Is implementing Electronic Signatures a Significant Change to the QMS?

[kchan]

Hello,

We currently have a hybrid QMS system where we write paper records, then scan them into our network. We use the network copies as the official record.

If I were to switch to using entirely electronic records and signatures (never a paper copy), would that be considered a significant change to the QMS?
All I can find is the NBOG 2014-3 article that says switching from paper to electronic is considered significant, BUT, we already had electronic records.

Thanks in advance for your input!

 

[Tidge]

I say "Yes" but the change may not be as extreme as some folks may advise. The most significant aspects IMO are:

• The QMS must unequivocally state the meaning and understanding of an electronic signature
• There must be proof of correct implementation of electronic signatures where they are employed

In the USA, 21 CFR part 11 spells out necessary implementation details for electronic records/signatures. These are straightforward and well-intentioned rules that can be adapted for other jurisdictions.

Also, the FDA requires formal notification that a company is using electronic signatures (if you never deal with the FDA, I suppose this doesn't matter to you)

 

[somashekar]

Yes, it is significant change.
For reason.,
The records control process now interacts with your 4.1.6 (software used in the quality management system) You will need to document a procedure for its validation and validate this software.
You will have to ensure by the validation that the responsibilities and authorities about records approvals are mapped as you have documented under the clause 5.5.1, and that they are effective.
You wll have to pay attention about the controls you put in place about records security and integrity and being retreievable and the authorities mapped to persons who can retreive the records. This is in consideration with the records control process interaction with the Internal audit process. This also helps you to demonstrate the records well during any external audits by the auditee responsible adequately.
With the remote audits becomming the new way forward, I have seen many examples of poor records retreievability by the designated auditee leading to poor audit performances and time delays. Situations across processes can lead to a finding. It will do good when you can check this well in your internal audits as well as determine how the MR can get involved in the records retreivable authority given to him based on his responsibility. This is a good point to consider in your software validation.....

 

[kchan]

Thank you both for your input!

We sell in the USA and in Europe (under MDD). We are under MDSAP. We already utilize a validated eQMS system, which has digital signatures for process-based workflows, so we are familiar with Part 11.

In order to move to AdobeSign/certified electronic signatures on records, I believe the process is to:

a. Validate AdobeSign and the process used for Part 11 compliant electronic signatures.
b. Contact our MDSAP AO to inform them of the change and get permission / undergo a delta audit for the use of electronic signatures
c. Start using electronic signatures.

Would I also need to contact our NB about it in Europe? Or let the FDA know?

 

[med_cert]

Thank you both for your input!

We sell in the USA and in Europe (under MDD). We are under MDSAP. We already utilize a validated eQMS system, which has digital signatures for process-based workflows, so we are familiar with Part 11.

In order to move to AdobeSign/certified electronic signatures on records, I believe the process is to:

a. Validate AdobeSign and the process used for Part 11 compliant electronic signatures.
b. Contact our MDSAP AO to inform them of the change and get permission / undergo a delta audit for the use of electronic signatures
c. Start using electronic signatures.

Would I also need to contact our NB about it in Europe? Or let the FDA know?

Hi @kchan can I ask which eQMS system you use?

 

[Tidge]

I would like to keep reading how your discussions with AdobeSign go. Based on the specific functionality of AdobeSign, it may be necessary to also establish them as a (software) service provider. (specific) Supplier controls could reduce the burden of validation on your end.

 

[Tagin]

Adobe Sign has some template assistance for the validation:
https://helpx.adobe.com/sign/using/21-cfr-validation-pack.html

 

[Ed Panek]

Run validation by using both manual and E sign off for a period of 1-3 months. Then validate the outputs match.

I would also complete this checklist

 

[kchan]

Hi @kchan can I ask which eQMS system you use?

Agile PLM

 

[kchan]

Hi all,

Thanks for your answers. We certainly intend to validate any software we use for Electronic Signatures. However, my question is more aimed towards understanding whether we need to notify our registrar and NB and if it is considered a 'significant change' to the QMS in that regard.