Validation Center™

FDA intends to amend 21 CFR Part 11.  According to George Smith of FDA, a draft proposed amended regulation is in the clearance process.  Along with the amended regulation, FDA will issue a new guidance to replace the 2003 guidance.  They have not publicized a date for draft release, but sources say FDA is targeting the first half of 2007.  Until then, do we have an idea as to how the amended regulation and its promised companion guidance will change what we do today?  Here are a few clues:  Read the August 2003 guidance.  Read the understated, but hugely insightful, cGMPs for the 21st Century- A Risk Based Approach.
My prediction, based on conversations with industry insiders and FDA experts, is that the new Part 11 will look like it would look if you re-wrote it yourself after reading these two documents.  I believe FDA will hard-code the approach they have been working hard to publicize via guidance documents.  Without further delay, then, here is my high-level take on what will change, what will stay the same, and why we should care:
1.  Know your predicate rules.  Remember those?  They are the regulations that govern what you do, regardless of whether what you do is automated or computerized.  Think of it as the rules you would have to follow even if you were 100% paper based.  Examples are 21 CFR Parts 210 and 211 (for drug manufacturing) and 21 CFR Part 820 (for medical devices).  The 2003 guidance says to follow your predicate rules.  I think the new regulation will reinforce this.
2.  Know your product and your process.  The risk based approach will mean that FDA will expect you to know the specific function impacted by your electronic records and signatures and how those functions - or problems with those functions - may impact patient safety.  The more complex your process and the more risky your product (e.g. think pacemaker or infusion pump), the more assurance you will need that your electronic records are authentic, secure, etc. and the more confidence you will need in the validity of your electronic signatures.
3.  Validation, Audit Trail, Record Retention, and Record Copying requirements will likely be removed or scaled back in the new Part 11.  However, FDA will probably tell you again to follow predicate rule requirements for these items (see #1 above).  Have I mentioned that you need to know your predicate rules?
4.  The rest will likely remain.  FDA knows there are certain things every electronic record or signature should have, regardless of complexity, risk, or predicate rule requirement.  For a list, see page 4 of the 2003 guidance.
5.  Scope - FDA is likely to more clearly define what records are in the scope of Part 11 and which are not.  Do not expect anything earth-shattering though.  Focus on the "narrow interpretation" parts of the 2003 guidance.  Records required by predicate rules are probably in; records not required by predicate rules are probably out.
6.  Security Standards, Biometrics:  The good news is that I do not expect FDA to limit flexibility by giving us very specific guidance on security standards and biometrics.  The bad news is that I do not expect FDA to give us very specific guidance on security standards and biometrics.  FDA will expect that you use appropriate technology to ensure the validity of your electronic signatures and records.  For guidance on specific technology standards and approaches to biometrics, you will likely need to go to other sources such as IEEE or NIST.
The Bottom Line:  If you are complying with the current intent of Part 11 as embodied in the 2003 guidance document, then you probably will not have to change much to comply with the new Part 11.  Of course, that is if I am right in my predictions above.  If I am wrong, then the bad news is companies will again be spending resources and money on figuring out how to comply with Part 11 (remember the early part of this century?).  I am optimistic though.  FDA is increasingly aware that their mission of promoting public health and safety is best served when we practitioners spend time and money working on developing and making health care products - not creating useless paper.
I've done my best to bring you what I think is likely to be the highlights of the new Part 11.  If you have a different view or you have some concrete insider information, leave a comment or contact me directly.