Validation of Electronic Signatures on Multiple Servers

Gert Sorensen · Jun 11, 2007

Hi Everybody,

I am looking into implemtation of electronic signatures on our QMS. I am considering adding an off-the-shelf-module to our Lotus Notes system that has the ability to track and log changes using Notes sign on. However, my challenge is (at the least) twofold:
1. The electronic QMS-system is not validated since there has always been made printouts (typical medical device solution

)
2. The system that hopefully will be implemented is going to run on several servers simultaneously in replicas.

Am I facing a validation of the QMS, since the electronic signatures apply to the documents there or am I "only" facing a validation of the module for electronic signatures since it is an off-the-shelf solution??
Can we perform validation of the respective servers via Wan or does it need to be done on-site?

If any of you have any experience how to handle a validation challenge like this, then I would appreciate input.

:thanks:

in advance

GStough · Jun 11, 2007

Re: Validation of Electronic Signatures - input needed

Hi Gert,

Seems to me that the first priority for this would be validation of the new system you're going to purchase. If the entire QMS also needs validation, I would think it would be a little bit lesser priority. I may wrong, but that is how it seems to me.

I, too, would be interested to see what the experts in this area would recommend.

Ajit Basrur · Jun 11, 2007

Re: Validation of Electronic Signatures - input needed

Gert Sorensen said:
Hi Everybody,

I am looking into implemtation of electronic signatures on our QMS. I am considering adding an off-the-shelf-module to our Lotus Notes system that has the ability to track and log changes using Notes sign on. However, my challenge is (at the least) twofold:
1. The electronic QMS-system is not validated since there has always been made printouts (typical medical device solution )
2. The system that hopefully will be implemented is going to run on several servers simultaneously in replicas.

Am I facing a validation of the QMS, since the electronic signatures apply to the documents there or am I "only" facing a validation of the module for electronic signatures since it is an off-the-shelf solution??
Can we perform validation of the respective servers via Wan or does it need to be done on-site?

If any of you have any experience how to handle a validation challenge like this, then I would appreciate input.

in advance

Hi Gert,

I am not very sure but would be worthwhile to get a validated software as per 21 CFR part 11. It would make your job bit easier.

BradM · Jun 11, 2007

Re: Validation of Electronic Signatures - input needed

Hello there, Gert!

If I understand your situation, you have Lotus Notes. You utilize the program for storing information only at this point (does Lotus currently perform calculations?) You rely on the printout and accept that data/ information. You sign the hard copy. Did you perform a validation of the Lotus Notes and it's report generation?

Currently how secure is the Lotus data? Does it have security levels? Does your entire QMS reside in Lotus Notes?

Just off the top of my head, the level of validation would be subject to the acceptance of your validation plan by your management. You might could draw a line in the sand and state what will be new (unchallenged) and move forward. For example, you could challenge the system as generating the same reports you had. If you have a huge # of items, you might could randomly sample the verification items.

Also, if you're going totally paperless, then you'll have to get into archiving, and the like.

I'm not sure if I am adding anything or not. Let me know if I'm missing the mark.

RoxaneB · Jun 11, 2007

Re: Validation of Electronic Signatures - input needed

Gert, will you be using Lotus notes to develop your documentation? If yes, when it comes time for e-signatures, a password is requested by Lotus notes. That should validate your e-approval of a document.

If you're talking about e-approval on a record, I'm not sure how Lotus is used in this area, unfortunately.

Gert Sorensen · Jun 11, 2007

Re: Validation of Electronic Signatures - input needed

Qualityalways said:
Hi Gert,

I am not very sure but would be worthwhile to get a validated software as per 21 CFR part 11. It would make your job bit easier.

You are, as ever, right. Unfortunately, I don't sign the checques

Gert Sorensen · Jun 11, 2007

Re: Validation of Electronic Signatures - input needed

BradM said:
If I understand your situation, you have Lotus Notes. You utilize the program for storing information only at this point (does Lotus currently perform calculations?)

Yes, our QMS is handled in a database system (danish design) running under Lotus Notes. It handles documents generated in Notes db and Microsoft Office (as attachments). No calculations that I am aware of...

BradM said:
You rely on the printout and accept that data/ information. You sign the hard copy. Did you perform a validation of the Lotus Notes and it's report generation?

That is what we do now, but we (I) would like to make the transition to going paperless. The validation that were performed is of a quality that I would not like to defend, putting it bluntly.

BradM said:
Currently how secure is the Lotus data? Does it have security levels? Does your entire QMS reside in Lotus Notes?

Fairly secure. We have workstation logon, network logon, notes logon on the client side. We have a good IT security: Firewalls, antivirus, DMZ zone, backup everyday.

BradM said:
Just off the top of my head, the level of validation would be subject to the acceptance of your validation plan by your management. You might could draw a line in the sand and state what will be new (unchallenged) and move forward. For example, you could challenge the system as generating the same reports you had. If you have a huge # of items, you might could randomly sample the verification items.

You mean for the PQ part? That's a defendable idea

BradM said:
Also, if you're going totally paperless, then you'll have to get into archiving, and the like.

You mean backup procedures etc.?

Any suggestions on the signature part of my challenge?

Gert Sorensen · Jun 11, 2007

Re: Validation of Electronic Signatures - input needed

RCBeyette said:
Gert, will you be using Lotus notes to develop your documentation? If yes, when it comes time for e-signatures, a password is requested by Lotus notes. That should validate your e-approval of a document.

If you're talking about e-approval on a record, I'm not sure how Lotus is used in this area, unfortunately.

My challenge is that the way Notes (at least our Notes) handles this is that it only stores the last 5 dates of changes. It does not store the actual change, nor the reason for the change + there is a clear demand for validation of the signature part itself.... :frust:

I just had an estimate of the cost of the signature module and tracking module. Roughly 75,000$ + annual license fee of app. 2,000$. :lmao:

I think I will consider another supplier :bonk:

GStough · Jun 11, 2007

Re: Validation of Electronic Signatures - input needed

Gert Sorensen said:
Any suggestions on the signature part of my challenge?

Gert,

As I recall from a previous life, there are several options out there for the signature part. One option is to assign specific symbols to each approver which will represent his/her e-signature. This may only be available with certain manufacturers of such e-signature solutions, though.

Another option might be to scan each approver's signature and digitally protect it using VeriSign (I think this was the name of the one we used) or something similar to protect it from misuse or unauthorized alteration.

Hope this helps. :bigwave:

RoxaneB · Jun 11, 2007

Re: Validation of Electronic Signatures - input needed

Gert Sorensen said:
My challenge is that the way Notes (at least our Notes) handles this is that it only stores the last 5 dates of changes. It does not store the actual change, nor the reason for the change + there is a clear demand for validation of the signature part itself....

I take it, then, that you are not using the Archive Module? I thought that there was a flat fee from IBS - the supplier of Notes - for the package and you were able to pick which ever modules you wished to use. The cost came from the number of users. I'm fairly certain that's how we set things up with them. We don't even use half the databases, but I thought the e-signature option was standard within the Document Control database.

The Reason for Change table shows only 5 lines, but if you hit 'Tab' when you're in the bottom right cell, it will add another line like a table in Word. Worst case scenario, you could add the Reason for Change notes to the Electronic History section at the bottom which does allow for some manual entry information.

What version are you on? If I may ask...

Validation of Electronic Signatures on Multiple Servers

Gert Sorensen

GStough

Ajit Basrur

BradM

RoxaneB

Change Agent and Data Storyteller

Gert Sorensen

Gert Sorensen

Gert Sorensen

GStough

RoxaneB

Change Agent and Data Storyteller

Similar threads