Using Google Drive/Docs

[Zero_yield]

A couple things about backups: I've used Google Drive for personal items for 10+ years and never had an issue. To echo what Randy was saying, what I have experienced, like everyone does, is times when I couldn't connect to the internet. Brief net outages will happen (often when they're inconvenient), so having local backups is key. Dead tree format would be fine, as would a hard drive, zip disk, flash drive, etc.

 

[Brakeman]

Just a two bit note about QMS storage requirements. Some customers and even some suppliers are very concerned about digital security from disclosure much more than security from loss. Encryption software may be necessary to satisfy some, but it is a huge pain in the behind.

 

[KarenA01]

Just a two bit note about QMS storage requirements. Some customers and even some suppliers are very concerned about digital security from disclosure much more than security from loss. Encryption software may be necessary to satisfy some, but it is a huge pain in the behind.

On a sort of related question... Should Google be on our Approved vendor list? I think it should be, but upper management seems to thinks not because it is not it's not directly product related (So in the category of MRO).

-Karen

 

[Brakeman]

IMHO I think it should be since it's loss of function would directly hinder your QMS operation.

 

[Tidge]

Onsite, offsite, zip drive kept in a cigar box, you decide what's best for you and your needs and check it out in a test of some type. Maybe even use 2 different methods.

Do they still make zip drives? I don't think I have seen one for at VERY long time!

And here I was, thinking that cigar boxes were going to be the expensive component of the backup and recovery strategy.

 

[Randy]

And here I was, thinking that cigar boxes were going to be the expensive component of the backup and recovery strategy.

That'll do to if it works

 

[Junn1992]

i guess google drive could have everything, and a local depository accessible while offline on local computers could have the latest version of documents from the QMS (not taking into account customer documents here). At the extreme end, you could have the latest version of QMS documents in hardcopy, and the hardcopy files readily accessible by people around the office. Then of course you would need a periodic audit of these hardcopies to make sure they are really the 'latest version'

 

[DamienL]

I've audited Google doc control 500 times and never a problem from what I've experienced.

Sorry for so late to the conversation. I'm wondering about version control per Karens' OP? 21 CFR 820.70 requires that "All software changes shall be validated before approval and issuance". If the cloud providers are pushing out patches/updates every week, then it's not possible to meet this requirement. Yes, you can do an assessment/revalidation pretty quickly after the fact, but it will always be after the fact.

I'm looking to use Google Drive or similar for controlled documents storage and DocuSign or similar for eSignatures, but that requirement seems to explicitly preclude their use. 13485 seems a bit more forgiving - "Such software applications shall be validated prior to initial use and, as appropriate, after changes to such software or its application". Any suggestions how to handle continuous updates and still remain compliant with QSR&13485? Thanks

 

[KarenA01]

Sorry for so late to the conversation. I'm wondering about version control per Karens' OP? 21 CFR 820.70 requires that "All software changes shall be validated before approval and issuance". If the cloud providers are pushing out patches/updates every week, then it's not possible to meet this requirement. Yes, you can do an assessment/revalidation pretty quickly after the fact, but it will always be after the fact.

We will be going for 13485 (as a component manufacturer) using Google Drive/Sheet for our initial registration late spring or early summer,...

But we are also beginning an ERP implementation which will be validated, that when it goes live will contain our controlled docs . So using the google solution will just be temporary until the ERP is ready to go live (likely early 2024) ...

You imply validating google Drive and sheets would fairly easy/quick... While I have written a lot of software it was not for applications that require validation and I have never been involved in software validation (my background in validation is analytical methods) ... How would one go about doing an acceptable minimal validation on Google Docs/Sheets?

If the continuous updates are an issue, I would hope the fact that we are implementing an ERP would make that a minor if it is an issue...

But as you likely know Docusign sells a part 11 compliant electronic signature product... so somehow the issue must be dealt with, else they would not be in that business.

BTW awhile back somewhere on these boards I did see a post where someone said they did get 13485 using Google for doc control... which is why I think (hope) that won't be an issue for our registration.

-Karen

 

[Randy]

Show me where it says that the "document control" software has to be validated because I don't see it, it just references the "computer software" to operate controls and equipment....You're probably reading too deep or your consultant is spacing out. I'd almost guarantee that their own (FDA-whoever) doc control software doesn't even meet what you're talking about.....After 18+ years of US Gov't contracting you learn a couple things.

§ 820.70 Production and process controls.

(a) General. Each manufacturer shall develop, conduct, control, and monitor production processes to ensure that a device conforms to its specifications. Where deviations from device specifications could occur as a result of the manufacturing process, the manufacturer shall establish and maintain process control procedures that describe any process controls necessary to ensure conformance to specifications. Where process controls are needed they shall include:

(1) Documented instructions, standard operating procedures (SOP's), and methods that define and control the manner of production;
(2) Monitoring and control of process parameters and component and device characteristics during production;
(3) Compliance with specified reference standards or codes;
(4) The approval of processes and process equipment; and
(5) Criteria for workmanship which shall be expressed in documented standards or by means of identified and approved representative samples.

(b) Production and process changes. Each manufacturer shall establish and maintain procedures for changes to a specification, method, process, or procedure. Such changes shall be verified or where appropriate validated according to § 820.75, before implementation and these activities shall be documented. Changes shall be approved in accordance with § 820.40.

(c) Environmental control. Where environmental conditions could reasonably be expected to have an adverse effect on product quality, the manufacturer shall establish and maintain procedures to adequately control these environmental conditions. Environmental control system(s) shall be periodically inspected to verify that the system, including necessary equipment, is adequate and functioning properly. These activities shall be documented and reviewed.

(d) Personnel. Each manufacturer shall establish and maintain requirements for the health, cleanliness, personal practices, and clothing of personnel if contact between such personnel and product or environment could reasonably be expected to have an adverse effect on product quality. The manufacturer shall ensure that maintenance and other personnel who are required to work temporarily under special environmental conditions are appropriately trained or supervised by a trained individual.

(e) Contamination control. Each manufacturer shall establish and maintain procedures to prevent contamination of equipment or product by substances that could reasonably be expected to have an adverse effect on product quality.

(f) Buildings. Buildings shall be of suitable design and contain sufficient space to perform necessary operations, prevent mixups, and assure orderly handling.

(g) Equipment. Each manufacturer shall ensure that all equipment used in the manufacturing process meets specified requirements and is appropriately designed, constructed, placed, and installed to facilitate maintenance, adjustment, cleaning, and use.

(1) Maintenance schedule. Each manufacturer shall establish and maintain schedules for the adjustment, cleaning, and other maintenance of equipment to ensure that manufacturing specifications are met. Maintenance activities, including the date and individual(s) performing the maintenance activities, shall be documented.
(2) Inspection. Each manufacturer shall conduct periodic inspections in accordance with established procedures to ensure adherence to applicable equipment maintenance schedules. The inspections, including the date and individual(s) conducting the inspections, shall be documented.
(3) Adjustment. Each manufacturer shall ensure that any inherent limitations or allowable tolerances are visibly posted on or near equipment requiring periodic adjustments or are readily available to personnel performing these adjustments.

(h) Manufacturing material. Where a manufacturing material could reasonably be expected to have an adverse effect on product quality, the manufacturer shall establish and maintain procedures for the use and removal of such manufacturing material to ensure that it is removed or limited to an amount that does not adversely affect the device's quality. The removal or reduction of such manufacturing material shall be documented.

(i) Automated processes. When computers or automated data processing systems are used as part of production or the quality system, the manufacturer shall validate computer software for its intended use according to an established protocol. All software changes shall be validated before approval and issuance. These validation activities and results shall be documented.