Record signature requirements in proposed FDA 21 CFR 820 QMS Regulation

[Sam Lazzara]

Does anybody else see a "problem" here?

It appears to me that the proposed signature requirements for the "Control of records 820.35" is very burdensome as compared to the existing requirements for signatures in the current 820 regulation.

Signature requirements in current FDA 21 CFR 820 (as of 2022-03)
820.30 Design controls (c) Design input
820.30 Design controls (d) Design output
820.40 Document controls.
820.75 Process validation
820.80 Receiving, in-process, and finished device acceptance
820.120 Device labeling (b) Labeling inspection
820.90 Nonconforming product (b) Nonconformity review and disposition

Signature requirements in ISO 13485:2016
None

Signature requirements in "proposed" FDA 21 CFR 820 QMS Regulation
All records (?) (see proposal below)
§ 820.35 Control of records.
In addition to the requirements of Clause 4.2.5 in ISO 13485 (incorporated by reference, see § 820.7), Control of
Records, the manufacturer must obtain the signature for each individual who approved or re-approved the record, and
the date of such approval, on that record and include the below information in certain records as follows: ....
https://www.govinfo.gov/content/pkg/FR-2022-02-23/pdf/2022-03227.pdf

My Analysis
ISO 13485:2016 clause 4.2.5 applies to all QMS records but in no case are signatures required per ISO 13485. The FDA proposed 820 rule (QMSR) appears to require signatures/dates for ALL QMS records, not only the documents/records that required signatures per the current 820 regulation. For my clients who do not employ eQMS software, this would be a substantial and burdensome change. Their general practice for the documents/records not requiring signature per the current 820 regulation is to simply enter the name of the responsible person and the date on the document/record, and not to require a signature (handwritten or electronic) for those documents/records.

 

[Tidge]

Thank you for the link to the Federal register.

I must admit I am confused about where the "new burden" is? Per my understanding: 21 CFR 820.40(b) makes it clear that document approvals and changes (for all documentation required by Part 820) require signatures... and a casual glance at all the subparts included requirements that the activities of the subparts need to be documented, e.g. Statistical Techniques (I admit I just jumped to the end!)

If an electronic system is used to capture signatures, 21 CFR 11 applies.

As a practical matter, I don't know how a manufacturer could prove who created (or modified) a record without a signature. In my salad days (green in judgement, cold in blood) I might have been theoretically swayed by some argument that MWER is taking 100% responsibility for all records not having an attributable signature but I don't think that is practical or believable. It's not as if a member of MWER is going to attest with authority to the content of any random electronic document, and it would strain credibility that (absent actual signatures) there had been distinct review and approval by specified parties.

 

[Sam Lazzara]

Thank you for your reply, Tidge.

Please allow me to explain via an example. The information below is in the context of a medical device QMS that does not employ eQMS software.
In the implementations I most familiar with, we avoid paper and pens. Rather than printing paper forms and filling them out with an ink pen, the fields in pre-approved Forms are filled out electronically using native applications such as Microsoft Word.

I don't take issue with the requirement to have signature-based approvals for "pure" documents such as blank Forms. I say "pure" to distinguish between "records" which are a type of document and the underlying documents that are signature approved. The most prominent example I can think of are Forms that have various labeled but empty fields in them to record information after the Form is signature-approved. In my case, signature approvals are maintained in a Document Change Order (DCO) and the DCO number is referenced in the Form footer.

All of the Forms I am speaking about have various form-fields in which information is entered and at least one "Completed By/Date" field that the responsible person uses to record their name and the date. The "Completed By/Date" field information is directly typed into the field by the responsible person with no need for a signature to be applied (handwritten or electronic).

In summary, the completed Form becomes a quality system record completed by a responsible person without application of a handwritten or electronic signature. The Form becomes a quality system record once it is completed under the authority of the person who typed their name and date in the Completed By/Date section of the Form. It would be burdensome for this person to apply their signature to this record since the completed form is not simply a paper record that could be readily signed - it is an electronic record only.

 

[Tidge]

If the electronic forms satisfy 21 CFR 11, you should be fine.

 

[Sam Lazzara]

They do with regard to electronic records, but they do not include any type of signature (handwritten or electronic) so Part 11 requirements for electronic signatures do not apply.
My concern with the proposed FDA 820 QMS Regulation is that signatures appear to be required for all records.

 

[Jen Kirley]

They do with regard to electronic records, but they do not include any type of signature (handwritten or electronic) so Part 11 requirements for electronic signatures do not apply.
My concern with the proposed FDA 820 QMS Regulation is that signatures appear to be required for all records.

