FDA Software Considerations in Medical Systems and Equipment

---

CFR Part 11 was established by the FDA in 1997 and clarified in 2007 and it applies to Electronic Record & Electronic Signatures and their related rules. CFR Part 11 establishes a requirement that computer systems used to create, modify and maintain electronic records & signatures are subject to validation. Computer systems (including hardware and software), controls and documentation must be readily available for and subject to FDA inspection and predicate rules apply, i.e., GMP, GCP, GLP.

• Validation of systems to ensure accuracy, reliability, consistent intended performance and the ability to discern invalid or altered records.
• Ability to generate accurate and complete copies of records in both human readable and electronic form suitable for inspection, review and copying.
• Protection of records to enable accurate and ready retrieval throughout the record retention period.
• Limiting access to authorized individuals.
• The use of secure, computer-generated, time-stamped audit trails to independently record the date and time of operator entries.
• Record changes shall not obscure previously recorded information and audit trails are to be maintained as long as the associated electronic record.
• Use operational system checks to enforce permitted sequencing of steps and events, as appropriate.
• Use of authority checks to ensure that only authorized individuals can use the system, electronically sign a record, access the operation, alter a record or perform the operation at hand.
• Use of device checks to determine the validity of the source of data input.
• Determination that persons who develop, maintain or use electronic records/electronic signatures have the education, training and experience to perform the assigned tasks.
• The establishment of, and adherence to, written policies that hold individuals accountable and responsible for actions initiated under their electronic signature so as to deter signature falsification.
• Adequate control over the distribution of, access to and use of documentation for system operation and maintenance.
• Revision and change control procedures to maintain an audit trail that documents time-sequenced development and modification of system documentation.

Q: What are the Validation Deliverables?
A: The Validation Deliverables include:

• Validation Plan
• User Requirements
• Functional Specification
• IQ/OQ/PQ Protocols
• Validation Summary Report

Q: What needs to be validated?
A: Finished Pharmaceutical GMPs such as:

• Personnel Qualifications (211.25), Consultants (211.34)
• Equipment Cleaning and Maint. (211.67)
• Automated Equipment (211.68)
• Materials Examination and Usage (211.122)
• Packaging and Labeling Oper. (211.130)
• Drug Product Inspection (211.134)
• Distribution Procedures (211.150)
• Reserve Samples (211.170)
• Records and Reports (211.180)

A: Medical Device GMPs such as:

• Management Responsibility (820.20)
• Quality Audit (820.22)
• Personnel (820.25)
• Design Controls (820.30)
• Document Controls (820.40)
• Purchasing Controls (820.50)
• Identification (820.60)
• Traceability (820.65)
• Production and Process Controls (820.70)
• Inspection, Measuring and Test Equipment (820.72)
• Process Validation (820.75)
• Receiving, In-Process, and Finished Device Acceptance (820.80)
• Acceptance Status (820.86)
• Nonconforming Product (820.90)
• Corrective and Preventive Action (820.100)
• Device Labeling (820.120)
• Device Packaging (820.130)
• Handling (820.140)
• Storage (820.150)
• Distribution (820.160)
• Installation (820.170)
• Records - General (820.180)
• Device Master Record (820.181)
• Device History Record (820.184)
• Quality System Record (820.186)
• Complaint Files (820.198)
• Servicing (820.200)
• Statistical Techniques (820.250)