that pharmaceutical manufacturers have an incentive to falsify

electronic signatures. One comment expressed concern about possible

signature falsification when an employee leaves a company to work

elsewhere and the employee uses the electronic signature illegally.

The agency agrees that the integrity of any electronic signature/

electronic record system depends heavily upon the honesty of employees

and that most persons are not motivated to falsify records. However,

the agency's experience with various types of records and signature

falsification demonstrates that some people do falsify information

under certain circumstances. Among those circumstances are situations

in which falsifications can be executed with ease and have little

likelihood of detection. Part 11 is intended to minimize the

opportunities for readily executing falsifications and to maximize the

chances of detecting falsifications.

Concerning signature falsification by former employees, the agency

would expect that upon the departure of an employee, the assigned

electronic signature would be ``retired'' to prevent the former

employee from falsely using the signature.

H. Security of Industry Electronic Records Submitted to FDA

8. Several comments expressed concern about the security and

confidentiality of electronic records submitted to FDA. One suggested

that submissions be limited to such read-only formats as CD-ROM with

raw data for statistical manipulation provided separately on floppy

diskette. One comment suggested that in light of the proposed rule, the

agency should review its own internal security procedures. Another

addressed electronic records that may be disclosed under the Freedom of

Information Act and expressed concern regarding agency deletion of

trade secrets. One comment anticipated FDA's use of open systems to

access industry records (such as medical device production and control

records) and suggested that such access should be restricted to closed

systems.

The agency is well aware of its legal obligation to maintain the

confidentiality of trade secret information in its possession, and is

committed to meet that obligation regardless of the form (paper or

electronic) a record takes. The procedures used to ensure

confidentiality are consistent with the provisions of part 11. FDA is

also examining other controls, such as use of digital signatures, to

ensure submission integrity. To permit legitimate changes to be made,

the agency does not believe that it is necessary to restrict

submissions to those maintained in

[[Page 13434]]

read-only formats in all cases; each agency receiving unit retains the

flexibility to determine whatever format is most suitable. Those

intending to submit material are expected to consult with the

appropriate agency receiving unit to determine the acceptable formats.

Although FDA access to electronic records on open systems

maintained by firms is not anticipated in the near future, the agency

believes it would be inappropriate to rule out such a procedure. Such

access can be a valuable inspection tool and can enhance efficiencies

by reducing the time investigators may need to be on site. The agency

believes it is important to develop appropriate procedures and security

measures in cooperation with industry to ensure that such access does

not jeopardize data confidentiality or integrity.

I. Effective Date/Grandfathering

9. Several comments addressed the proposed effective date of the

final rule, 90 days after publication in the Federal Register, and

suggested potential exemptions (grandfathering) for systems now in use.

Two comments requested an expedited effective date for the final rule.

One comment requested an effective date at least 18 months after

publication of the final rule to permit firms to modify and validate

their systems. One comment expressed concern about how the rule, in

general, will affect current systems, and suggested that the agency

permit firms to continue to use existing electronic record systems that

otherwise conform to good manufacturing or laboratory practices until

these firms make major modifications to those systems or until 5 years

have elapsed, whichever comes first. Several other comments requested

grandfathering for specific sections of the proposed rule.

The agency has carefully considered the comments and suggestions

regarding the final rule's effective date and has concluded that the

effective date should be 5 months after date of publication in the

Federal Register. The agency wishes to accommodate firms that are

prepared now to comply with part 11 or will be prepared soon, so as to

encourage and foster new technologies in a manner that ensures that

electronic record and electronic signature systems are reliable,

trustworthy, and compatible with FDA's responsibility to promote and

protect public health. The agency believes that firms that have

consulted with FDA before adopting new electronic record and electronic

signature technologies (especially technologies that may impact on the

ability of the agency to conduct its work effectively) will need to

make few, if any, changes to systems used to maintain records required

by FDA.

The agency believes that the provisions of part 11 represent

minimal standards and that a general exemption for existing systems

that do not meet these provisions would be inappropriate and not in the

public interest because such systems are likely to generate electronic

records and electronic signatures that are unreliable, untrustworthy,

and not compatible with FDA's responsibility to promote and protect

public health. Such an exemption might, for example, mean that a firm

could: (1) Deny FDA inspectional access to electronic record systems,

(2) permit unauthorized access to those systems, (3) permit individuals

to share identification codes and passwords, (4) permit systems to go

unvalidated, and (5) permit records to be falsified in many ways and in

a manner that goes undetected.

The agency emphasizes that these regulations do not require, but

rather permit, the use of electronic records and signatures. Firms not

confident that their electronic systems meet the minimal requirements

of these regulations are free to continue to use traditional signatures

and paper documents to meet recordkeeping requirements.

J. Comments by Electronic Mail (e-mail) and Electronic Distribution of

FDA Documents

10. One comment specifically noted that the agency has accepted

comments by e-mail and that this provides an additional avenue for

public participation in the rulemaking process. Another comment

encouraged FDA to expand the use of electronic media to provide

information by such open systems as bulletin boards.

The agency intends to explore further the possibility of continuing

to accept public comments by e-mail and other electronic means. For

this current experiment, the agency received only one comment by e-

mail. The comment that addressed this issue was, itself, transmitted in

a letter. The agency recognizes the benefits of distributing

information electronically, has expanded that activity, and intends to

continue that expansion. Although only one e-mail comment was received,

the agency does not attribute that low number to a lack of ability to

send e-mail because the agency received e-mail from 198 persons who

requested the text of the proposed rule, including requests from people

outside the United States.

K. Submissions by Facsimile (Fax)

11. One comment said that part 11 should include a provision for

FDA acceptance of submissions by fax, such as import form FDA 2877. The

comment noted that the U.S. Customs Service accepts fax signatures on

its documents, and claimed that FDA's insistence on hard copies of form

FDA 2877 is an impediment to imports.

The agency advises that part 11 permits the unit that handles

import form FDA 2877 to accept that record in electronic form when it

is prepared logistically to do so. As noted in the discussion on

Sec. 11.1(b) in comment 21 of this document, the agency recognizes that

faxes can be in paper or electronic form, based on the capabilities of

the sender and recipient.

L. Blood Bank Issues

12. Two comments addressed blood bank issues in the context of

electronic records and electronic signatures and said the agency should

clarify that part 11 would permit electronic crossmatching by a central

blood center for individual hospitals. One comment stated that remote

blood center and transfusion facilities should be permitted to rely on

electronically communicated information, such as authorization for

labeling/issuing units of blood, and that the electronic signature of

the supervisor in the central testing facility releasing the product

for labeling and issuance should be sufficient because the proposed

rule guards against security and integrity problems.

One comment questioned whether, under part 11, electronic

signatures would meet the signature requirements for the release of

units of blood, and if there would be instances where a full signature

would be required instead of a technician's identification. Another

comment asserted that it is important to clarify how the term ``batch''

will be interpreted under part 11, and suggested that the term used in

relation to blood products refers to a series of units of blood having

undergone common manufacturing processes and recorded on the same

computerized document. The comment contrasted this to FDA's current

view that each unit of blood be considered a batch.

The agency advises that part 11 permits release records now in

paper form to be in electronic form and traditional handwritten

signatures to be electronic signatures. Under part 11, the name of the

technician must appear in the record display or printout to clearly

identify the technician. The appearance of the technician's

identification code

[[Page 13435]]

alone would not be sufficient. The agency also advises that the

definition of a ``batch'' for blood or other products is not affected

by part 11, which addresses the trustworthiness and reliability of

electronic records and electronic signatures, regardless of how a

batch, which is the subject of those records and signatures, is

defined.

M. Regulatory Flexibility Analysis

13. One comment said that, because part 11 will significantly

impact a substantial number of small businesses, even though the impact

would be beneficial, FDA is required to perform a regulatory

flexibility analysis and should publish such an analysis in the Federal

Register before a final rule is issued.

The comment states that the legislative history of the Regulatory

Flexibility Act is clear that, ``significant economic impact,'' as it

appears at 5 U.S.C. 605(b) is neutral with respect to whether such

impact is beneficial or adverse.

Contrary to the comment's assertion, the legislative history is not

dispositive of this matter. It is well established that the task of

statutory construction must begin with the actual language of the

statute. (See Bailey v. United States, 116 S. Ct. 595, 597 (1996).) A

statutory term must not be construed in isolation; a provision that may

seem ambiguous in isolation is often clarified by the remainder of the

statute. (See Dept. Of Revenue of Oregon v. ACF Industries, 114 S. Ct.

843, 850 (1994).) Moreover, it is a fundamental canon of statutory

construction that identical terms within the same statute must bear the

same meaning. (See Reno v. Koray, 115 S. Ct. 2021, 2026 (1995).)

In addition to appearing in 5 U.S.C. 605(b), the term ``significant

economic impact'' appears elsewhere in the statute. The legislation is

premised upon the congressional finding that alternative regulatory

approaches may be available which ``minimize the significant economic

impact'' of rules (5 U.S.C. 601 note). In addition, an initial

regulatory flexibility analysis must describe significant regulatory

alternatives that ``minimize any significant economic impact'' (5

U.S.C. 603(c)). Similarly, a final regulatory flexibility analysis must

include a description of the steps the agency has taken to ``minimize

any significant economic impact'' (5 U.S.C. 604(a)(5)). The term

appeared as one of the elements of a final regulatory flexibility

analysis, as originally enacted in 1980. (See Pub. L. No. 96-354, 3(a),

94 Stat. 1164, 1167 (1980) (formerly codified at 5 U.S.C. 604(a)(3)).)

In addition, when Congress amended the elements of a final regulatory

flexibility analysis in 1996, it re-enacted the term, as set forth

above. (See Pub. L. 104-121, 241(b), 110 Stat. 857, 865 (1996)

(codified at 5 U.S.C.604(a)(5)).)

Unless the purpose of the statute was intended to increase the

economic burden of regulations by minimizing positive or beneficial

effects, ``significant economic impact'' cannot include such effects.

Because it is beyond dispute that the purpose of the statute is not

increasing economic burdens, the plain meaning of ``significant

economic impact'' is clear and necessarily excludes beneficial or

positive effects of regulations. Even where there are some limited

contrary indications in the statute's legislative history, it is

inappropriate to resort to legislative history to cloud a statutory

text that is clear on its face. (See Ratzlaff v. United States, 114 S.

Ct. 655, 662 (1994).) Therefore, the agency concludes that a final

regulatory flexibility analysis is not required for this regulation or

any regulation for which there is no significant adverse economic

impact on small entities. Notwithstanding these conclusions, FDA has

nonetheless considered the impact of the rule on small entities. (See

section XVI. of this document.)

N. Terminology

14. One comment addressed the agency's use of the word ``ensure''

throughout the rule and argued that the agency should use the word

``assure'' rather than ``ensure'' because ``ensure'' means ``to

guarantee or make certain'' whereas ``assure'' means ``to make

confident.'' The comment added that ``assure'' is also more consistent

with terminology in other regulations.

The agency wishes to emphasize that it does not intend the word

``ensure'' to represent a guarantee. The agency prefers to use the word

``ensure'' because it means to make certain.

O. General Comments Regarding the Prescription Drug Marketing Act of

1987 (PDMA)

15. Three comments addressed the use of handwritten signatures that

are recorded electronically (SRE's) under part 11 and PDMA. One firm

described its delivery information acquisition device and noted its use

of time stamps to record when signatures are executed. The comments

requested clarification that SRE's would be acceptable under the PDMA

regulations. One comment assumed that subpart C of part 11 (Electronic

Signatures) would not apply to SRE's, noting that it was not practical

under PDMA (given the large number of physicians who may be eligible to

receive drug product samples) to use such alternatives as

identification codes combined with passwords.

The agency advises that part 11 applies to handwritten signatures

recorded electronically and that such signatures and their

corresponding electronic records will be acceptable for purposes of

meeting PDMA's requirements when the provisions of part 11 are met.

Although subpart C of part 11 does not apply to handwritten signatures

recorded electronically, the agency advises that controls related to

electronic records (subpart B), and the general provisions of subpart

A, do apply to electronic records in the context of PDMA. The agency

emphasizes, however, that part 11 does not restrict PDMA signings to

SRE's, and that organizations retain the option of using electronic

signatures in conformance with part 11. Furthermore, the agency

believes that the number of people in a given population or

organization should not be viewed as an insurmountable obstacle to use

of electronic signatures. The agency is aware, for example, of efforts

by the American Society of Testing and Materials to develop standards

for electronic medical records in which digital signatures could

theoretically be used on a large scale.

