Many criteria can be used to evaluate the prosperity of a society and the focus certainly differs depending on the individual. Health, however, is the one factor that nobody would hesitate to agree with. Today, high-quality and high-performing drugs are available to treat sick people.
To maintain this high quality, the production of drugs is typically monitored using robust analytical instruments, such as spectrometers. Requirements for these instruments have been proposed by standardization organizations. This article presents these requirements, with a focus on those that concern software.
CFR Part 11 – An Overview
In regulated environments, signatures and records can be created either electronically or on paper. Previously, paper was preferred over electronic signatures (e-signatures) and records, but compared to paper-based records, electronic records save on costs due to increased data security, improved accuracy and a reduced need for staff to handle and maintain the files.
For electronic records and signatures eligible for the regulated environment, electronic signatures must be reliable and trustworthy to the same degree that handwritten signatures and paper records are. Therefore, these electronic records can only be created once certain defined features have been implemented within the software application used. The Title CFR Part 11 of the Code of Federal Regulation, prepared by the US Food and Drug Administration (FDA) describes these defined features:
CFR - Code of Federal Regulations Title 21
In the following sections, features of the Metrohm spectroscopy software Vision Air Pharma are used to present software requirements stipulated for regulated industries by the FDA.
The topics covered in the CFR Part 11 can be divided into two groups:
- Electronic signatures and user management
- Records and audit trails
This article is also divided up in the same way, with an initial description of how e-signatures and user management are organized in the Vision Air Pharma software.
Electronic signature and user management
11.50 Signature manifestations
(a) Signed electronic records shall contain information associated with the signing that clearly indicates all of the following:
(1) The printed name of the signer
(2) The date and time when the signature was executed
(3) The meaning (such as review, approval, responsibility, or authorship) associated with the signature.
(b) The items identified in paragraphs (a)(1), (a)(2), and (a) (3) of this section shall be subject to the same controls as for electronic records and shall be included in human readable form of the electronic record (such as electronic display or printout).
Both customized and predefined reports are provided by Vision Air. These contain sections linked to the digital signature which indicates the ID and name of the signer, the meaning of the signature, and a time-stamp, as shown in Figure 1. The organization manages the signature meanings.
Figure 1. Display of a typical Sample Report created with Vision Air Pharma.
11.70 Signature/record linking
Electronic signatures and handwritten signatures executed to electronic records shall be linked to their respective electronic records to ensure that the signatures cannot be excised, copied, or otherwise transferred to falsify an electronic record by ordinary means.
11.100 (a) Each electronic signature shall be unique to one individual and shall not be reused by, or reassigned to, anyone else.
Figure 2. Within each step of the signing process in Vision Air Pharma a User ID, a password and a reason have to be entered. User IDs have to be different for the two signing levels.
In Vision Air Pharma, e-signatures are specific to each individual person, as they are linked to each user’s unique ID and password. Since e-signatures are stored in the database, they cannot be copied, excised or transferred. E-signatures can be revoked by users who have the appropriate rights, but this also has to be signed and recorded, along with the time, the name, the user ID and the reason for revocation.
Figure 3. Vision Air Pharma audit trail with respect to electronic signatures.
11.200 (a) Electronic signatures that are not based on biometrics shall:
(1) Employ at least two distinct identification components such as an identification code and password.
(2) Be used only by their genuine owners
(3) Be administered and executed to ensure that attempted use of an individual's electronic signature by anyone other than its genuine owner requires collaboration of two or more individuals
Figure 4. Mandatory Log in procedure during startup of Vision Air Pharma.
A user ID and password are required to login into the Vision Air software. This serves as an initial check of the person using e-signatures, but for every signature, a login and password also has to be entered. Each signing process can consist of up to two levels and these must be carried out by different people.
11.10 (d) Limiting system access to authorized individuals
11.10 (g) Use of authority checks to ensure that only authorized individuals can use the system, electronically sign a record, access the operation or computer system input or output device, alter a record, or perform the operation at hand.
Figure 5. Display of user rights in Vision Air Pharma regarding electronic signatures for "Administrators". Rights can be adjusted for the individual user group.
In Vision Air, a unique ID and password is assigned to each user. Different access authorities can define three user types. The password length and complexity and the valid time period are also set.
Figure 6. Setting options in Vision Air Pharma regarding password complexity. The minimum settings for the password length and the reuse of recent passwords is three.
11.300 Persons who use electronic signatures based upon use of identification codes in combination with passwords shall employ controls to ensure their security and integrity. Such controls shall include:
(a) Maintaining the uniqueness of each combined identification code and password, such that no two individuals have the same combination of identification code and password.
(b) Ensuring that identification code and password issuances are periodically checked, recalled or revised (e.g. to cover such events as password aging).
