On March 20, 1997, FDA promulgated “21 CFR Part 11: Electronic Records; Electronic Signatures; Final Rule” in the Federal Register, along with a significant preamble guidance to address the scope of electronic recordkeeping for FDA-regulated manufacturers. Subsequently, in August 2003, FDA published the “Guidance for Industry, Part 11: Electronic Records; Electronic Signatures – Scope and Application.” From an electronic records standpoint, the basic scope of the Part 11 regulatory requirements and its associated guidance addresses only those electronic records that manufacturers should rely on to demonstrate compliance to its predicate regulations (e.g., 21 CFR Part 820 Quality System Regulation (QSR) for medical device manufacturers). However, confusion still appears to exist by some medical device manufacturers, which has led to misconceptions that other records (e.g., electronic records created by medical devices during their use) may also be considered electronic records that fall under the scope of the Part 11 regulation.
21 CFR Part 11.1 Scope (b) states that, “This part applies to records in electronic form that are created, modified, maintained, archived, retrieved, or transmitted under any records requirements set forth in agency regulations.”
Medical device manufacturers create documentation and records in an electronic format that allow for compliance to FDA regulations, such as QSR for medical devices. For medical device manufacturers, typical records required by QSR include quality system procedures, design history files, device master records, device history records, complaint file records, purchasing records, etc. In general, these records enable medical device manufacturers to demonstrate compliance to QSR requirements during an FDA inspection. No implication is stated in Part 11 that electronic records actually created by the medical devices (i.e., by end users) are subject to Part 11 compliance requirements, since these records are not typically required for compliance to any FDA regulations by a manufacturer.
21 CFR Part 11.1 Scope (e) states, “Computer systems (including hardware and software), controls, and attendant documentation maintained under this part shall be readily available for, and subject to, FDA inspection.”
For example, during an FDA inspection, the agency would have the authority to review computer systems that create and maintain electronic documentation in order to determine whether a medical device manufacturer is complying with QSR requirements. This type of documentation, if they are Part 11-related electronic records, could then be identified by the manufacturer as part of its quality system procedures and records. However, per Part 11, FDA has no authority to inspect electronic records created by medical devices at an end user’s site.
The August 2003 guidance stated that under FDA’s narrow interpretation of the “Definition of Part 11 Records” for “records that are required to be maintained under predicate rule requirements and that are maintained in electronic format in place of paper format, records (and any associated signatures) that are not required to be retained under predicate rules, but that are nonetheless maintained in electronic format, are not Part 11 records. We recommend that you determine, based on the predicate rules, whether specific records are Part 11 records. We recommend that you document such decisions.”
Again, this FDA guidance clarifies that only electronic records required to be maintained under a predicate rule such as QSR for medical devices are defined as Part 11-related records. In general, predicate rules (e.g., QSR for medical devices) identify which records (whether paper or electronic) should be maintained, the content of the required records, whether signatures are required for the record, and how long the records must be kept. If there were no specified FDA predicate rule requirement that a record be created or maintained, Part 11 would most likely not apply to an electronic record. Since electronic records that are created by a medical device are not required by a predicate rule such as QSR, FDA has clarified that such records are not defined as Part 11 records.
In general, many medical devices can save various electronic data such as user settings, logs, and patient databases. These types of electronic data are created by a device, and thus there is no specific requirement for the data per any FDA predicate rule.
In Noblitt & Rueland’s experience, medical device manufacturers that market devices and whose devices generate electronic data specifically created by the device typically do not consider the electronic data as Part 11 electronic records. Thus medical device manufacturers typically do not consider such electronic data as user settings, logs, or patient data as Part 11 electronic records since this type of data is not identified by any predicate rule such as QSR to fulfill an FDA inspection requirement.
In summary, FDA appears to be clear in its narrow interpretation of the definition of Part 11 electronic records that fulfill FDA predicate rules such as QSR requirements. To clarify the misconceptions by some medical device manufacturers, electronic data created by medical devices should not be considered Part 11 electronic records, and thus 21 CFR Part 11 requirements should not apply.
Dennis Rubenacker is co-founder and senior partner of the consulting firm Noblitt & Rueland, which provides consulting and training services for medical device and IVD manufacturers. He specializes in software validation, FDA electronic recordkeeping, design control, risk assessment, software development, and software quality management for the medical device industry. He has extensive experience dealing with product development, software development, software quality assurance, and software verification and validation for IVD medical device instrumentation and automated processes. His medical product line experience includes clinical chemistry analyzers, immunoassay analyzers, microbiology analyzers, glucose monitors, and OTC diagnostic devices. He has assisted international companies ranging in size from less than $1 million in sales to Fortune 100 companies. He received his BS in electrical engineering with highest honors from the University of Illinois and is a member of the Institute for Electrical and Electronic Engineers, RAPS, OCRA, and ASQ. He can be contacted via e-mail at email@example.com.