Real World Examples for Part 11 Technical Controls

Size: px

Start display at page:

Download "Real World Examples for Part 11 Technical Controls"

Nathan Gallagher
5 years ago
Views:

1 Wolfgang Winter Product Manager, Networked Data Systems 23. January 2003 Real World Examples for Part 11 Technical Controls Time: 3.00 p.m. Central European Time Telephone Number: Chair Person: Ingrid Ginnutt

2 Real World Examples for Part 11 Technical Controls Presented by Wolfgang Winter Product Manager, Networked Data Systems Dial , Chairperson Ingrid Ginnutt for e-seminar Audio Slide 2

3 Real World Examples for Part 11 Technical Controls Implementing the procedural and technical controls for 21 CFR Part 11 is a big challenge for compliance. This seminar explains the technical controls mandated by the rule and demonstrates how they can be implemented, using examples from Agilent Cerity for Pharmaceutical QA/QC, a networked data system from Agilent Technologies targeted at pharmaceutical quality control laboratories. Dial , Chairperson Ingrid Ginnutt for e-seminar Audio Slide 3

4 Agenda for Today s Session Overview of Agilent Cerity for Pharmaceutical QA/QC Overview of technical controls mandated by 21 CFR Part 11 Detailed discussion of each control, using examples from Cerity for Pharmaceutical QA/QC Dial , Chairperson Ingrid Ginnutt for e-seminar Audio Slide 4

Agilent Cerity for Pharmaceutical QA/QC Supports QA/QC workflow Full 21 CFR Part 11 compliance (e-records and e-signatures) Fully scaleable client/server system Custom calculator and custom reports

5 Agilent Cerity for Pharmaceutical QA/QC Supports QA/QC workflow Full 21 CFR Part 11 compliance (e-records and e-signatures) Fully scaleable client/server system Custom calculator and custom reports to eliminate external calculations The networked data system that fully supports the everyday tasks of pharmaceutical QA/QC laboratories by modeling the way analysts work. Level 4 Instrument control for Agilent 6890/6850, 1100, 35900E and Waters Alliance Suite of computer-based compliance protocols and services Dial , Chairperson Ingrid Ginnutt for e-seminar Audio Slide 5

Cerity Client/Server System Dial +44 20 8240 8243,

6 Cerity Client/Server System Dial , Chairperson Ingrid Ginnutt for e-seminar Audio Slide 6

7 21 CFR Part 11 Technical Controls Section Requirement Responsibility* 11.10a Systems must be validated Proc b Accurate and complete copies Tech c Protection of records Proc., Tech d Access limited to authorized individuals Proc., Tech e Secure, computer-generated, time-stamped Tech. audit trail 11.10f/g/h Checks (device, authority, system checks) Tech Signature Manifestations Tech Signature/Record Linking Tech Uniqueness of e-sig to the individual Proc., Tech E-Sig Components and Controls Proc., Tech Controls for identification codes and passwords Proc., Tech. * Proc. = Pharmaceutical company is usually responsible to develop procedural controls Tech. = Supplier is usually responsible to implement technical controls Dial , Chairperson Ingrid Ginnutt for e-seminar Audio Slide 7

8 Accurate and Complete Copies ( 11.10b) The system must allow the creation of accurate and complete copies of the electronic record in human readable as well as electronic format for inspection and review by the FDA Cerity Archive/Restore Utility: exchange data between database servers long term archival for offline data query-based utility supports scheduled, scripted operation XML archive catalog Dial , Chairperson Ingrid Ginnutt for e-seminar Audio Slide 8

9 Protection of Records ( 11.10c) Records must be protected to enable accurate and ready retrieval throughout the record retention period Strict protection and version control in the Cerity database no information is ever overwritten Technically, Cerity uses globally unique identifiers and security services to keep records unique and safe from fraudulent or accidental modification Sign Secure Keep Integrity Retrieve Dial , Chairperson Ingrid Ginnutt for e-seminar Audio Slide 9

10 Access Control ( 11.10d) System access must be limited to authorized individuals All Cerity utilities require login of an authorized user Authentication based on operating system authentication No duplicate user account system needs to be maintained for Cerity Dial , Chairperson Ingrid Ginnutt for e-seminar Audio Slide 10

11 Notification of Unauthorized Access ( 11.10d) Uses security event log from operating system Leverages from security policies already established in the IT infrastructure Leverages notification procedures established by the system administrator Dial , Chairperson Ingrid Ginnutt for e-seminar Audio Slide 11

12 Break Number 1 Please type your question into the Chat Box at any time during the presentation. Dial , Chairperson Ingrid Ginnutt for e-seminar Audio Slide 12