P. Comments on the Unique Nature of Passwords

16. Several comments noted, both generally and with regard to

Secs. 11.100(a), 11.200(a), and 11.300, that the password in an

electronic signature that is composed of a combination of password and

identification code is not, and need not be, unique. Two comments added

that passwords may be known to system security administrators who

assist people who forget passwords and requested that the rule

acknowledge that passwords need not be unique. One comment said that

the rule should describe how uniqueness is to be determined.

The agency acknowledges that when an electronic signature consists

of a combined identification code and password, the password need not

be unique. It is possible that two persons in the same organization may

have the same password. However, the agency believes that where good

password practices are implemented, such coincidence would be highly

unlikely. As discussed in section XIII. of this document in the context

of comments on proposed Sec. 11.300, records are less trustworthy and

reliable if it is relatively easy for someone to deduce or execute, by

chance, a person's electronic

[[Page 13436]]

signature where the identification code of the signature is not

confidential and the password is easily guessed.

The agency does not believe that revising proposed Sec. 11.100(a)

is necessary because what must remain unique is the electronic

signature, which, in the case addressed by the comments, consists not

of the password alone, but rather the password in combination with an

identification code. If the combination is unique, then the electronic

signature is unique.

The agency does not believe that it is necessary to describe in the

regulations the various ways of determining uniqueness or achieving

compliance with the requirement. Organizations thereby maintain

implementation flexibility.

The agency believes that most system administrators or security

managers would not need to know passwords to help people who have

forgotten their own. This is because most administrators or managers

have global computer account privileges to resolve such problems.

IV. Scope (Sec. 11.1)

17. One comment suggested adding a new paragraph to proposed

Sec. 11.1 that would exempt computer record maintenance software

installed before the effective date of the final rule, and that would

exempt electronic records maintained before that date. The comment

argued that such exemptions were needed for economic and constitutional

reasons because making changes to existing systems would be costly and

because the imposition of additional requirements after the fact could

be regarded as an ex post facto rule. The comment said firms have been

using electronic systems that have demonstrated reliability and

security for many years before the agency's publication of the ANPRM,

and that the absence of FDA's objections in inspectional form FDA 483

was evidence of the agency's acceptance of the system.

As discussed in section III.I. of this document, the agency is

opposed to ``grandfathering'' existing systems because such exemptions

may perpetuate environments that provide opportunities for record

falsification and impair FDA's ability to protect and promote public

health. However, the agency wishes to avoid any confusion regarding the

application of the provisions of part 11 to systems and electronic

records in place before the rule's effective date. Important

distinctions need to be made relative to an electronic record's

creation, modification, and maintenance because various portions of

part 11 address matters relating to these actions. Those provisions

apply depending upon when a given electronic record is created,

modified, or maintained.

Electronic records created before the effective date of this rule

are not covered by part 11 provisions that relate to aspects of the

record's creation, such as the signing of the electronic record. Those

records would not, therefore, need to be altered retroactively.

Regarding records that were first created before the effective date,

part 11 provisions relating to modification of records, such as audit

trails for record changes and the requirement that original entries not

be obscured, would apply only to those modifications made on or after

the rule's effective date, not to modifications made earlier. Likewise,

maintenance provisions of part 11, such as measures to ensure that

electronic records can be retrieved throughout their retention periods,

apply to electronic records that are being maintained on or after the

rule's effective date. The hardware and software, as well as

operational procedures used on or after the rule's effective date, to

create, modify, or maintain electronic records must comply with the

provisions of part 11.

The agency does not agree with any suggestion that FDA endorsement

or acceptance of an electronic record system can be inferred from the

absence of objections in an inspection report. Before this rulemaking,

FDA did not have established criteria by which it could determine the

reliability and trustworthiness of electronic records and electronic

signatures and could not sanction electronic alternatives when

regulations called for signatures. A primary reason for issuing part 11

is to develop and codify such criteria. FDA will assess the

acceptability of electronic records and electronic signatures created

prior to the effective date of part 11 on a case-by-case basis.

18. One comment suggested that proposed Sec. 11.1 exempt production

of medical devices and in vitro diagnostic products on the grounds that

the subject was already adequately addressed in the medical device CGMP

regulations currently in effect in Sec. 820.195 (21 CFR 820.195), and

that additional regulations would be confusing and would limit

compliance.

The agency believes that part 11 complements, and is supportive of,

the medical device CGMP regulations and the new medical device quality

system regulation, as well as other regulations, and that compliance

with one does not confound compliance with others. Before publication

of the ANPRM, the agency determined that existing regulations,

including the medical device CGMP regulations, did not adequately

address electronic records and electronic signatures. That

determination was reinforced in the comments to the ANPRM, which

focused on the need to identify what makes electronic records reliable,

trustworthy, and compatible with FDA's responsibility to promote and

protect public health. For example, the provision cited by the comment,

Sec. 820.195, states ``When automated data processing is used for

manufacturing or quality assurance purposes, adequate checks shall be

designed and implemented to prevent inaccurate data output, input, and

programming errors.'' This section does not address the many issues

addressed by part 11, such as electronic signatures, record

falsification, or FDA access to electronic records. The relationship

between the quality system regulation and part 11 is discussed at

various points in the preamble to the quality system regulation.

19. One comment asserted that for purposes of PDMA, the scope of

proposed part 11 should be limited to require only those controls for

assessing signatures in paper-based systems because physicians'

handwritten signatures are executed to electronic records. The comment

further asserted that, because drug manufacturers' representatives

carry computers into physicians' offices (where the physicians then

sign sample requests and receipts), only closed system controls should

be needed.

The agency believes that, for purposes of PDMA, controls needed for

electronic records bearing handwritten signatures are no different from

controls needed for the same kinds of records and signatures used

elsewhere, and that proposed Sec. 11.1 need not make any such

distinction.

In addition, the agency disagrees with the implication that all

PDMA electronic records are, in fact, handled within closed systems.

The classification of a system as open or closed in a particular

situation depends on what is done in that situation. For example, the

agency agrees that a closed system exists where a drug producer's

representative (the person responsible for the content of the

electronic record) has control over access to the electronic record

system by virtue of possessing the portable computer and controlling

who may use the computer to sign electronic records. However, should

the firm's representative transfer copies of those records to a public

online service that stores them for the drug firm's

[[Page 13437]]

subsequent retrieval, the agency considers such transfer and storage to

be within an open system because access to the system holding the

records is controlled by the online service, which is not responsible

for the record's content. Activities in the first example would be

subject to closed system controls and activities in the second example

would be subject to open system controls.

20. One comment urged that proposed Sec. 11.1 contain a clear

statement of what precedence certain provisions of part 11 have over

other regulations.

The agency believes that such statements are found in Sec. 11.1(c):

Where electronic signatures and their associated records meet

the requirements of this part, the agency will consider the

electronic signatures to be equivalent to full handwritten

signatures, initials, and other general signings as required under

agency regulations unless specifically excepted by regulations * *

*.

and Sec. 11.1(d) (``Electronic records that meet the requirements of

this part may be used in lieu of paper records, in accordance with

Sec. 11.2, unless paper records are specifically required.''). These

provisions clearly address the precedence of part 11 and the

equivalence of electronic records and electronic signatures.

To further clarify the scope of the rule, FDA has revised Sec. 11.1

to apply to electronic records submitted to the agency under

requirements of the Federal Food, Drug, and Cosmetic Act (the act) and

the Public Health Service Act (the PHS Act). This clarifies the point

that submissions required by these statutes, but not specifically

mentioned in the Code of Federal Regulations (CFR), are subject to part

11.

21. Proposed Sec. 11.1(b) stated that the regulations would apply

to records in electronic form that are created, modified, maintained,

or transmitted, under any records requirements set forth in Chapter I

of Title 21. One comment suggested that the word ``transmitted'' be

deleted from proposed Sec. 11.1(b) because the wording would

inappropriately apply to paper documents that are transmitted by fax.

The comment noted that if the records are in machine readable form

before or after transmission, they would still be covered by the

revised wording.

The agency does not intend part 11 to apply to paper records even

if such records are transmitted or received by fax. The agency notes

that the records transmitted by fax may be in electronic form at the

sender, the recipient, or both. Part 11 would apply whenever the record

is in electronic form. To remedy the problem noted by the comment, the

agency has added a sentence to Sec. 11.1(b) stating that part 11 does

not apply to paper records that are, or have been, transmitted by

electronic means.

22. One comment asked whether paper records created by computer

would be subject to proposed part 11. The comment cited, as an example,

the situation in which a computer system collects toxicology data that

are printed out and maintained as ``raw data.''

Part 11 is intended to apply to systems that create and maintain

electronic records under FDA's requirements in Chapter I of Title 21,

even though some of those electronic records may be printed on paper at

certain times. The key to determining part 11 applicability, under

Sec. 11.1(b), is the nature of the system used to create, modify, and

maintain records, as well as the nature of the records themselves.

Part 11 is not intended to apply to computer systems that are

merely incidental to the creation of paper records that are

subsequently maintained in traditional paper-based systems. In such

cases, the computer systems would function essentially like manual

typewriters or pens and any signatures would be traditional handwritten

signatures. Record storage and retrieval would be of the traditional

``file cabinet'' variety. More importantly, overall reliability,

trustworthiness, and FDA's ability to access the records would derive

primarily from well-established and generally accepted procedures and

controls for paper records. For example, if a person were to use word

processing software to generate a paper submission to FDA, part 11

would not apply to the computer system used to generate the submission,

even though, technically speaking, an electronic record was initially

created and then printed on paper.

When records intended to meet regulatory requirements are in

electronic form, part 11 would apply to all the relevant aspects of

managing those records (including their creation, signing,

modification, storage, access, and retrieval). Thus, the software and

hardware used to create records that are retained in electronic form

for purposes of meeting the regulations would be subject to part 11.

Regarding the comment about ``raw data,'' the agency notes that

specific requirements in existing regulations may affect the particular

records at issue, regardless of the form such records take. For

example, ``raw data,'' in the context of the good laboratory practices

regulations (21 CFR part 58), include computer printouts from automated

instruments as well as the same data recorded on magnetic media. In

addition, regulations that cover data acquisition systems generally

include requirements intended to ensure the trustworthiness and

reliability of the collected data.

23. Several comments on proposed Sec. 11.1(b) suggested that the

phrase ``or archived and retrieved'' be added to paragraph (b) to

reflect more accurately a record's lifecycle.

The agency intended that record archiving and retrieval would be

part of record maintenance, and therefore already covered by

Sec. 11.1(b). However, for added clarity, the agency has revised

Sec. 11.1(b) to add ``archived and retrieved.''

24. One comment suggested that, in describing what electronic

records are within the scope of part 11, proposed Sec. 11.1(b) should

be revised by substituting ``processed'' for ``modified'' and

``communicated'' for ``transmitted'' because ``communicated'' reflects

the fact that the information was dispatched and also received. The

comment also suggested substituting ``retained'' for ``maintained,'' or

adding the word ``retained,'' because ``maintain'' does not necessarily

convey the retention requirement.

The agency disagrees. The word ``modified'' better describes the

agency's intent regarding changes to a record; the word ``processed''

does not necessarily infer a change to a record. FDA believes

``transmitted'' is preferable to ``communicated'' because

``communicated'' might infer that controls to ensure integrity and

authenticity hinge on whether the intended recipient actually received

the record. Also, as discussed in comment 22 of this document, the

agency intends for the term ``maintain'' to include records retention.

25. Two comments suggested that proposed Sec. 11.1(b) explicitly

state that part 11 supersedes all references to handwritten signatures

in 21 CFR parts 211 through 226 that pertain to a drug, and in 21 CFR

parts 600 through 680 that pertain to biological products for human

use. The comments stated that the revision should clarify coverage and

permit blood centers and transfusion services to take full advantage of

electronic systems that provide process controls.

The agency does not agree that the revision is necessary because,

under Sec. 11.1(b) and (c), part 11 permits electronic records or

submissions under all FDA regulations in Chapter I of Title 21 unless

specifically excepted by future regulations.

