What is 21 CFR Part 11 Compliance?

21 CFR Part 11 is a regulation issued by the FDA that sets forth requirements for electronic records and electronic signatures to ensure their reliability, integrity, and authenticity in FDA-regulated industries, including pharmaceuticals, biotechnology, and medical devices. It establishes criteria for electronic records and signatures that are considered equivalent to paper records and handwritten signatures.

Given the nature of regulated clinical trials and the current FDA guidance pertaining to systems development, validation and how we manage electronic records and e-signatures, it not surprising that many people don't fully understand how 21 CFR Part 11 compliance works, or whether their desired clinical trial vendor is compliant. What many do not realize is that this is quite a loaded question, and that there are considerations beyond the tool or service in question that will also need to be addressed.

Let's say there is a software solution that you wish to deploy in your upcoming clinical trial. The solution as a whole has been developed, validated, packaged, and delivered in a 21 CFR Part 11 compliant manner. Is it 21 CFR Part 11 compliant? Well… sort of. The solution itself is compliant, but, since the world of clinical trials is not a black box environment, the solution must be consistently used in a way that follows regulatory guidelines in order to maintain compliance.

You may be wondering to yourself, “Okay, so what does that mean, exactly?”

Simply put, it means that you and your team play a critical role in this 21 CFR Part 11 framework, too.

Consider these questions:

• How will you be implementing the solution?
• What other systems will be interacting with it?
• How many users will be interacting with the solution? What types of users are they?
• Will data be coming into it? Going out? Both?
• Who is in control of those things and how are they being managed and maintained?

I can advise you on how to address these questions, but the answers ultimately depend on the objectives of your organization or project.

There are external factors that require controls set forth by you and your team as well. Think of this as a relay race - the solution is the baton, and the provider ensures that it gets the baton to you in a compliant way; but in order to be successful in this race, you must take the baton and put forth effort to ensure we cross the finish line in an equally compliant way.

When choosing any clinical trial solution, make sure you keep these two things in mind:

(1) Software developers can validate their solutions as 21 CFR Part 11 compliant, but you (the research team or system user) must validate any projects within the system.

(2) The solution, once handed over to you, will operate locally within an environment that is independent to the solution (within your organization or network or project team). Note that a quality management system (QMS) is a system that must be further validated at the project level to be compliant. It is useless if your local environment cannot demonstrate that all users (internal and external) have proper training and are following SOPs for training, and sufficient access controls are in place. If these pieces do not exist or are incomplete or insufficient, then the 21 CFR Part 11 system and/or 21 CFR Part 11 project within that system cannot demonstrate end-to-end 21 CFR Part 11 compliance and we have essentially dropped the baton.

Yonalink has done everything in our power to ensure our solution is 21 CFR Part 11 compliant; and was designed with certain features to help support your part of the compliance ‘race’. It all boils down to quality controls (a quality management system) and traceability of the data (who’s touched what, when, and how did it change things).

What the FDA is really looking for is: “Can you guarantee that the electronic version of this signature is equivalent to one on paper ‘in the real world’?” and “Is this electronic data consistent with the source data, or, if it is meant to be the source, is it consistent with ‘real life’, and how do I (the FDA) know that?” Yonalink can help you with many of these things - via audit trails, user management functionality, and authentications - but how you implement and utilize the system and the controls you set forth are just as critical if we want to keep from dropping that baton.

‍