13 Audit Trail ( 11.10e) Use of Computer generated, timestamped, audit trails to independently record the date and time of of operator entries and actions that create, modify, or delete electronic records. Record changes shall not obscure previously recorded information. Example Screen: Logbook fields available in the report layout editor. Dial , Chairperson Ingrid Ginnutt for e-seminar Audio Slide 13

14 Example for Version Control ( 11.10e) Calibration Table Revision Sample Result Revisions quantified with this revision of the Calibration Table Dial , Chairperson Ingrid Ginnutt for e-seminar Audio Slide 14

Column ID Tag Example: Wireless radio frequency

15 Device Check ( 11.10h) Example Device checks should be used to determine the validity of the source of data input or operation instruction. Column ID Tag Example: Wireless radio frequency transmission in the Agilent 1100 Thermostated Column Compartment LEVEL 4 Control Dial , Chairperson Ingrid Ginnutt for e-seminar Audio Slide 15

16 System Check ( 11.10g) Example: Formal Results Review/Approval Operational system checks should be used to enforce permitted sequencing of steps and events as appropriate. Dial , Chairperson Ingrid Ginnutt for e-seminar Audio Slide 16

17 Configurable Sign-Off and Audit Comments System allows to configure which actions require electronic sign-off Audit comments can be made mandatory (according to predicate rules) Dial , Chairperson Ingrid Ginnutt for e-seminar Audio Slide 17

18 Signature Manifestations ( 11.50) Meaning of signature two identification components timestamp recorded in logbook reuses security subsystem of operating system Dial , Chairperson Ingrid Ginnutt for e-seminar Audio Slide 18

Audit Trail/Signature Manifestation Example Meaning of signature Report template can show date and time stamps Date and time stamps are available in coordinated universal time

19 Audit Trail/Signature Manifestation Example Meaning of signature Report template can show date and time stamps Date and time stamps are available in coordinated universal time (UTC) User ID (as defined for operating system) User full name (as defined for operating system) Dial , Chairperson Ingrid Ginnutt for e-seminar Audio Slide 19

20 Break Number 2 Please type your question into the Chat Box at any time during the presentation. Dial , Chairperson Ingrid Ginnutt for e-seminar Audio Slide 20

21 New (Draft) FDA Guidance on Time Stamps Item FDA Guidance Requirement Cerity for Pharmaceutical QA/QC Time Stamp Accuracy Computer clocks must be synchronized and safe relies on standard NT/Windows 2000 clock synchronization scripts using a time server (IT system Systems Clock Security Time Zones Expression of Date and Time Precision of Date and Time Expressions You should be able to detect inappropriate changes to computer clocks. You should implement time stamps with a clear understanding of what time zone reference you use. System documentation should define how date and time are expressed. Audit trail and signature time stamps should be precise to the hour and minute. Date expressions in those stamps should indicate year, month and numerical day of the month. administration) relies on standard NT/Windows 2000 security policies and user profiles stores time information as universal time (UTC). Time information is displayed in local time according to the local time zone settings on the client computer reuses standard date and time formats as set in the regional settings of the operating system stores time information including seconds. Presentation of date and time information is done according to the regional settings of the operating system Dial , Chairperson Ingrid Ginnutt for e-seminar Audio Slide 21

22 Signature/Record Linking ( 11.70) Electronic signatures shall be linked to their respective electronics records to ensure that (they) cannot be excised, copied, to falsify an electronic record by ordinary means Cerity data is stored in a secure Oracle database Cerity design ensures referential integrity between related records Cerity audit trail and signature information cannot be manipulated Strict revision control of all records maintained by the Cerity system A B CUT PASTE Dial , Chairperson Ingrid Ginnutt for e-seminar Audio Slide 22

23 Uniqueness of e-sig ( ) Each electronic signature shall be unique to one individual and shall not be reused by, or reassigned to, anyone else Requires procedural controls in the organization Is typically handled by HR and IT departments IT policies ensure that combinations of user ID and passwords are unique and periodically revised Cerity leverages this work directly - no duplication required for the lab! Dial , Chairperson Ingrid Ginnutt for e-seminar Audio Slide 23

24 E-Sig Components and Controls ( ) The rule requires stringent controls to prevent impersonation Logon is mandatory in Cerity (user id and password) Cerity session can be locked interactively After a defined inactivity period, Cerity sessions are locked automatically. User ID and password are required to unlock a locked session. You are not who you say you are Dial , Chairperson Ingrid Ginnutt for e-seminar Audio Slide 24

interactively Unlock requires the user to re-enter both identification

25 Example: Cerity Inactivity Timeout Addresses the requirements for discontinuous session Sessions can be locked automatically (time-out) or interactively Unlock requires the user to re-enter both identification components Dial , Chairperson Ingrid Ginnutt for e-seminar Audio Slide 25

Controls for identification codes and passwords ( 11.