26. Several comments expressed concern that the proposed rule had

inappropriately been expanded in scope

[[Page 13438]]

from the ANPRM to address electronic records as well as electronic

signatures. One comment argued that the scope of part 11 should be

restricted only to those records that are currently required to be

signed, witnessed, or initialed, and that the agency should not require

electronic records to contain electronic signatures where the

corresponding paper records are not required to be signed.

The agency disagrees with the assertion that part 11 should address

only electronic signatures and not electronic records for several

reasons. First, based on comments on the ANPRM, the agency is convinced

that the reliability and trustworthiness of electronic signatures

depend in large measure on the reliability and trustworthiness of the

underlying electronic records. Second, the agency has concluded that

electronic records, like paper records, need to be trustworthy,

reliable, and compatible with FDA's responsibility to promote and

protect public health regardless of whether they are signed. In

addition, records falsification is an issue with respect to both signed

and unsigned records. Therefore, the agency concludes that although the

ANPRM focused primarily on electronic signatures, expansion of the

subject to electronic records in the proposed rule was fully justified.

The agency stresses that part 11 does not require that any given

electronic record be signed at all. The requirement that any record

bear a signature is contained in the regulation that mandates the basic

record itself. Where records are signed, however, by virtue of meeting

a signature requirement or otherwise, part 11 addresses controls and

procedures intended to help ensure the reliability and trustworthiness

of those signatures.

27. Three comments asked if there were any regulations, including

CGMP regulations, that might be excepted from part 11 and requested

that the agency identify such regulations.

FDA, at this time, has not identified any current regulations that

are specifically excepted from part 11. However, the agency believes it

is prudent to provide for such exceptions should they become necessary

in the future. It is possible that, as the agency's experience with

part 11 increases, certain records may need to be limited to paper if

there are problems with the electronic versions of such records.

28. One comment requested clarification of the meaning of the term

``general signings'' in proposed Sec. 11.1(c), and said that the

distinction between ``full handwritten'' signatures and ``initials'' is

unnecessary because handwritten includes initials in all common

definitions of handwritten signature. The comment also suggested

changing the term ``equivalent'' to ``at least equivalent'' because

electronic signatures are not precise equivalents of handwritten

signatures and computer-based signatures have the potential of being

more secure.

The agency advises that current regulations that require records to

be signed express those requirements in different ways depending upon

the agency's intent and expectations. Some regulations expressly state

that records must be signed using ``full handwritten'' signatures,

whereas other regulations state that records must be ``signed or

initialed;'' still other regulations implicitly call for some kind of

signing by virtue of requiring record approvals or endorsements. This

last broad category is addressed by the term ``general signings'' in

Sec. 11.1(c).

Where the language is explicit in the regulations, the means of

meeting the requirement are correspondingly precise. Therefore, where a

regulation states that a signature must be recorded as ``full

handwritten,'' the use of initials is not an acceptable substitute.

Furthermore, under part 11, for an electronic signature to be

acceptable in place of any of these signings, the agency only needs to

consider them as equivalent; electronic signatures need not be superior

to those other signings to be acceptable.

29. Several comments requested clarification of which FDA records

are required to be in paper form, and urged the agency to allow and

promote the use of electronic records in all cases. One comment

suggested that proposed Sec. 11.1(d) be revised to read, in part, ``* *

* unless the use of electronic records is specifically prohibited.''

The agency intends to permit the use of electronic records required

to be maintained but not submitted to the agency (as noted in

Sec. 11.2(a)) provided that the requirements of part 11 are met and

paper records are not specifically required. The agency also wishes to

encourage electronic submissions, but is limited by logistic and

resource constraints. The agency is unaware of ``maintenance records''

that are currently explicitly required to be in paper form (explicit

mention of paper is generally unnecessary because, at the time most

regulations were prepared, only paper-based technologies were in use)

but is providing for that possibility in the future. For purposes of

part 11, the agency will not consider that a regulation requires

``maintenance'' records to be in paper form where the regulation is

silent on the form the record must take. FDA believes that the

comments' suggested wording does not offer sufficient advantages to

adopt the change.

However, to enable FDA to accept as many electronic submissions as

possible, the agency is amending Sec. 11.1(b) to include those

submissions that the act and the PHS Act specifically require, even

though such submissions may not be identified in agency regulations. An

example of such records is premarket submissions for Class I and Class

II medical devices, required by section 510(k) of the act (21 U.S.C.

360(k)).

30. Several comments addressed various aspects of the proposed

requirement under Sec. 11.1(e) regarding FDA inspection of electronic

record systems. Several comments objected to the proposal as being too

broad and going beyond the agency's legal inspectional authority. One

comment stated that access inferred by such inspection may include

proprietary financial and sales data to which FDA is not entitled.

Another comment suggested adding the word ``authorized'' before

``inspection.'' Some comments suggested revising proposed Sec. 11.1(e)

to limit FDA inspection only to the electronic records and electronic

signatures themselves, thus excluding inspection of hardware and

software used to manage those records and signatures. Other comments

interpreted proposed Sec. 11.1(e) as requiring them to keep supplanted

or retired hardware and software to enable FDA inspection of those

outdated systems.

The agency advises that FDA inspections under part 11 are subject

to the same legal limitations as FDA inspections under other

regulations. The agency does not believe it is necessary to restate

that limitation by use of the suggested wording. However, within those

limitations, it may be necessary to inspect hardware and software used

to generate and maintain electronic records to determine if the

provisions of part 11 are being met. Inspection of resulting records

alone would be insufficient. For example, the agency may need to

observe the use and maintenance of tokens or devices that contain or

generate identification information. Likewise, to assess the adequacy

of systems validation, it is generally necessary to inspect hardware

that is being used to determine, among other things, if it matches the

system documentation description of such hardware. The agency has

concluded that hardware and software used to generate and maintain

electronic records and signatures are ``pertinent

[[Page 13439]]

equipment'' within the meaning of section 704 of the act (21 U.S.C.

374).

The agency does not expect persons to maintain obsolete and

supplanted computer systems for the sole purpose of enabling FDA

inspection. However, the agency does expect firms to maintain and have

available for inspection documentation relevant to those systems, in

terms of compliance with part 11, for as long as the electronic records

are required by other relevant regulations. Persons should also be

mindful of the need to keep appropriate computer systems that are

capable of reading electronic records for as long as those records must

be retained. In some instances, this may mean retention of otherwise

outdated and supplanted systems, especially where the old records

cannot be converted to a form readable by the newer systems. In most

cases, however, FDA believes that where electronic records are

accurately and completely transcribed from one system to another, it

would not be necessary to maintain older systems.

31. One comment requested that proposed part 11 be revised to give

examples of electronic records subject to FDA inspection, including

pharmaceutical and medical device production records, in order to

reduce the need for questions.

The agency does not believe that it is necessary to include

examples of records it might inspect because the addition of such

examples might raise questions about the agency's intent to inspect

other records that were not identified.

32. One comment said that the regulation should state that certain

security related information, such as private keys attendant to

cryptographic implementation, is not intended to be subject to

inspection, although procedures related to keeping such keys

confidential can be subject to inspection.

The agency would not routinely seek to inspect especially sensitive

information, such as passwords or private keys, attendant to security

systems. However, the agency reserves the right to conduct such

inspections, consistent with statutory limitations, to enforce the

provisions of the act and related statutes. It may be necessary, for

example, in investigating cases of suspected fraud, to access and

determine passwords and private keys, in the same manner as the agency

may obtain specimens of handwritten signatures (``exemplars''). Should

there be any reservations about such inspections, persons may, of

course, change their passwords and private keys after FDA inspection.

33. One comment asked how persons were expected to meet the

proposed requirement, under Sec. 11.1(e), that computer systems be

readily available for inspection when such systems include

geographically dispersed networks. Another comment said FDA

investigators should not be permitted to access industry computer

systems as part of inspections because investigators would be untrained

users.

The agency intends to inspect those parts of electronic record or

signature systems that have a bearing on the trustworthiness and

reliability of electronic records and electronic signatures under part

11. For geographically dispersed systems, inspection at a given

location would extend to operations, procedures, and controls at that

location, along with interaction of that local system with the wider

network. The agency would inspect other locations of the network in a

separate but coordinated manner, much the same way the agency currently

conducts inspections of firms that have multiple facilities in

different parts of the country and outside of the United States.

FDA does not believe it is reasonable to rule out computer system

access as part of an inspection of electronic record or signature

systems. Historically, FDA investigators observe the actions of

establishment employees, and (with the cooperation of establishment

management) sometimes request that those employees perform some of

their assigned tasks to determine the degree of compliance with

established requirements. However, there may be times when FDA

investigators need to access a system directly. The agency is aware

that such access will generally require the cooperation of and, to some

degree, instruction by the firms being inspected. As new, complex

technologies emerge, FDA will need to develop and implement new

inspectional methods in the context of those technologies.

V. Implementation (Sec. 11.2)

34. Proposed Sec. 11.2(a) stated that for ``records required by

chapter I of this title to be maintained, but not submitted to the

agency, persons may use electronic records/signatures in lieu of paper

records/conventional signatures, in whole or in part, * * *.''

Two comments requested clarification of the term ``conventional

signatures.'' One comment suggested that the term ``traditional

signatures'' be used instead. Another suggested rewording in order to

clarify the slash in the phrase ``records/signatures.''

The agency advises that the term ``conventional signature'' means

handwritten signature. The agency agrees that the term ``traditional

signature'' is preferable, and has revised Sec. 11.2(a) and (b)

accordingly. The agency has also clarified proposed Sec. 11.2(a) by

replacing the slash with the word ``or.''

35. One comment asked if the term ``persons'' in proposed

Sec. 11.2(b) would include devices because computer systems frequently

apply digital time stamps on records automatically, without direct

human intervention.

The agency advises that the term ``persons'' excludes devices. The

agency does not consider the application of a time stamp to be the

application of a signature.

36. Proposed Sec. 11.2(b)(2) provides conditions under which

electronic records or signatures could be submitted to the agency in

lieu of paper. One condition is that a document, or part of a document,

must be identified in a public docket as being the type of submission

the agency will accept in electronic form. Two comments addressed the

nature of the submissions to the public docket. One comment asked that

the agency provide specifics, such as the mechanism for updating the

docket and the frequency of such updates. One comment suggested making

the docket available to the public by electronic means. Another comment

suggested that acceptance procedures be uniform among agency units and

that electronic mail be used to hold consultations with the agency. One

comment encouraged the agency units receiving the submissions to work

closely with regulated industry to ensure that no segment of industry

is unduly burdened and that agency guidance is widely accepted.

The agency intends to develop efficient electronic records

acceptance procedures that afford receiving units sufficient

flexibility to deal with submissions according to their capabilities.

Although agencywide uniformity is a laudable objective, to attain such

flexibility it may be necessary to accommodate some differences among

receiving units. The agency considers of primary importance, however,

that all part 11 submissions be trustworthy, reliable, and in keeping

with FDA regulatory activity. The agency expects to work closely with

industry to help ensure that the mechanics and logistics of accepting

electronic submissions do not pose any undue burdens. However, the

agency expects persons to consult with the

[[Page 13440]]

intended receiving units on the technical aspects of the submission,

such as media, method of transmission, file format, archiving needs,

and technical protocols. Such consultations will ensure that

submissions are compatible with the receiving units' capabilities. The

agency has revised proposed Sec. 11.2(b)(2) to clarify this

expectation.

Regarding the public docket, the agency is not at this time

establishing a fixed schedule for updating what types of documents are

acceptable for submission because the agency expects the docket to

change and grow at a rate that cannot be predicted. The agency may,

however, establish a schedule for updating the docket in the future.

The agency agrees that making the docket available electronically is

advisable and will explore this option. Elsewhere in this issue of the

Federal Register, FDA is providing further information on this docket.

VI. Definitions (Sec. 11.3)

37. One comment questioned the incorporation in proposed

Sec. 11.3(a) of definitions under section 201 of the act (21 U.S.C.

321), noting that other FDA regulations (such as 21 CFR parts 807 and

820) lack such incorporation, and suggested that it be deleted.

The agency has retained the incorporation by reference to

definitions under section 201 of the act because those definitions are

applicable to part 11.

38. One comment suggested adding the following definition for the

term ``digital signature:'' ``data appended to, or a cryptographic

transformation of, a data unit that allows a recipient of the data unit

to prove the source and integrity of the data unit and protect against

forgery, e.g., by the recipient.''