(c) Following loss management procedures to electronically deauthorize lost, stolen, missing, or otherwise potentially compromised tokens, cards, and other devices that bear or generate identification code or password information, and to issue temporary or permanent replacements using suitable, rigorous controls.
(d) Use of transaction safeguards to prevent unauthorized use of passwords and / or identification codes, and to detect and report in an immediate and urgent manner any attempts at their unauthorized use to the system security unit, and, as appropriate, to organizational management.
In the Vision Air software, each User ID is unique and, once created, cannot be deleted; it can only be disabled. A user is locked after a certain number of unsuccessful login attempts - a critical event that is recorded in the audit trail. Further, an automatically generated email notifies selected users.
Figure 7. Display of user Login/logout options. Automatic logouts will not cancel measurements.
Electronic records and audit trails
111.10 (a) Validation of systems to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records.
An extensive configuration change viewer in Vision Air gives a distinct overview of any changes that affect the instrument and measurement process. The reports include the user name, time, date and reasons for the changes. Additionally, an implemented surveillance function provides a complete overview of all user events, measurements, and performed instrument diagnostics.
Figure 8. Display of the configuration change viewer after a new operating procedure has been created. Configuration changes need to be signed before being active.
11.10 (b) The ability to generate accurate and complete copies of records in both human readable and electronic form suitable for inspection, review and copying by the agency. Persons should contact the agency if there are any questions regarding the ability of the agency to perform such review and copying of the electronic records.
Figure 9. Setting options in Vision Air Pharma for automatic export of files and reports e.g. to a LIMS system. Settings can also be set for an automatic print out of reports.
A SQL database saves all instrument settings, measurements, users and electronic records. Following each measurement, electronic records can be created either automatically or manually. Records can also be printed and stored automatically. The export folder can be selected to be on a network drive or on a local device. Different file formats are available for creating electronic records. Each User ID is unique and records are available in formats such as DOC and PDF.
11.10 (c) Protection of records to enable their accurate and ready retrieval throughout the records retention period.
As a data-based software solution, the Vision Air can save all types of records including sample data, user configurations, operating procedures and audit trails, in an SQL database. The software can also be set up with an automatic backup procedure.
Figure 10. Auto backup settings. Backups are performed even if Vision Air Pharma is closed or users are logged off from the operating system.
11.10 (f) Use of operational checks to enforce permitted sequence of steps and events, as appropriate.
Vision Air uses operating procedures to ensure that all steps of an analysis are carried out in the right order. Mandatory sample registration fields provide guidance and users must fill these fields out during measurement. Guidance is also provided to users during the process of changing configurations; such changes can only be applied after a two-level signing process has been performed, which needs to be done by two people.
Figure 11. Display of user guidance in Vision Air Pharma. Information in mandatory fields (highlighted in red) need to be entered to complete the sample registration.
Conclusion
Meeting the requirements for a regulated environment is complex and time-intensive, involving the application of procedural, technical, and administrative controls. The Vision Air software provides all technical requirements that the 21 CFR Part 11 demands, so that customers working in regulated environments are supported in achieving and maintaining compliance in a much easier and faster way.
About Metrohm
At Metrohm is one of the world’s most trusted manufacturers of high-precision instruments for chemical analysis. Metrohm was founded in 1943 by engineer Bertold Suhner in Herisau, Switzerland. Today, Metrohm is represented in 120 countries by subsidiaries and exclusive distributors. The global Metrohm Group also includes the Dutch companies Metrohm Applikon and Metrohm Autolab, manufacturers of online analyzers and instruments for electrochemical research, respectively. Recently, the Metrohm Group was joined by Metrohm Raman, a leading manufacturer of handheld Raman spectrometers.
Metrohm is the global market leader in analytical instruments for titration. Instruments for ion chromatography, voltammetry, conductivity, and stability measurement make the Metrohm portfolio for ion analysis complete. Instruments for Near-infrared and Raman spectroscopy are another, strongly growing segment of the Metrohm portfolio.
Metrohm is a problem solver, both in the laboratory and within the industrial process. To this end, the company offers their customers complete solutions, including dedicated analytical instrumentation as well as comprehensive application know-how. More than 30% of the company’s employees at the Metrohm international headquarters in Herisau work in R&D.
Metrohm has been owned 100% by the non-profit Metrohm Foundation since 1982. The Metrohm Foundation, which does not exert any influence on the company’s business operations, sponsors gifted students in the natural sciences, supports charitable and philanthropic purposes and, above all, ensures the independence of the company.
Sponsored Content Policy: News-Medical.net publishes articles and related content that may be derived from sources where we have existing commercial relationships, provided such content adds value to the core editorial ethos of News-Medical.Net which is to educate and inform site visitors interested in medical research, science, medical devices and treatments.