Examples of Electronic Records for 21 CFR Part 11

ga2qa23

Involved In Discussions
Hi all, I do QA/RA for a medical device manufacturer, and I'm looking for a generally-accepted list of types of electronic records that are covered / should be validated per U.S. Regulation 21 CFR Part 11 (Electronic Records; Electronic Signatures). I would greatly appreciate if someone could point me to either a useful book / guidance document / industry blog post that covers this topic.

In particular, I'm most confused by this FDA Guidance (https://www.fda.gov/media/75414/download) which says that "Definition of Part 11 Records: Under this narrow interpretation, FDA considers part 11 to be applicable to the following records or signatures in electronic format (part 11 records or signatures): Records submitted to FDA, under predicate rules ... in electronic format ... However, a record that is not itself submitted, but is used a record that is not itself submitted, but is used in generating a submission, is not a part 11 record unless it is otherwise required to be maintained under a predicate rule and it is maintained in electronic format."

This stipulation is frankly confusing. I'm guessing it means that there are VERY FEW types of electronic records that are excluded.

I'm looking for a simple list of included and excluded, that covers a lot of common situations. For example:
"Electronic Records" included in Scope of 21 CFR Part 11
Not Included in Scope
Training Records that are signed.A non-signed evidence of competency/training.
A signed data intake form.A raw data spreadsheet exported by a medical device, for complaint investigation.
Use of excel as a database, where the data is kept only in the excel file.Use of excel as a tracking tool, where actual data is kept in separate records.
A distribution record of a medical device.A simple list of customer names.
A DHF document that must be submitted in a 510(k) such as a software requirements specification (SRS).(Do any exclusions exist for DHF?)
A DHF document that is not submitted in a 510(k) such as either a hardware technical requirements document or a hardware test for battery life.(Do any exclusions exist for DHF?)
A MDF / DMR record such as a Bill of Materials (BOM).(Do any exclusions exist for MDF / DMR?)
A DHR record completed form such as manufacturing traveler, installation, and/or service.A DHR record such as raw data logs from the medical device being worked on.

This question may seem trivial to experts, but please keep in mind that as a newcomer to this subject, the scope is incredibly poorly defined. I've already made a homemade guide for identifying complaints vs. non-complaints but this is beyond me. I've read the FDA Guidance, the 'predicate rules" related to medical devices (21 CFR Part 820 and 21 CFR Part 11), and the other posts here on Elsmar Cove, but couldn't find anything.

Yes, I understand that it's my responsibility to thoroughly analyze all regulations and my own business activities to determine what constitutes an "electronic record", but there are also situations which are clearly obvious to those who have experienced it already. I would really appreciate any help before having to resort to a questionable consultant.
 
Last edited:

ga2qa23

Involved In Discussions
To follow-up, another confusing type of record is a "Software Problem Resolution" record (per standard IEC 62304) considered an "electronic record" under 21 CFR Part 11? I can come up with arguments both for and against being covered by 21 CFR Part 11...
  • Pro-Argument: a "Software Problem Resolution" record can be considered part of the DHF of the medical device.
  • Counter-Argument: a "Software Problem Resolution" record is only mandated by the standard IEC 62304, which is not required by FDA.
 

yodon

Leader
Super Moderator
A *record* that falls under Part 11 scope is any record required under predicate rule that you maintain in electronic form.

A training record is in scope (presuming that is supporting evidence of competency). Whether it's signed or not has no bearing on whether it's a record or not (and recognize that the requirements don't establish that it must be signed). That record needs to be maintained in accordance with the Part 11 aspects for records.

If you sign a record electronically, then the signature falls under the electronic signature part of the regulation.

Your line item about a distribution record may be off base. You *are* required to maintain records of distribution (820.160). If you maintain those electronically, then they are in scope for Part 11. If your "list of customer names" is intended to comply with the requirement (which,by itself, it wouldn't), and you maintain it electronically, then it would be in scope. If it's not intended to comply with 820.160 (or part of it), then it's not an electronic record required by predicate rule and not in scope (there is no predicate rule that requires you to maintain a record of customer names).

The bit about submissions sent electronically would be applicable for, say, paper records that are scanned and submitted (as long as those paper records are considered the evidence of compliance). The scanned copy that is submitted is not considered in scope.

The software problem resolution record is a bit tricky. Clearly, the regulation requires device change records. Frequently, this is, or is supplemented with the software problem resolution record. In that case, it would clearly be in scope. Most likely, you are asserting compliance with 62304 to demonstrate a presumption of conformity with applicable regulations. Personally, I would not want to try to argue that it's not in scope.

Does that help?
 
Top Bottom