The agency agrees that the term digital signature should be defined

and has added new Sec. 11.3(b)(5) to provide a definition for digital

signature that is consistent with the Federal Information Processing

Standard 186, issued May 19, 1995, and effective December 1, 1995, by

the U.S. Department of Commerce, National Institute of Standards and

Technology (NIST). Generally, a digital signature is ``an electronic

signature based upon cryptographic methods of originator

authentication, computed by using a set of rules and a set of

parameters such that the identity of the signer and the integrity of

the data can be verified.'' FDA advises that the set of rules and

parameters is established in each digital signature standard.

39. Several comments suggested various modifications of the

proposed definition of biometric/behavioral links, and suggested

revisions that would exclude typing a password or identification code

which, the comments noted, is a repeatable action. The comments

suggested that actions be unique and measurable to meet the intent of a

biometric method.

The agency agrees that the proposed definition of biometric/

behavioral links should be revised to clarify the agency's intent that

repetitive actions alone, such as typing an identification code and

password, are not considered to be biometric in nature. Because

comments also indicated that it would be preferable to simplify the

term, the agency is changing the term ``biometric/behavioral link'' to

``biometrics.'' Accordingly, Sec. 11.3(b)(3) defines the term

``biometrics'' to mean ``a method of verifying an individual's identity

based on measurement of the individual's physical feature(s) or

repeatable action(s) where those features and/or actions are both

unique to that individual and measurable.''

40. One comment said that the agency should identify what biometric

methods are acceptable to verify a person's identity and what

validation acceptance criteria the agency has used to determine that

biometric technologies are superior to other methods, such as use of

identification codes and passwords.

The agency believes that there is a wide variety of acceptable

technologies, regardless of whether they are based on biometrics, and

regardless of the particular type of biometric mechanism that may be

used. Under part 11, electronic signatures that employ at least two

distinct identification components such as identification codes and

passwords, and electronic signatures based on biometrics are equally

acceptable substitutes for traditional handwritten signatures.

Furthermore, all electronic record systems are subject to the same

requirements of subpart B of part 11 regardless of the electronic

signature technology being used. These provisions include requirements

for validation.

Regarding the comment's suggestion that FDA apply quantitative

acceptance criteria, the agency is not seeking to set specific

numerical standards or statistical performance criteria in determining

the threshold of acceptability for any type of technology. If such

standards were to be set for biometrics-based electronic signatures,

similar numerical performance and reliability requirements would have

to be applied to other technologies as well. The agency advises,

however, that the differences between system controls for biometrics-

based electronic signatures and other electronic signatures are a

result of the premise that biometrics-based electronic signatures, by

their nature, are less prone to be compromised than other methods such

as identification codes and passwords. Should it become evident that

additional controls are warranted for biometrics-based electronic

signatures, the agency will propose to revise part 11 accordingly.

41. Proposed Sec. 11.3(b)(4) defined a closed system as an

environment in which there is communication among multiple persons, and

where system access is restricted to people who are part of the

organization that operates the system.

Many comments requested clarification of the term ``organization''

and stated that the rule should account for persons who, though not

strictly employees of the operating organization, are nonetheless

obligated to it in some manner, or who would otherwise be granted

system access by the operating organization. As examples of such

persons, the comments cited outside contractors, suppliers, temporary

employees, and consultants. The comments suggested a variety of

alternative wording, including a change of emphasis from organizational

membership to organizational control over system access. One comment

requested clarification of whether the rule intends to address specific

disciplines within a company.

Based on the comments, the agency has revised the proposed

definition of closed system to state ``an environment in which system

access is controlled by persons who are responsible for the content of

electronic records that are on the system.'' The agency agrees that the

most important factor in classifying a system as closed or open is

whether the persons responsible for the content of the electronic

records control access to the system containing those records. A system

is closed if access is controlled by persons responsible for the

content of the records. If those persons do not control such access,

then the system is open because the records may be read, modified, or

compromised by others to the possible detriment of the persons

responsible for record content. Hence, those responsible for the

records would need to take appropriate additional measures in an open

system to protect those records from being read, modified, destroyed,

or otherwise compromised by unauthorized and potentially unknown

parties. The agency does not believe it is necessary to codify the

basis or criteria for authorizing system access, such as existence of a

fiduciary

[[Page 13441]]

responsibility or contractual relationship. By being silent on such

criteria, the rule affords maximum flexibility to organizations by

permitting them to determine those criteria for themselves.

42. Concerning the proposed definition of closed system, one

comment suggested adding the words ``or devices'' after ``persons''

because communications may involve nonhuman entities.

The agency does not believe it is necessary to adopt the suggested

revision because the primary intent of the regulation is to address

communication among humans, not devices.

43. One comment suggested defining a closed system in terms of

functional characteristics that include physical access control, having

professionally written and approved procedures with employees and

supervisors trained to follow them, conducting investigations when

abnormalities may have occurred, and being under legal obligation to

the organization responsible for operating the system.

The agency agrees that the functional characteristics cited by the

comment are appropriate for a closed system, but has decided that it is

unnecessary to include them in the definition. The functional

characteristics themselves, however, such as physical access controls,

are expressed as requirements elsewhere in part 11.

44. Two comments said that the agency should regard as closed a

system in which dial-in access via public phone lines is permitted, but

where access is authorized by, and under the control of, the

organization that operates the system.

The agency advises that dial-in access over public phone lines

could be considered part of a closed system where access to the system

that holds the electronic records is under the control of the persons

responsible for the content of those records. The agency cautions,

however, that, where an organization's electronic records are stored on

systems operated by third parties, such as commercial online services,

access would be under control of the third parties and the agency would

regard such a system as being open. The agency also cautions that, by

permitting access to its systems by public phone lines, organizations

lose the added security that results from restricting physical access

to computer terminal and other input devices. In such cases, the agency

believes firms would be prudent to implement additional security

measures above and beyond those controls that the organization would

use if the access device was within its facility and commensurate with

the potential consequences of such unauthorized access. Such additional

controls might include, for example, use of input device checks, caller

identification checks (phone caller identification), call backs, and

security cards.

45. Proposed Sec. 11.3(b)(5) defined electronic record as a

document or writing comprised of any combination of text, graphic

representation, data, audio information, or video information, that is

created, modified, maintained, or transmitted in digital form by a

computer or related system. Many comments suggested revising the

proposed definition to reflect more accurately the nature of electronic

records and how they differ from paper records. Some comments suggested

distinguishing between machine readable records and paper records

created by machine. Some comments noted that the term ``document or

writing'' is inappropriate for electronic records because electronic

records could be any combination of pieces of information assembled

(sometimes on a transient basis) from many noncontiguous places, and

because the term does not accurately describe such electronic

information as raw data or voice mail. Two comments suggested that the

agency adopt definitions of electronic record that were established,

respectively, by the United Nations Commission on International Trade

Law (UNCITRAL) Working Group on Electronic Data Interchange, and the

American National Standards Institute/Institute of Electrical and

Electronic Engineers Software Engineering (ANSI/IEEE) Standard (729-

1983).

The agency agrees with the suggested revisions and has revised the

definition of ``electronic record'' to emphasize this unique nature and

to clarify that the agency does not regard a paper record to be an

electronic record simply because it was created by a computer system.

The agency has removed ``document or writing'' from this definition and

elsewhere in part 11 for the sake of clarity, simplicity, and

consistency.

However, the agency believes it is preferable to adapt or modify

the words ``document'' and ``writing'' to electronic technologies

rather than discard them entirely from the lexicon of computer

technology. The agency is aware that the terms ``document'' and

``electronic document'' are used in contexts that clearly do not intend

to describe paper. Therefore, the agency considers the terms

``electronic record'' and ``electronic document'' to be generally

synonymous and may use the terms ``writing,'' ``electronic document,''

or ``document'' in other publications to describe records in electronic

form. The agency believes that such usage is a prudent conservation of

language and is consistent with the use of other terms and expressions

that have roots in older technologies, but have nonetheless been

adapted to newer technologies. Such terms include telephone

``dialing,'' internal combustion engine ``horse power,'' electric light

luminance expressed as ``foot candles,'' and (more relevant to computer

technology) execution of a ``carriage return.''

Accordingly, the agency has revised the definition of electronic

record to mean ``any combination of text, graphics, data, audio,

pictorial, or other information representation in digital form that is

created, modified, maintained, archived, retrieved, or distributed by a

computer system.''

46. Proposed Sec. 11.3(b)(6) defined an electronic signature as the

entry in the form of a magnetic impulse or other form of computer data

compilation of any symbol or series of symbols, executed, adopted or

authorized by a person to be the legally binding equivalent of the

person's handwritten signature. One comment supported the definition as

proposed, noting its consistency with dictionary definitions (Random

House Dictionary of the English Language, Unabridged Ed. 1983, and

American Heritage Dictionary, 1982). Several other comments, however,

suggested revisions. One comment suggested replacing ``electronic

signature'' with ``computer based signature,'' ``authentication,'' or

``computer based authentication'' because ``electronic signature'' is

imprecise and lacks clear and recognized meaning in the information

security and legal professions. The comment suggested a definition

closer to the UNCITRAL draft definition:

(1) [a] method used to identify the originator of the data

message and to indicate the originator's approval of the information

contained therein; and (2) that method is as reliable as was

appropriate for the purpose for which the data message was generated

or communicated, in the light of all circumstances, including any

agreement between the originator and the addressee of the data

message.

One comment suggested replacing ``electronic signature'' with

``electronic identification'' or ``electronic authorization'' because

the terms include many types of technologies that are not easily

distinguishable and because the preamble to the proposed rule gave a

rationale for using ``electronic signature'' that was too ``esoteric

for practical consideration.''

[[Page 13442]]

The agency disagrees that ``electronic signature'' as proposed

should be replaced with other terms and definitions. As noted in the

preamble to the proposed rule, the agency believes that it is vital to

retain the word ``signature'' to maintain the equivalence and

significance of various electronic technologies with the traditional

handwritten signature. By not using the word ``signature,'' people may

treat the electronic alternatives as less important, less binding, and

less in need of controls to prevent falsification. The agency also

believes that use of the word signature provides a logical bridge

between paper and electronic technologies that facilitates the general

transition from paper to electronic environments. The term helps people

comply with current FDA regulations that specifically call for

signatures. Nor does the agency agree that this reasoning is beyond the

reach of practical consideration.

The agency declines to accept the suggested UNCITRAL definition

because it is too narrow in context in that there is not always a

specified message addressee for electronic records required by FDA

regulations (e.g., a batch production record does not have a specific

``addressee'').

47. Concerning the proposed definition of ``electronic signature,''

other comments suggested deletion of the term ``magnetic impulse'' to

render the term media neutral and thus allow for such alternatives as

an optical disk. Comments also suggested that the term ``entry'' was

unclear and recommended its deletion. Two comments suggested revisions

that would classify symbols as an electronic signature only when they

are committed to permanent storage because not every computer entry is

a signature and processing to permanent storage must occur to indicate

completion of processing.

The agency advises that the proposal did not limit electronic

signature recordings to ``magnetic impulse'' because the proposed

definition added, ``or other form of computer data * * *.'' However, in

keeping with the agency's intent to accept a broad range of

technologies, the terms ``magnetic impulse'' and ``entry'' have been

removed from the proposed definition. The agency believes that

recording of computer data to ``permanent'' storage is not a necessary

or warranted qualifier because it is not relevant to the concept of

equivalence to a handwritten signature. In addition, use of the

qualifier regarding permanent storage could impede detection of

falsified records if, for example, the signed falsified record was

deleted after a predetermined period (thus, technically not recorded to

``permanent'' storage). An individual could disavow a signature because

the record had ceased to exist.

For consistency with the proposed definition of handwritten

signature, and to clarify that electronic signatures are those of

individual human beings, and not those of organizations (as included in

the act's definition of ``person''), FDA is changing ``person'' to

``individual'' in the final rule.

Accordingly, Sec. 11.3(b)(7) defines electronic signature as a

computer data compilation of any symbol or series of symbols executed,

adopted, or authorized by an individual to be the legally binding

equivalent of the individual's handwritten signature.

48. Proposed Sec. 11.3(b)(7) (redesignated Sec. 11.3(b)(8) in the

final rule) defined ``handwritten signature'' as the name of an

individual, handwritten in script by that individual, executed or

adopted with the present intention to authenticate a writing in a

permanent form. The act of signing with a writing or marking instrument

such as a pen or stylus is preserved. The proposed definition also

stated that the scripted name, while conventionally applied to paper,

may also be applied to other devices which capture the written name.