I looked at the web article FDA Issues Proposed Rule to Amend Medical Device Quality System Regulation that discusses the proposed change and didn't see what you are referring to. There may be other such sources to review.

I am not affiliated with McDermott, Will and Emery.

 

[Hi_Its_Matt]

...
All of the Forms I am speaking about have various form-fields in which information is entered and at least one "Completed By/Date" field that the responsible person uses to record their name and the date. The "Completed By/Date" field information is directly typed into the field by the responsible person with no need for a signature to be applied (handwritten or electronic).

In summary, the completed Form becomes a quality system record completed by a responsible person without application of a handwritten or electronic signature.

You have used this approach before without any issue from FDA or certification/notified bodies?

I have always assumed that (for most quality system records) some type of signature was required* for the purposes of recording who completed/generated the record - either a wet signature, or a part-11 compliant electronic signature.
Of course, I've also seen some degree of leniency in enforcing this requirement, based on the specific type of record... the risk involved with the record, whether it was a QSR/13485 required record, or only required by internal processes, etc.

It may be getting off topic, but I'm curious what type of records these are that someone simply typing their name into the "completed by" field is considered "good enough."

 

[Sam Lazzara]

Hi_Its_Matt,
Yes, I have used this approach for many years without any issue from FDA or certification/notified bodies.

With regard to ISO 13485:2016, I am applying the following definitions from ISO 9000:2015.
DOCUMENT: Information and the medium on which it is contained.
RECORD: Document stating results achieved or providing evidence of activities performed.
In this context, a RECORD is a type of DOCUMENT (a subset of DOCUMENTS).
This notion is consistent with ISO 13485:2016 clause 4.2.1(d): documents, including records, determined by the organization to...

The ISO 9000 (and therefore the ISO 13485) definition of RECORD does not use the word "signature".

My typical situation is a follows:
1. Controlled QMS forms are released in Microsoft Word format.
Note: The "blank" form is a DOCUMENT but not specifically a RECORD until it is filled out.
2. The Word forms have unlocked form-fields intended for specific information to be entered each time the form is used.
3. Personnel filling out the form type information into all of the form fields and type their name/date into a "Completed By/Date" field at the bottom of the form.
4. The completed electronic form is then saved to (moved to) a designated QMS electronic folder.

In the past, I have ensured that these FDA 21 CFR 820 signature requirements are met:
Signature requirements in current FDA 21 CFR 820 (as of 2022-03)
820.30 Design controls (c) Design input
820.30 Design controls (d) Design output
820.40 Document controls.
820.75 Process validation
820.80 Receiving, in-process, and finished device acceptance
820.120 Device labeling (b) Labeling inspection
820.90 Nonconforming product (b) Nonconformity review and disposition

...and I go a bit further with requiring signatures just due to old traditions and habits.
Examples: Personnel Training Records, Design Review Approvals, Internal Audit Reports, Management Review Records.

Note: Signatures are not (explicitly) required for any DOCUMENTS or RECORDS in ISO 13485:2016. The term "signature" does not appear in the standard.

I have attached just one example of a form that I have used that does not require a signature.

 

[Sam Lazzara]

I looked at the web article FDA Issues Proposed Rule to Amend Medical Device Quality System Regulation that discusses the proposed change and didn't see what you are referring to. There may be other such sources to review.

Hello Jen,
The article you referenced does mention what I am speaking about, the Recordkeeping section:

• Implementing the signature and date requirements for records subject to the records control provisions in Clause 4.2.5 of ISO 13485, underscoring FDA’s continued focus on ensuring the validity and authenticity of signatures and dating of quality and manufacturing records, including electronic records

Clause 4.2.5 of ISO 13485:2016 applies to all records required to provide evidence of conformity to requirements and of the effective operation of the QMS. So, FDA is proposing that signatures be applied to ALL QMS records.

And strangely, in the proposed rule, regarding Clause 4.2.4 Control of documents, FDA does not mention the addition of signature requirements for documents.

 

[Hi_Its_Matt]

Yes, I have used this approach for many years without any issue from FDA or certification/notified bodies.

That's good to hear. Most of my professional experience has been in those areas where FDA requires signatures, plus those "extra" topics you listed, so maybe that's why I'm so used to seeing them!
Until recently I haven't really been in the position to challenge my employer's signature/documentation requirements. Although they were reasonable, and there was never much fuss about them. In my current role, I not only have the authority to challenge things, but the expectation! There are probably a few places we use wet signatures (or validated e-signatures) when they aren't truly required, but none that are so frequent they cause any real hassle. Otherwise I probably would have changed them by now!