Are 2 Hard Copies of Procedures and Instructions Required?

[snoopy2017]

Hi ISO 13485 community,

How many hard copies of our QMS procedures should we keep around in the company? In the past, the regulatory department in charge ensured that there were at least 2 hard copies; one master procedure and one copy of it kept in another location. I understand the reason for keeping the master copy because it has the original signatures. What is the point of keeping the additional hard copy if people can just download the procedures from our server? What is the reason for this?

Thank you.

 

[Coury Ferguson]

Hi ISO 13485 community,

How many hard copies of our QMS procedures should we keep around in the company? In the past, the regulatory department in charge ensured that there were at least 2 hard copies; one master procedure and one copy of it kept in another location. I understand the reason for keeping the master copy because it has the original signatures. What is the point of keeping the additional hard copy if people can just download the procedures from our server? What is the reason for this?

Thank you.

Why doesn't your organization put the procedures on the company's Intranet allowing all people within your organization having access? Easier to control.

I don't know if having hard copies on the floor is the best action. Hard Copies would have to be maintained under tight controls. Recalling obsolete procedures can create headaches in some organizations. I am not that familiar with ISO 13485. Does it require hard copies be available? I wouldn't think so.

But, this is just my opinion.

 

[Golfman25]

Actually, the only reason to keep a hard copy is to be able to give to the auditor during an audit (unless you can hook him up to your network and let him pull the electronic copies himself). The only downside to electronic copies is that people need to have access to a terminal to see them. So old guys like books instead.

 

[Stijloor]

Actually, the only reason to keep a hard copy is to be able to give to the auditor during an audit (unless you can hook him up to your network and let him pull the electronic copies himself). The only downside to electronic copies is that people need to have access to a terminal to see them. So old guys like books instead.

The OP is in the medical devices industry. They may have to maintain hardcopy documents that are signed.

 

[Sidney Vianna]

What is the reason for this?

A potential reason is to make the document set available for auditors/inspectors during unannounced audits/inspections performed, respectively by Notified Bodies and Regulatory Agencies, e.g., the FDA.

 

[Ronen E]

ISO 13485 doesn’t spell out a requirement for hard copies, let alone the number of sets.

FDA does seem to still give hard copies a presumption of authenticity, in that it assumes pen-and-paper signature control is inherently valid, while e-signatures (and e-copies controls) require formal validation (see part 11).

 

[Ronen E]

I understand the reason for keeping the master copy because it has the original signatures. What is the point of keeping the additional hard copy if people can just download the procedures from our server? What is the reason for this?

I guess that the (past?) requirement stemmed from a backup perspective; however today it’s much safer to make an electronic copy and save on an alternate location (in case a fire destroyed the original AND your on-site server), or even in the Cloud (if you deem it trust-worthy from both the backup and confidentiality perspectives).

Please note that if you intend to let people download their copies straight from the server you have to put in place controls that will ensure that they will always be using the effective version. You also need to consider what happens with print-outs, and how to prevent them being used past an updated version issue.

My approach is to declare that everything but the Master Copy (even photocopies of it) is uncontrolled and thus invalid past the date of printing / downloading, unless identified otherwise by formal, explicit means. If that sounds too harsh it may be extended to 3 days, or a week, but past that it becomes risky in my opinion. I always find it funny when orgs have the practice of stamping printouts with “Uncontrolled Copy” or the like - it’s much easier to put in place a practice for highlighting / identifying the few (if any) duplicate copies that ARE controlled, instead.