Many comments addressed this proposed definition. Two comments

suggested that it be deleted on the grounds it is redundant and that,

when handwritten signatures are recorded electronically, the result

fits the definition of electronic signature.

The agency disagrees that the definition of handwritten signature

should be deleted. In stating the criteria under which electronic

signatures may be used in place of traditional handwritten signatures,

the agency believes it is necessary to define handwritten signature. In

addition, the agency believes that it is necessary to distinguish

handwritten signatures from electronic signatures because, with

handwritten signatures, the traditional act of signing one's name is

preserved. Although the handwritten signature recorded electronically

and electronic signatures, as defined in part 11, may both ultimately

result in magnetic impulses or other forms of computerized symbol

representations, the means of achieving those recordings and, more

importantly, the controls needed to ensure their reliability and

trustworthiness are quite different. In addition, the agency believes

that a definition for handwritten signature is warranted to accommodate

persons who wish to implement record systems that are combinations of

paper and electronic technologies.

49. Several comments suggested replacing the reference to

``scripted name'' in the proposed definition of handwritten signature

with ``legal mark'' so as to accommodate individuals who are physically

unable to write their names in script. The comments asserted that the

term ``legal mark'' would bring the definition to closer agreement with

generally recognized legal interpretations of signature.

The agency agrees and has added the term ``legal mark'' to the

definition of handwritten signature.

50. One comment recommended that the regulation state that, when

the handwritten signature is not the result of the act of signing with

a writing or marking instrument, but is applied to another device that

captures the written name, a system should verify that the owner of the

signature has authorized the use of the handwritten signature.

The agency declines to accept this comment because, if the act of

signing or marking is not preserved, the type of signature would not be

considered a handwritten signature. The comment appears to be referring

to instances in which one person authorizes someone else to use his or

her stamp or device. The agency views this as inappropriate when the

signed record does not clearly show that the stamp owner did not

actually execute the signature. As discussed elsewhere in this

preamble, the agency believes that where one person authorizes another

to sign a document on his or her behalf, the second person must sign

his or her own name (not the name of the first person) along with some

notation that, in doing so, he or she is acting in the capacity, or on

behalf, of the first person.

51. One comment suggested that where handwritten signatures are

captured by devices, there should be a register of manually written

signatures to enable comparison for authenticity and the register also

include the typed names of individuals.

The agency agrees that the practice of establishing a signature

register has merit, but does not believe that it is necessary, in light

of other part 11 controls. As noted elsewhere in this preamble (in the

discussion of proposed Sec. 11.50), the agency agrees that human

readable displays of electronic records must display the name of the

signer.

52. Several comments suggested various editorial changes to the

proposed definition of handwritten signature including: (1) Changing

the word ``also'' in the last sentence to ``alternatively,'' (2)

clarifying the

[[Page 13443]]

difference between the words ``individual'' and ``person,'' (3)

deleting the words ``in a permanent form,'' and (4) changing

``preserved'' to ``permitted.'' One comment asserted that the last

sentence of the proposed definition was unnecessary.

The agency has revised the definition of handwritten signature to

clarify its intent and to keep the regulation as flexible as possible.

The agency believes that the last sentence of the proposed definition

is needed to address devices that capture handwritten signatures. The

agency is not adopting the suggestion that the word ``preserved'' be

changed to ``permitted'' because ``preserved'' more accurately states

the agency's intent and is a qualifier to help distinguish handwritten

signatures from others. The agency advises that the word ``individual''

is used, rather than ``person,'' because the act's definition of person

extends beyond individual human beings to companies and partnerships.

The agency has retained the term ``permanent'' to discourage the use of

pencils, but recognizes that ``permanent'' does not mean eternal.

53. One comment asked whether a signature that is first handwritten

and then captured electronically (e.g., by scanning) is an electronic

signature or a handwritten signature, and asked how a handwritten

signature captured electronically (e.g., by using a stylus-sensing pad

device) that is affixed to a paper copy of an electronic record would

be classified.

FDA advises that when the act of signing with a stylus, for

example, is preserved, even when applied to an electronic device, the

result is a handwritten signature. The subsequent printout of the

signature on paper would not change the classification of the original

method used to execute the signature.

54. One comment asserted that a handwritten signature recorded

electronically should be considered to be an electronic signature,

based on the medium used to capture the signature. The comment argued

that the word signature should be limited to paper technology.

The agency disagrees and believes it is important to classify a

signature as handwritten based upon the preserved action of signing

with a stylus or other writing instrument.

55. One comment asked if the definition of handwritten signature

encompasses handwritten initials.

The agency advises that, as revised, the definition of handwritten

signature includes handwritten initials if the initials constitute the

legal mark executed or adopted with the present intention to

authenticate a writing in a permanent form, and where the method of

recording such initials involves the act of writing with a pen or

stylus.

56. Proposed Sec. 11.3(b)(8) (redesignated as Sec. 11.3(b)(9) in

the final rule) defined an open system as an environment in which there

is electronic communication among multiple persons, where system access

extends to people who are not part of the organization that operates

the system.

Several comments suggested that, for simplicity, the agency define

``open system'' as any system that does not meet the definition of a

closed system. One comment suggested that the definition be deleted on

the grounds it is redundant, and that it is the responsibility of

individual firms to take appropriate steps to ensure the validity and

security of applications and information, regardless of whether systems

are open or closed. Other comments suggested definitions of ``open

system'' that were opposite to what they suggested for a closed system.

The agency has revised the definition of open system to mean ``an

environment in which system access is not controlled by persons who are

responsible for the content of electronic records that are on the

system.'' The agency believes that, for clarity, the definition should

stand on its own rather than as any system that is not closed. The

agency rejects the suggestion that the term need not be defined at all

because FDA believes that controls for open systems merit distinct

provisions in part 11 and defining the term is basic to understanding

which requirements apply to a given system. The agency agrees that

companies have the responsibility to take steps to ensure the validity

and security of their applications and information. However, FDA finds

it necessary to establish part 11 as minimal requirements to help

ensure that those steps are, in fact, acceptable.

VII. Electronic Records--Controls for Closed Systems (Sec. 11.10)

The introductory paragraph of proposed Sec. 11.10 states that:

Closed systems used to create, modify, maintain, or transmit

electronic records shall employ procedures and controls designed to

ensure the authenticity, integrity, and confidentiality of

electronic records, and to ensure that the signer cannot readily

repudiate the signed record as not genuine. * * *

The rest of the section lists specific procedures and controls.

57. One comment expressed full support for the list of proposed

controls, calling them generally appropriate and stated that the agency

is correctly accommodating the fluid nature of various electronic

record and electronic signature technologies. Another comment, however,

suggested that controls should not be implemented at the time

electronic records are first created, but rather only after a document

is accepted by a company.

The agency disagrees with this suggestion. To ignore such controls

at a stage before official acceptance risks compromising the record.

For example, if ``preacceptance'' records are signed by technical

personnel, it is vital to ensure the integrity of their electronic

signatures to prevent record alteration. The need for such integrity is

no less important at preacceptance stages than at later stages when

managers officially accept the records. The possibility exists that

some might seek to disavow, or avoid FDA examination of, pertinent

records by declaring they had not been formally ``accepted.'' In

addition, FDA routinely can and does inspect evolving paper documents

(e.g., standard operating procedures and validation protocols) even

though they have yet to receive a firm's final acceptance.

58. One comment said proposed Sec. 11.10 contained insufficient

requirements for firms to conduct periodic inspection and monitoring of

their own systems and procedures to ensure compliance with the

regulations. The comment also called for a clear identification of the

personnel in a firm who would be responsible for system implementation,

operation, change control, and monitoring.

The agency does not believe it is necessary at this time to codify

a self-auditing requirement, as suggested by the comment. Rather, the

agency intends to afford organizations flexibility in establishing

their own internal mechanisms to ensure compliance with part 11. Self-

audits, however, may be considered as a general control, within the

context of the introductory paragraph of Sec. 11.10. The agency

encourages firms to conduct such audits periodically as part of an

overall approach to ensure compliance with FDA regulations generally.

Likewise, the agency does not believe it is necessary or practical to

codify which individuals in an organization should be responsible for

compliance with various provisions of part 11. However, ultimate

responsibility for part 11 will generally rest with persons responsible

for electronic record content, just as responsibility for compliance

with paper record requirements generally lies with those responsible

for the record's content.

[[Page 13444]]

59. Several comments interpreted proposed Sec. 11.10 as applying

all procedures and controls to closed systems and suggested revising it

to permit firms to apply only those procedures and controls they deem

necessary for their own operations, because some requirements are

excessive in some cases.

The agency advises that, where a given procedure or control is not

intended to apply in all cases, the language of the rule so indicates.

Specifically, use of operational checks (Sec. 11.10(f)) and device

checks (Sec. 11.10(h)) is not required in all cases. The remaining

requirements do apply in all cases and are, in the agency's opinion,

the minimum needed to ensure the trustworthiness and reliability of

electronic record systems. In addition, certain controls that firms

deem adequate for their routine internal operations might nonetheless

leave records vulnerable to manipulation and, thus, may be incompatible

with FDA's responsibility to protect public health. The suggested

revision would effectively permit firms to implement various controls

selectively and possibly shield records from FDA, employ unqualified

personnel, or permit employees to evade responsibility for fraudulent

use of their electronic signatures.

The agency believes that the controls in Sec. 11.10 are vital, and

notes that almost all of them were suggested by comments on the ANPRM.

The agency believes the wording of the regulation nonetheless permits

firms maximum flexibility in how to meet those requirements.

60. Two comments suggested that the word ``confidentiality'' in the

introductory paragraph of proposed Sec. 11.10 be deleted because it is

unnecessary and inappropriate. The comments stated that firms should

determine if certain records need to be confidential, and that as long

as records could not be altered or deleted without appropriate

authority, it would not matter whether they could read the records.

The agency agrees that not all records required by FDA need to be

kept confidential within a closed system and has revised the reference

in the introductory paragraph of Sec. 11.10 to state ``* * * and, when

appropriate, the confidentiality of electronic records.'' The agency

believes, however that the need for retaining the confidentiality of

certain records is not diminished because viewers cannot change them.

It may be prudent for persons to carefully assess the need for record

confidentiality. (See, e.g., 21 CFR 1002.42, Confidentiality of records

furnished by dealers and distributors, with respect to certain

radiological health products.) In addition, FDA's obligation to retain

the confidentiality of information it receives in some submissions

hinges on the degree to which the submitter maintains confidentiality,

even within its own organization. (See, e.g., 21 CFR 720.8(b) with

respect to cosmetic ingredient information in voluntary filings of

cosmetic product ingredient and cosmetic raw material composition

statements.)

61. One comment asked if the procedures and controls required by

proposed Sec. 11.10 were to be built into software or if they could

exist in written form.

The agency expects that, by their nature, some procedures and

controls, such as use of time-stamped audit trails and operational

checks, will be built into hardware and software. Others, such as

validation and determination of personnel qualifications, may be

implemented in any appropriate manner regardless of whether the

mechanisms are driven by, or are external to, software or hardware. To

clarify this intent, the agency has revised the introductory paragraph

of proposed Sec. 11.10 to read, in part, ``Persons who use closed

systems to create, modify * * *.'' Likewise, for clarity and

consistency, the agency is introducing the same phrase, ``persons who

use * * *'' in Secs. 11.30 and 11.300.

62. One comment contended that the distinction between open and

closed systems should not be predominant because a $100,000 transaction

in a closed system should not have fewer controls than a $1 transaction

in an open system.

The agency believes that, within part 11, firms have the

flexibility they need to adjust the extent and stringency of controls

based on any factors they choose, including the economic value of the

transaction. The agency does not believe it is necessary to modify part

11 at this time so as to add economic criteria.

63. One comment suggested that the reference to repudiation in the

introductory paragraph of Sec. 11.10 should be deleted because

repudiation can occur at any time in legal proceedings. Another

comment, noting that the proposed rule appeared to address only

nonrepudiation of a signer, said the rule should address nonrepudiation

of record ``genuineness'' or extend to nonrepudiation of submission,

delivery, and receipt. The comment stated that some firms provide

nonrepudiation services that can prevent someone from successfully

claiming that a record has been altered.