26 Controls for identification codes and passwords ( ) Cerity reuses operating system (OS) security system Cerity reuses password policies (security policies) defined for the operating system Dial , Chairperson Ingrid Ginnutt for e-seminar Audio Slide 26

Leverage from Operating System (OS) Security Manage users in system administration console using a standard IT tool ( MMC ) Authenticated OS users are granted access

27 Leverage from Operating System (OS) Security Manage users in system administration console using a standard IT tool ( MMC ) Authenticated OS users are granted access rights to the Cerity applications Directly reuse password and security policies defined by IT group Dial , Chairperson Ingrid Ginnutt for e-seminar Audio Slide 27

28 Summary Implementation of the technical controls for 21 Part 11 has many aspects (technical, procedural, educational) Constant trade-off between efficiency and overhead Cerity for Pharmaceutical QA/QC offers workflow support and technical controls for 21 Part 11 compliance Fits into and leverages from the existing IT infrastructure with minimal rework and duplication Dial , Chairperson Ingrid Ginnutt for e-seminar Audio Slide 28

29 References Good Automated Laboratory Practices (GAMP) Special Interest Group, Complying with 21 CFR Part 11: Electronic Records and Signatures, Final Draft, September 2000, Draft Guidance for Industry 21 CFR Part 11; Electronic Records; Electronic Signatures Time Stamps, see What is Universal Time? Computer time synchronization How to Set Up And Synchronize with Domain Time Source Servers (Q131715) US;q Dial , Chairperson Ingrid Ginnutt for e-seminar Audio Slide 29

30 References (2) Wolfgang Winter, Electronic Records are here to stay, Biopharm Europe, Special Issue September 2002, L. Huber, Implementing 21CFR Part 11 - Electronic Signatures and Records in Analytical Laboratories Part 1, - Overview and Requirements, Biopharm 12 (11), 28-34, 1999 W. Winter, L. Huber, Implementing 21CFR Part 11 - Electronic Signatures and Records in Analytical Laboratories, Part 2 Security Aspects for Systems and Applications, BioPharm 13 (1), 44-50, 2000; reprinted in Pharmaceutical Technology 24 (6), 74-87, June 2000 W. Winter and L Huber: Implementing 21CFR Part 11 - Electronic Signatures and Records in Analytical Laboratories, Part 3 Data Security and Data Integrity BioPharm 13 (3), 2000, pages Dial , Chairperson Ingrid Ginnutt for e-seminar Audio Slide 30

31 References (3) L. Huber and W. Winter: Implementing 21CFR Part 11 - Electronic Signatures and Records in Analytical Laboratories, Part 4 Long Term Archiving and Ready Retrieval BioPharm 13 (6), 2000 W. Winter and L. Huber: Implementing 21CFR Part 11 - Electronic Signatures and Records in Analytical Laboratories, Part 6, Biopharm and LCGC North America November 2000 Supplement C. Nickel, W. Winter and L. Huber: Implementing 21CFR Part 11 - Electronic Signatures and Records in Analytical Laboratories, Part 7 An approach towards compliance with 21 CFR part11 for noncompliant legacy systems, Biopharm and LCGC North America November 2000 Supplement Dial , Chairperson Ingrid Ginnutt for e-seminar Audio Slide 31

32 Wrap-up e-seminar Questions Thank you for attending today s Agilent e-seminar. Our Seminar schedule is expanding regularly. Please check our web site frequently at: Or register for Stay current with e-notes to receive regular updates. Dial , Chairperson Ingrid Ginnutt for e-seminar Audio Slide 32

Feb 19, 2003: Automated analytical method validation and regulatory compliance Mar 13, 2003: Monitoring the health and status of a networked chromatography data system Apr 17, 2003: Strategies and

33 Feb 19, 2003: Automated analytical method validation and regulatory compliance Mar 13, 2003: Monitoring the health and status of a networked chromatography data system Apr 17, 2003: Strategies and examples for design qualification (DQ) and re-qualification (RQ) for laboratory data systems Dial , Chairperson Ingrid Ginnutt for e-seminar Audio Slide 33

Integration of Agilent UV-Visible ChemStation with OpenLAB ECM

Integration of Agilent UV-Visible ChemStation with OpenLAB ECM Compliance with Introduction in Title 21 of the Code of Federal Regulations includes the US Federal guidelines for storing and protecting