In response to the first comment, the agency does not agree that

the reference to repudiation should be deleted because reducing the

likelihood that someone can readily repudiate an electronic signature

as not his or her own, or that the signed record had been altered, is

vital to the agency's basic acceptance of electronic signatures. The

agency is aware that the need to deter such repudiation has been

addressed in many forums and publications that discuss electronic

signatures. Absent adequate controls, FDA believes some people would be

more likely to repudiate an electronically-signed record because of the

relative ease with which electronic records may be altered and the ease

with which one individual could impersonate another. The agency notes,

however, that the rule does not call for nonrepudiation as an absolute

guarantee, but requires that the signer cannot ``readily'' repudiate

the signature.

In response to the second comment, the agency agrees that it is

also important to establish nonrepudiation of submission, delivery, and

receipt of electronic records, but advises that, for purposes of

Sec. 11.10, the agency's intent is to limit nonrepudiation to the

genuineness of the signer's record. In other words, an individual

should not be able to readily say that: (1) He or she did not, in fact,

sign the record; (2) a given electronic record containing the

individual's signature was not, in fact, the record that the person

signed; or (3) the originally signed electronic record had been altered

after having been signed.

64. Proposed Sec. 11.10(a) states that controls for closed systems

are to include the validation of systems to ensure accuracy,

reliability, consistent intended performance, and the ability to

conclusively discern invalid or altered records.

Many comments objected to this proposed requirement because the

word ``conclusively'' inferred an unreasonably high and unattainable

standard, one which is not applied to paper records.

The agency intends to apply the same validation concepts and

standards to electronic record and electronic signature systems as it

does to paper systems. As such, FDA does not intend the word

``conclusively'' to suggest an unattainable absolute and has,

therefore, deleted the word from the final rule.

65. One comment suggested qualifying the proposed validation

requirement in Sec. 11.10(a) to state that validation be performed

``where

[[Page 13445]]

necessary'' and argued that validation of commercially available

software is not necessary because such software has already been

thoroughly validated. The comment acknowledged that validation may be

required for application programs written by manufacturers and others

for special needs.

The agency disagrees with the comment's claim that all commercial

software has been validated. The agency believes that commercial

availability is no guarantee that software has undergone ``thorough

validation'' and is unaware of any regulatory entity that has

jurisdiction over general purpose software producers. The agency notes

that, in general, commercial software packages are accompanied not by

statements of suitability or compliance with established standards, but

rather by disclaimers as to their fitness for use. The agency is aware

of the complex and sometimes controversial issues in validating

commercial software. However, the need to validate such software is not

diminished by the fact that it was not written by those who will use

the software.

In the future, the agency may provide guidance on validation of

commercial software used in electronic record systems. FDA has

addressed the matter of software validation in general in such

documents as the ``Draft Guideline for the Validation of Blood

Establishment Computer Systems,'' which is available from the

Manufacturers Assistance and Communications Staff, Center for Biologics

Evaluation and Research (HFM-42), Food and Drug Administration, 1401

Rockville Pike, Rockville, MD 20852-1448, 301-594-2000. This guideline

is also available by sending e-mail to the following Internet address:

[email protected]). For the purposes of part 11, however, the

agency believes it is vital to retain the validation requirement.

66. One comment requested an explanation of what was meant by the

phrase ``consistent intended'' in proposed Sec. 11.10(a) and why

``consistent performance'' was not used instead. The comment suggested

that the rule should distinguish consistent intended performance from

well-recognized service ``availability.''

The agency advises that the phrase ``consistent intended

performance'' relates to the general principle of validation that

planned and expected performance is based upon predetermined design

specifications (hence, ``intended''). This concept is in accord with

the agency's 1987 ``Guideline on General Principles of Process

Validation,'' which is available from the Division of Manufacturing and

Product Quality, Center for Drug Evaluation and Research (HFD-320),

Food and Drug Administration, 7520 Standish Pl., Rockville, MD 20855,

301-594-0093). This guideline defines validation as establishing

documented evidence that provides a high degree of assurance that a

specific process will consistently produce a product meeting its

predetermined specifications and quality attributes. The agency

believes that the comment's concepts are accommodated by this

definition to the extent that system ``availability'' may be one of the

predetermined specifications or quality attributes.

67. One comment said the rule should indicate whether validation of

systems does, or should, require any certification or accreditation.

The agency believes that although certification or accreditation

may be a part of validation of some systems, such certification or

accreditation is not necessary in all cases, outside of the context of

any such approvals within an organization itself. Therefore, part 11 is

silent on the matter.

68. One comment said the rule should clarify whether system

validation should be capable of discerning the absence of electronic

records, in light of agency concerns about falsification. The comment

added that the agency's concerns regarding invalid or altered records

can be mitigated by use of cryptographically enhanced methods,

including secure time and date stamping.

The agency does not believe that it is necessary at this time to

include an explicit requirement that systems be capable of detecting

the absence of records. The agency advises that the requirement in

Sec. 11.10(e) for audit trails of operator actions would cover those

actions intended to delete records. Thus, the agency would expect firms

to document such deletions, and would expect the audit trail mechanisms

to be included in the validation of the electronic records system.

69. Proposed Sec. 11.10(b) states that controls for closed systems

must include the ability to generate true copies of records in both

human readable and electronic form suitable for inspection, review, and

copying by the agency, and that if there were any questions regarding

the ability of the agency to perform such review and copying, persons

should contact the agency.

Several comments objected to the requirement for ``true'' copies of

electronic records. The comments asserted that information in an

original record (as may be contained in a database) may be presented in

a copy in a different format that may be more usable. The comments

concluded that, to generate precise ``true'' copies of electronic

records, firms may have to retain the hardware and software that had

been used to create those records in the first place (even when such

hardware and software had been replaced by newer systems). The comments

pointed out that firms may have to provide FDA with the application

logic for ``true'' copies, and that this may violate copyright

provisions. One comment illustrated the difference between ``true''

copies and other equally reliable, but not exact, copies of electronic

records by noting that pages from FDA's paper publications (such as the

CFR and the Compliance Policy Guidance Manual) look quite different

from electronic copies posted to FDA's bulletin board. The comments

suggested different wording that would effectively require accurate and

complete copies, but not necessarily ``true'' copies.

The agency agrees that providing exact copies of electronic records

in the strictest meaning of the word ``true'' may not always be

feasible. The agency nonetheless believes it is vital that copies of

electronic records provided to FDA be accurate and complete.

Accordingly, in Sec. 11.10(b), ``true'' has been replaced with

``accurate and complete.'' The agency expects that this revision should

obviate the potential problems noted in the comments. The revision

should also reduce the costs of providing copies by making clear that

firms need not maintain obsolete equipment in order to make copies that

are ``true'' with respect to format and computer system.

70. Many comments objected to the proposed requirement that systems

be capable of generating electronic copies of electronic records for

FDA inspection and copying, although they generally agreed that it was

appropriate to provide FDA with readable paper copies. Alternative

wording was suggested that would make providing electronic copies

optional, such that persons could provide FDA with nothing but paper

copies if they so wished. The comments argued that providing FDA with

electronic copies was unnecessary, unjustified, not practical

considering the different types of computer systems that may be in use,

and would unfairly limit firms in their selection of hardware and

software if they could only use systems that matched FDA's capabilities

(capabilities which, it was argued, would not be uniform throughout the

United States). One comment suggested that the rule specify

[[Page 13446]]

a particular format, such as ASCII, for electronic copies to FDA.

The agency disagrees with the assertion that FDA need only be

provided with paper copies of electronic records. To operate

effectively, the agency must function on the same technological plane

as the industries it regulates. Just as firms realize efficiencies and

benefits in the use of electronic records, FDA should be able to

conduct audits efficiently and thoroughly using the same technology.

For example, where firms perform computerized trend analyses of

electronic records to improve their processes, FDA should be able to

use computerized methods to audit electronic records (on site and off,

as necessary) to detect trends, inconsistencies, and potential problem

areas. If FDA is restricted to reviewing only paper copies of those

records, the results would severely impede its operations. Inspections

would take longer to complete, resulting in delays in approvals of new

medical products, and expenditure of additional resources both by FDA

(in performing the inspections and transcribing paper records to

electronic format) and by the inspected firms, which would generate the

paper copies and respond to questions during the resulting lengthened

inspections.

The agency believes that it also may be necessary to require that

persons furnish certain electronic copies of electronic records to FDA

because paper copies may not be accurate and complete if they lack

certain audit trail (metadata) information. Such information may have a

direct bearing on record trustworthiness and reliability. These data

could include information, for example, on when certain items of

electronic mail were sent and received.

The agency notes that people who use different computer systems

routinely provide each other with electronic copies of electronic

records, and there are many current and developing tools to enable such

sharing. For example, at a basic level, records may be created in, or

transferred to, the ASCII format. Many different commercial programs

have the capability to import from, and export to, electronic records

having different formats. Firms use electronic data interchange

(commonly known as EDI) and agreed upon transaction set formats to

enable them to exchange copies of electronic records effectively. Third

parties are also developing portable document formats to enable

conversion among several diverse formats.

Concerning the ability of FDA to handle different formats of

electronic records, based upon the emergence of format conversion tools

such as those mentioned above, the agency's experience with electronic

submissions such as computer assisted new drug applications (commonly

known as CANDA's), and the agency's planned Submissions Management and

Review Tracking System (commonly known as SMART), FDA is confident that

it can work with firms to minimize any formatting difficulties. In

addition, substitution of the words ``accurate and complete'' for

``true,'' as discussed in comment 69, should make it easier for firms

to provide FDA with electronic copies of their electronic records. FDA

does not believe it is necessary to specify any particular format in

part 11 because it prefers, at this time, to afford industry and the

agency more flexibility in deciding which formats meet the capabilities

of all parties. Accordingly, the agency has revised proposed

Sec. 11.10(b) to read:

The ability to generate accurate and complete copies of records

in both human readable and electronic form suitable for inspection,

review, and copying by the agency. Persons should contact the agency

if there are any questions regarding the ability of the agency to

perform such review and copying of the electronic records.

71. Proposed Sec. 11.10(c) states that procedures and controls for

closed systems must include the protection of records to enable their

accurate and ready retrieval throughout the records retention period.

One firm commented that, because it replaces systems often (about

every 3 years), it may have to retain supplanted systems to meet these

requirements. Another comment suggested that the rule be modified to

require records retention only for as long as ``legally mandated.''

The agency notes that, as discussed in comment 70 of this document,

persons would not necessarily have to retain supplanted hardware and

software systems provided they implemented conversion capabilities when

switching to replacement technologies. The agency does not believe it

is necessary to add the qualifier ``legally mandated'' because the

retention period for a given record will generally be established by

the regulation that requires the record. Where the regulations do not

specify a given time, the agency would expect firms to establish their

own retention periods. Regardless of the basis for the retention

period, FDA believes that the requirement that a given electronic

record be protected to permit it to be accurately and readily retrieved

for as long as it is kept is reasonable and necessary.

72. Proposed Sec. 11.10(e) would require the use of time-stamped

audit trails to document record changes, all write-to-file operations,

and to independently record the date and time of operator entries and

actions. Record changes must not obscure previously recorded

information and such audit trail documentation must be retained for a

period at least as long as required for the subject electronic

documents and must be available for agency review and copying.

Many comments objected to the proposed requirement that all write-

to-file operations be documented in the audit trail because it is

unnecessary to document all such operations. The comments said that

this would require audit trails for such automated recordings as those

made to internal buffers, data swap files, or temporary files created

by word processing programs. The comments suggested revising

Sec. 11.10(e) to require audit trails only for operator entries and

actions.

Other comments suggested that audit trails should cover: (1)

Operator data inputs but not actions, (2) only operator changes to

records, (3) only critical write-to-file information, (4) operator

changes as well as all actions, (5) only new entries, (6) only systems

where data can be altered, (7) only information recorded by humans, (8)

information recorded by both humans and devices, and (9) only entries

made upon adoption of the records as official. One comment said audit

trails should not be required for data acquisition systems, while

another comment said audit trails are critical for data acquisition

systems.

It is the agency's intent that the audit trail provide a record of

essentially who did what, wrote what, and when. The write-to-file

operations referenced in the proposed rule were not intended to cover

the kind of ``background'' nonhuman recordings the comments identified.

The agency considers such operator actions as activating a

manufacturing sequence or turning off an alarm to warrant the same

audit trail coverage as operator data entries in order to document a

thorough history of events and those responsible for such events.

Although FDA acknowledges that not every operator ``action,'' such as

switching among screen displays, need be covered by audit trails, the

agency is concerned that revising the rule to cover only ``critical''

operations would result in excluding much information and actions that

are necessary to document events thoroughly.

[[Page 13447]]

The agency believes that, in general, the kinds of operator actions

that need to be covered by an audit trail are those important enough to

memorialize in the electronic record itself. These are actions which,

for the most part, would be recorded in corresponding paper records

according to existing recordkeeping requirements.

The agency intends that the audit trail capture operator actions

(e.g., a command to open a valve) at the time they occur, and operator

information (e.g., data entry) at the time the information is saved to

the recording media (such as disk or tape), in much the same manner as

such actions and information are memorialized on paper. The audit trail

need not capture every keystroke and mistake that is held in a

temporary buffer before those commitments. For example, where an

operator records the lot number of an ingredient by typing the lot

number, followed by the ``return key'' (where pressing the return key

would cause the information to be saved to a disk file), the audit

trail need not record every ``backspace delete'' key the operator may

have previously pressed to correct a typing error. Subsequent ``saved''

corrections made after such a commitment, however, must be part of the

audit trail.

At this time, the agency's primary concern relates to the integrity

of human actions. Should the agency's experience with part 11

demonstrate a need to require audit trails of device operations and

entries, the agency will propose appropriate revisions to these

regulations. Accordingly, the agency has revised proposed Sec. 11.10(e)

by removing reference to all write-to-file operations and clarifying

that the audit trail is to cover operator entries and actions that

create, modify, or delete electronic records.

73. A number of comments questioned whether proposed Sec. 11.10(e)

mandated that the audit trail be part of the electronic record itself

or be kept as a separate record. Some comments interpreted the word

``independently'' as requiring a separate record. Several comments

focused on the question of whether audit trails should be generated

manually under operator control or automatically without operator

control. One comment suggested a revision that would require audit

trails to be generated by computer, because the system, not the

operator, should record the audit trail. Other comments said the rule

should facilitate date and time recording by software, not operators,

and that the qualifier ``securely'' be added to the language describing

the audit trail. One comment, noting that audit trails require

validation and qualification to ensure that time stamps are accurate

and independent, suggested that audit trails be required only when

operator actions are witnessed.

The agency advises that audit trail information may be contained as

part of the electronic record itself or as a separate record. FDA does

not intend to require one method over the other. The word

``independently'' is intended to require that the audit trail not be

under the control of the operator and, to prevent ready alteration,

that it be created independently of the operator.

To maintain audit trail integrity, the agency believes it is vital

that the audit trail be created by the computer system independently of

operators. The agency believes it would defeat the purpose of audit

trails to permit operators to write or change them. The agency believes

that, at this time, the source of such independent audit trails may

effectively be within the organization that creates the electronic

record. However, the agency is aware of a situation under which time

and date stamps are provided by trusted third parties outside of the

creating organization. These third parties provide, in effect, a public

electronic notary service. FDA will monitor development of such

services in light of part 11 to determine if a requirement for such

third party services should be included in these regulations. For now,

the agency considers the advent of such services as recognition of the

need for strict objectivity in recording time and date stamps.

The agency disagrees with the premise that only witnessed operator

actions need be covered by audit trails because the opportunities for

record falsification are not limited to cases where operator actions

are witnessed. Also, the need for validating audit trails does not

diminish the need for their implementation.

FDA agrees with the suggestion that the proposed rule be revised to

require a secure audit trail--a concept inherent in having such a

control at all. Accordingly, proposed Sec. 11.10(e) has been revised to

require use of ``secure, computer-generated'' audit trails.

74. A few comments objected to the requirement that time be

recorded, in addition to dates, and suggested that time be recorded

only when necessary and feasible. Other comments specifically supported

the requirement for recording time, noting that time stamps make

electronic signatures less vulnerable to fraud and abuse. The comments

noted that, in any setting, there is a need to identify the date, time,

and person responsible for adding to or changing a value. One of the

comments suggested that the rule require recording the reason for

making changes to electronic records. Other comments implicitly

supported recording time.

FDA believes that recording time is a critical element in

documenting a sequence of events. Within a given day a number of events

and operator actions may take place, and without recording time,

documentation of those events would be incomplete. For example, without

time stamps, it may be nearly impossible to determine such important

sequencing as document approvals and revisions and the addition of

ingredients in drug production. Thus, the element of time becomes vital

to establishing an electronic record's trustworthiness and reliability.

The agency notes that comments on the ANPRM frequently identified

use of date/time stamps as an important system control. Time recording,

in the agency's view, can also be an effective deterrent to records

falsification. For example, event sequence codes alone would not

necessarily document true time in a series of events, making

falsification of that sequence easier if time stamps are not used. The

agency believes it should be very easy for firms to implement time

stamps because there is a clock in every computer and document

management software, electronic mail systems and other electronic

record/electronic applications, such as digital signature programs,

commonly apply date and time stamps. The agency does not intend that

new technologies, such as cryptographic technologies, will be needed to

comply with this requirement. The agency believes that implementation

of time stamps should be feasible in virtually all computer systems

because effective computer operations depend upon internal clock or

timing mechanisms and, in the agency's experience, most computer

systems are capable of precisely recording such time entries as when

records are saved.

The agency is implementing the time stamp requirement based on the

understanding that all current computers, electronic document software,

electronic mail, and related electronic record systems include such

technologies. The agency also understands that time stamps are applied

automatically by these systems, meaning firms would not have to install

additional hardware, software, or incur additional burden to implement

this control. In recognition of this, the agency wishes to clarify that

a primary intent of this provision is to ensure that people take

reasonable measures to

[[Page 13448]]

ensure that those built in time stamps are accurate and that people do

not alter them casually so as to readily mask unauthorized record

changes.

The agency advises that, although part 11 does not specify the time

units (e.g., tenth of a second, or even the second) to be used, the

agency expects the unit of time to be meaningful in terms of

documenting human actions.

The agency does not believe part 11 needs to require recording the

reason for record changes because such a requirement, when needed, is

already in place in existing regulations that pertain to the records

themselves.

75. One comment stated that proposed Sec. 11.10(e) should not

require an electronic signature for each write-to-file operation.

The agency advises that Sec. 11.10(e) does not require an

electronic signature as the means of authenticating each write-to-file

operation. The agency expects the audit trail to document who did what

and when, documentation that can be recorded without electronic

signatures themselves.

76. Several comments, addressing the proposed requirement that

record changes not obscure previously recorded information, suggested

revising proposed Sec. 11.10(e) to apply only to those entries intended

to update previous information.

The agency disagrees with the suggested revision because the

rewording is too narrow. The agency believes that some record changes

may not be ``updates'' but significant modifications or falsifications

disguised as updates. All changes to existing records need to be

documented, regardless of the reason, to maintain a complete and

accurate history, to document individual responsibility, and to enable

detection of record falsifications.

77. Several comments suggested replacing the word ``document'' with

``record'' in the phrase ``Such audit trails shall be retained for a

period at least as long as required for the subject electronic

documents * * *'' because not all electronic documents are electronic

records and because the word document connotes paper.

As discussed in section III.D. of this document, the agency equates

electronic documents with electronic records, but for consistency, has

changed the phrase to read ``Such audit trail documentation shall be

retained for a period at least as long as that required for the subject

electronic records * * *.''

78. Proposed Sec. 11.10(k)(ii) (Sec. 11.10(k)(2) in this

regulation) addresses electronic audit trails as a systems

documentation control. One comment noted that this provision appears to

be the same as the audit trail provision of proposed Sec. 11.10(e) and

requested clarification.

The agency wishes to clarify that the kinds of records subject to

audit trails in the two provisions cited by the comment are different.

Section 11.10(e) pertains to those records that are required by

existing regulations whereas Sec. 11.10(k)(2) covers the system

documentation records regarding overall controls (such as access

privilege logs, or system operational specification diagrams).

Accordingly, the first sentence of Sec. 11.10(e) has been revised to

read ``Use of secure, computer-generated, time-stamped audit trails to

independently record and date the time of operator entries and actions

that create, modify, or delete electronic records.''

79. Proposed Sec. 11.10(f) states that procedures and controls for

closed systems must include the use of operational checks to enforce

permitted sequencing of events, as appropriate.

Two comments requested clarification of the agency's intent

regarding operational checks.

The agency advises that the purpose of performing operational

checks is to ensure that operations (such as manufacturing production

steps and signings to indicate initiation or completion of those steps)

are not executed outside of the predefined order established by the

operating organization.

80. Several comments suggested that, for clarity, the phrase

``operational checks'' be modified to ``operational system checks.''

The agency agrees that the added modifier ``system'' more

accurately reflects the agency's intent that operational checks be

performed by the computer systems and has revised proposed

Sec. 11.10(f) accordingly.

81. Several comments suggested revising proposed Sec. 11.10(f) to

clarify what is to be checked. The comments suggested that ``steps'' in

addition to ``events'' be checked, only critical steps be checked, and

that ``records'' also be checked.

The agency intends the word ``event'' to include ``steps'' such as

production steps. For clarity, however, the agency has revised proposed

Sec. 11.10(f) by adding the word ``steps.'' The agency does not,

however, agree that only critical steps need be subject to operational

checks because a given specific step or event may not be critical, yet

it may be very important that the step be executed at the proper time

relative to other steps or events. The agency does not believe it

necessary to add the modifier ``records'' to proposed Sec. 11.10(f)

because creation, deletion, or modification of a record is an event.

Should it be necessary to create, delete, or modify records in a

particular sequence, operational system checks would ensure that the

proper sequence is followed.

82. Proposed Sec. 11.10(g) states that procedures and controls for

closed systems must include the use of authority checks to ensure that

only authorized individuals use the system, electronically sign a

record, access the operation or device, alter a record, or perform the

operation at hand.

One comment suggested that the requirement for authority checks be

qualified with the phrase ``as appropriate,'' on the basis that it

would not be necessary for certain parts of a system, such as those not

affecting an electronic record. The comment cited pushing an emergency

stop button as an example of an event that would not require an

authority check. Another comment suggested deleting the requirement on

the basis that some records can be read by all employees in an

organization.

The agency advises that authority checks, and other controls under

Sec. 11.10, are intended to ensure the authenticity, integrity, and

confidentiality of electronic records, and to ensure that signers

cannot readily repudiate a signed record as not genuine. Functions

outside of this context, such as pressing an emergency stop button,

would not be covered. However, even in this example, the agency finds

it doubtful that a firm would permit anyone, such as a stranger from

outside the organization, to enter a facility and press the stop button

at will regardless of the existence of an emergency. Thus, there would

likely be some generalized authority checks built into the firm's

operations.

The agency believes that few organizations freely permit anyone

from within or without the operation to use their computer system,

electronically sign a record, access workstations, alter records, or

perform operations. It is likely that authority checks shape the

activities of almost every organization. The nature, scope, and

mechanism of performing such checks is up to the operating

organization. FDA believes, however, that performing such checks is one

of the most fundamental measures to ensure the integrity and

trustworthiness of electronic records.

Proposed Sec. 11.10(g) does not preclude all employees from being

permitted to read certain electronic records. However, the fact that

some records may be read by all employees would not

[[Page 13449]]

justify deleting the requirement for authority checks entirely. The

agency believes it is highly unlikely that all of a firm's employees

would have authority to read, write, and sign all of its electronic

records.

83. One comment said authority checks are appropriate for document

access but not system access, and suggested that the phrase ``access

the operation or device'' be deleted. The comment added, with respect

to authority checks on signing records, that in many organizations,

more than one individual has the authority to sign documents required

under FDA regulations and that such authority should be vested with the

individual as designated by the operating organization. Another comment

said proposed Sec. 11.10(g) should explicitly require access authority

checks and suggested that the phrase ``use the system'' be changed to

``access and use the system.'' The comment also asked for clarification

of the term ``device.''

The agency disagrees that authority checks should not be required

for system access because, as discussed in comment 82 of this document,

it is unlikely that a firm would permit any unauthorized individuals to

access its computer systems. System access control is a basic security

function because system integrity may be impeached even if the

electronic records themselves are not directly accessed. For example,

someone could access a system and change password requirements or

otherwise override important security measures, enabling individuals to

alter electronic records or read information that they were not

authorized to see. The agency does not believe it necessary to add the

qualifier ``access and'' because Sec. 11.10(d) already requires that

system access be limited to authorized individuals. The agency intends

the word ``device'' to mean a computer system input or output device

and has revised proposed Sec. 11.10(g) to clarify this point.

Concerning signature authority, FDA advises that the requirement

for authority checks in no way limits organizations in authorizing

individuals to sign multiple records. Firms may use any appropriate

mechanism to implement such checks. Organizations do not have to embed

a list of authorized signers in every record to perform authority

checks. For example, a record may be linked to an authority code that

identifies the title or organizational unit of people who may sign the

record. Thus, employees who have that corresponding code, or belong to

that unit, would be able to sign the record. Another way to implement

controls would be to link a list of authorized records to a given

individual, so that the system would permit the individual to sign only

records in that list.

84. Two comments addressed authority checks within the context of

PDMA and suggested that such checks not be required for drug sample

receipt records. The comments said that different individuals may be

authorized to accept drug samples at a physician's office, and that the

large number of physicians who would potentially qualify to receive

samples would be too great to institute authority checks.

The agency advises that authority checks need not be automated and

that in the context of PDMA such checks would be as valid for

electronic records as they are for paper sample requests because only

licensed practitioners or their designees may accept delivery of drug

samples. The agency, therefore, acknowledges that many individuals may

legally accept samples and, thus, have the authority to sign electronic

receipts. However, authority checks for electronic receipts could

nonetheless be performed by sample manufacturer representatives by

using the same procedures as the representatives use for paper

receipts. Accordingly, the agency disagrees with the comment that

proposed Sec. 11.10(g) should not apply to PDMA sample receipts.

The agency also advises that under PDMA, authority checks would be

particularly important in the case of drug sample request records

because only licensed practitioners may request drug samples.

Accordingly, proposed Sec. 11.10(g) has been revised to read: ``Use

of authority checks to ensure that only authorized individuals can use

the system, electronically sign a record, access the operation or

computer system input or output device, alter a record, or perform the

operation at hand.''

85. Proposed Sec. 11.10(h) states that procedures and controls for

closed systems must include the use of device (e.g., terminal) location

checks to determine, as appropriate, the validity of the source of data

input or operational instruction. Several comments objected to this

proposed requirement and suggested its deletion because it is: (1)

Unnecessary (because the data source is always known by virtue of

system design and validation); (2) problematic with respect to mobile

devices, such as those connected by modem; (3) too much of a ``how

to;'' (4) not explicit enough to tell firms what to do; (5) unnecessary

in the case of PDMA; and (6) technically challenging. One comment

stated that a device's identification, in addition to location, may be

important and suggested that the proposed rule be revised to require

device identification as well.

FDA advises that, by use of the term ``as appropriate,'' it does

not intend to require device checks in all cases. The agency believes

that these checks are warranted where only certain devices have been

selected as legitimate sources of data input or commands. In such

cases, the device checks would be used to determine if the data or

command source was authorized. In a network, for example, it may be

necessary for security reasons to limit issuance of critical commands

to only one authorized workstation. The device check would typically

interrogate the source of the command to ensure that only the

authorized workstation, and not some other device, was, in fact,

issuing the command.

The same approach applies for remote sources connected by modem, to

the extent that device identity interrogations could be made

automatically regardless of where the portable devices were located. To

clarify this concept, the agency has removed the word ``location'' from

proposed Sec. 11.10(h). Device checks would be necessary under PDMA

when the source of commands or data is relevant to establishing

authenticity, such as when licensed practitioners order drug samples

directly from the manufacturer or authorized distributor without the

intermediary of a sales representative. Device checks may also be

useful to firms in documenting and identifying which sales

representatives are transmitting drug sample requests from licensed

practitioners.

FDA believes that, although validation may demonstrate that a given

terminal or workstation is technically capable of sending information

from one point to another, validation alone would not be expected to

address whether or not such device is authorized to do so.

86. Proposed Sec. 11.10(i) states that procedures and controls for

closed systems must include confirmation that persons who develop,

maintain, or use electronic record or signature systems have the

education, training, and experience to perform their assigned tasks.

Several comments objected to the word ``confirmation'' because it

is redundant with, or more restrictive than, existing regulations, and

suggested alternate wording, such as ``evidence.'' Two comments

interpreted the proposed wording as requiring that checks of personnel

qualifications be performed automatically by computer systems that

perform database type

[[Page 13450]]

matches between functions and personnel training records.

The agency advises that, although there may be some overlap in

proposed Sec. 11.10(i) and other regulations regarding the need for

personnel to be properly qualified for their duties, part 11 is

specific to functions regarding electronic records, an issue that other

regulations may or may not adequately address. Therefore, the agency is

retaining the requirement.

The agency does not intend to require that the check of personnel

qualifications be performed automatically by a computer system itself

(although such automation is desirable). The agency has revised the

introductory paragraph of Sec. 11.10, as discussed in section VII. of

this document, to clarify this point. The agency agrees that another

word should be used in place of ``confirmation,'' and for clarity has

selected ``determination.''

87. One comment suggested that the word ``training'' be deleted

because it has the same meaning as ``education'' and ``experience,''

and objected to the implied requirement for records of employee

training. Another comment argued that applying this provision to system

developers was irrelevant so long as systems perform as required and

have been appropriately validated. The comment suggested revising

proposed Sec. 11.10(i) to require employees to be trained only ``as

necessary.'' One comment, noting that training and experience are very

important, suggested expanding proposed Sec. 11.10(i) to require

appropriate examination and certification of persons who perform

certain high-risk, high-trust functions and tasks.

The agency regards this requirement as fundamental to the proper

operation of a facility. Personnel entrusted with important functions

must have sufficient training to do their jobs. In FDA's view, formal

education (e.g., academic studies) and general industry experience

would not necessarily prepare someone to begin specific, highly

technical tasks at a given firm. Some degree of on-the-job training

would be customary and expected. The agency believes that documentation

of such training is also customary and not unreasonable.

The agency also disagrees with the assertion that personnel

qualifications of system developers are irrelevant. The qualifications

of personnel who develop systems are relevant to the expected

performance of the systems they build and their ability to explain and

support these systems. Validation does not lessen the need for

personnel to have the education, training, and experience to do their

jobs properly. Indeed, it is highly unlikely that poorly qualified

developers would be capable of producing a system that could be

validated. The agency advises that, although the intent of proposed

Sec. 11.10(i) is to address qualifications of those personnel who

develop systems within an organization, rather than external

``vendors'' per se, it is nonetheless vital that vendor personnel are

likewise qualified to do their work. The agency agrees that periodic

examination or certification of personnel who perform certain critical

tasks is desirable. However, the agency does not believe that at this

time a specific requirement for such examination and certification is

necessary.

88. Proposed Sec. 11.10(j) states that procedures and controls for

closed systems must include the establishment of, and adherence to,

written policies that hold individuals accountable and liable for

actions initiated under their electronic signatures, so as to deter

record and signature falsification.

Several comments suggested changing the word ``liable'' to

``responsible'' because the word ``responsible'' is broader, more

widely understood by employees, more positive and inclusive of elements

of honesty and trust, and more supportive of a broad range of

disciplinary measures. One comment argued that the requirement would

not deter record or signature falsification because employee honesty

and integrity cannot be regulated.

The agency agrees because, although the words ``responsible'' and

``liable'' are generally synonymous, ``responsible'' is preferable

because it is more positive and supportive of a broad range of

disciplinary measures. There may be a general perception that

electronic records and electronic signatures (particularly

identification codes and passwords) are less significant and formal

than traditional paper records and handwritten signatures. Individuals

may therefore not fully equate the seriousness of electronic record

falsification with paper record falsification. Employees need to

understand the gravity and consequences of signature or record

falsification. Although FDA agrees that employee honesty cannot be

ensured by requiring it in a regulation, the presence of strong

accountability and responsibility policies is necessary to ensure that

employees understand the importance of maintaining the integrity of

electronic records and signatures.

89. Several comments expressed concern regarding employee liability

for actions taken under their electronic signatures in the event that

such signatures are compromised, and requested ``reasonable

exceptions.'' The comments suggested revising proposed Sec. 11.10(j) to

hold people accountable only where there has been intentional

falsification or corruption of electronic data.

The agency considers the compromise of electronic signatures to be

a very serious matter, one that should precipitate an appropriate

investigation into any causative weaknesses in an organization's

security controls. The agency nonetheless recognizes that where such

compromises occur through no fault or knowledge of individual

employees, there would be reasonable limits on the extent to which

disciplinary action would be taken. However, to maintain emphasis on

the seriousness of such security breeches and deter the deliberate

fabrication of ``mistakes,'' the agency believes Sec. 11.10 should not

provide for exceptions that may lessen the import of such a

fabrication.

90. One comment said the agency should consider the need for

criminal law reform because current computer crime laws do not address

signatures when unauthorized access or computer use is not an issue.

Another comment argued that proposed Sec. 11.10(j) should be expanded

beyond ``individual'' accountability to include business entities.

The agency will consider the need for recommending legislative

initiatives to address electronic signature falsification in light of

the experience it gains with this regulation. The agency does not

believe it necessary to address business entity accountability

specifically in Sec. 11.10 because the emphasis is on actions and

accountability of individuals, and because individuals, rather than

business entities, apply signatures.

91. One comment suggested that proposed Sec. 11.10(j) should be

deleted because it is unnecessary because individuals are presumably

held accountable for actions taken under their authority, and because,

in some organizations, individuals frequently delegate authority to

sign their names.

As discussed in comments 88 to 90 of this document, the agency has

concluded that this section is necessary. Furthermore it does not limit

delegation of authority as described in the comment. However, where one

individual signs his or her name on behalf of someone else, the

signature applied should be that of the delegatee, with some notation

of that fact, and not the name of the delegator. This is the

[[Page 13451]]

same procedure commonly used on paper documents, noted as ``X for Y.''

92. Proposed Sec. 11.10(k) states that procedures and controls for

closed systems must include the use of appropriate systems

documentation controls, including: (1) Adequate controls over the

distribution, access to, and use of documentation for system operation

and maintenance; and (2) records revision and change control procedures

to maintain an electronic audit trail that documents time-sequenced

development and modification of records. Several comments requested

clarification of the type of documents covered by proposed

Sec. 11.10(k). One comment noted that this section failed to address

controls for record retention. Some comments suggested limiting the

scope of systems documentation to application and configurable

software, or only to software that could compromise system security or

integrity. Other comments suggested that this section should be deleted

because some documentation needs wide distribution within an

organization, and that it is an onerous burden to control user manuals.

The agency advises that Sec. 11.10(k) is intended to apply to

systems documentation, namely, records describing how a system operates

and is maintained, including standard operating procedures. The agency

believes that adequate controls over such documentation are necessary

for various reasons. For example, it is important for employees to have

correct and updated versions of standard operating and maintenance

procedures. If this documentation is not current, errors in procedures

and/or maintenance are more likely to occur. Part 11 does not limit an

organization's discretion as to how widely or narrowly any document is

to be distributed, and FDA expects that certain documents will, in

fact, be widely disseminated. However, some highly sensitive

documentation, such as instructions on how to modify system security

features, would not routinely be widely distributed. Hence, it is

important to control distribution of, access to, and use of such

documentation.

Although the agency agrees that the most critical types of system

documents would be those directly affecting system security and

integrity, FDA does not agree that control over system documentation

should only extend to security related software or to application or

configurable software. Documentation that relates to operating systems,

for example, may also have an impact on security and day-to-day

operations. The agency does not agree that it is an onerous burden to

control documentation that relates to effective operation and security

of electronic records systems. Failure to control such documentation,

as discussed above, could permit and foster records falsification by

making the enabling instructions for these acts readily available to

any individual.

93. Concerning the proposed requirement for adequate controls over

documentation for system operation and maintenance, one comment

suggested that it be deleted because it is under the control of system

vendors, rather than operating organizations. Several comments

suggested that the proposed provision be deleted because it duplicates

Sec. 11.10(e) with respect to audit trails. Some comments also objected

to maintaining the change control procedures in electronic form and

suggested deleting the word ``electronic'' from ``electronic audit

trails.''

The agency advises that this section is intended to apply to

systems documentation that can be changed by individuals w

This text is long and has been trimmed here. Open the source document for the complete record.