Citations: FDA 21 CFR Part 11

The regulations in this part set forth the criteria under which the agency considers electronic records, electronic signatures, and handwritten signatures executed to electronic records to be trustworthy, reliable, and generally equivalent to paper records and handwritten signatures executed on pape

This part applies to records in electronic form that are created, modified, maintained, archived, retrieved, or transmitted, under any records requirements set forth in agency regulations. This part also applies to electronic records submitted to the agency under requirements of the Federal Food, Dr

Where electronic signatures and their associated electronic records meet the requirements of this part, the agency will consider the electronic signatures to be equivalent to full handwritten signatures, initials, and oth5er general signings as required by agency regulations, unless specifically exc

Electronic records that meet the requirements of this part may be used in lieu of paper records, in accordance with § 11.2, unless paper records are specifically required.

Computer systems (including hardware and software), controls, and attendant documentation maintained under this part shall be readily available for, and subject to, FDA inspection.

Validation of systems to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records.

The ability to generate accurate and complete copies of records in both human readable and electronic form suitable for inspection, review, and copying by the agency.

Protection of records to enable their accurate and ready retrieval throughout the records retention period.

Limiting system access to authorized individuals.

Use of secure, computer-generated, time-stamped audit trails to independently record the date and time of operator entries and actions that create, modify, or delete electronic records. Record changes shall not obscure previously recorded information.

Use of operational system checks to enforce permitted sequencing of steps and events, as appropriate.

Use of authority checks to ensure that only authorized individuals can use the system, electronically sign a record, access the operation or computer system input or output device, alter a record, or perform the operation at hand.

Use of device (e.g., terminal) checks to determine, as appropriate, the validity of the source of data input or operational instruction.

Determination that persons who develop, maintain, or use electronic record/electronic signature systems have the education, training, and experience to perform their assigned tasks.

The establishment of, and adherence to, written policies that hold individuals accountable and responsible for actions initiated under their electronic signatures, in order to deter record and signature falsification.

Use of appropriate controls over systems documentation including: (1) Adequate controls over the distribution of, access to, and use of documentation for system operation and maintenance. (2) Revision and change control procedures to maintain an audit trail that documents time-sequenced development

Each electronic signature shall be unique to one individual and shall not be reused by, or reassigned to, anyone else.

Before an organization establishes, assigns, or certifies an individual's electronic signature, the organization shall verify the identity of the individual.

Persons using electronic signatures shall certify to the agency that the electronic signatures in their system are intended to be the legally binding equivalent of traditional handwritten signatures.

The certification shall be signed with a traditional handwritten signature and submitted in electronic or paper form. Information on where to submit the certification can be found on FDA's web page on Letters of Non-Repudiation Agreement.

Persons using electronic signatures shall, upon agency request, provide additional certification or testimony that a specific electronic signature is the legally binding equivalent of the signer's handwritten signature.

For records required to be maintained but not submitted to the agency, persons may use electronic records in lieu of paper records or electronic signatures in lieu of traditional signatures, in whole or in part, provided that the requirements of this part are met.

For records submitted to the agency, persons may use electronic records in lieu of paper records or electronic signatures in lieu of traditional signatures, in whole or in part, provided that: (1) The requirements of this part are met; and (2) The document or parts of a document to be submitted ha

Electronic signatures that are not based upon biometrics shall: (1) Employ at least two distinct identification components such as an identification code and password. (i) When an individual executes a series of signings during a single, continuous period of controlled system access, the first si

Electronic signatures that are not based upon biometrics shall: Be used only by their genuine owners; and

Electronic signatures that are not based upon biometrics shall: Be administered and executed to ensure that attempted use of an individual's electronic signature by anyone other than its genuine owner requires collaboration of two or more individuals.

Electronic signatures based upon biometrics shall be designed to ensure that they cannot be used by anyone other than their genuine owner.

Act means the Federal Food, Drug, and Cosmetic Act (secs. 201-903 (21 U.S.C. 321-393)).

Agency means the Food and Drug Administration.

Biometrics means a method of verifying an individual's identity based on measurement of the individual's physical feature(s) or repeatable action(s) where those features and/or actions are both unique to that individual and measurable.

Closed system means an environment in which system access is controlled by persons who are responsible for the content of electronic records that are on the system.

Digital signature means an electronic signature based upon cryptographic methods of originator authentication, computed by using a set of rules and a set of parameters such that the identity of the signer and the integrity of the data can be verified.

Electronic record means any combination of text, graphics, data, audio, pictorial, or other information representation in digital form that is created, modified, maintained, archived, retrieved, or distributed by a computer system.

Electronic signature means a computer data compilation of any symbol or series of symbols executed, adopted, or authorized by an individual to be the legally binding equivalent of the individual's handwritten signature.

Handwritten signature means the scripted name or legal mark of an individual handwritten by that individual and executed or adopted with the present intention to authenticate a writing in a permanent form.

Open system means an environment in which system access is not controlled by persons who are responsible for the content of electronic records that are on the system.

Persons who use open systems to create, modify, maintain, or transmit electronic records shall employ procedures and controls designed to ensure the authenticity, integrity, and, as appropriate, the confidentiality of electronic records from the point of their creation to the point of their receipt.

Maintaining the uniqueness of each combined identification code and password.

Ensuring that identification code and password issuances are periodically checked, recalled, or revised (e.g., password aging).

Following loss management procedures to electronically deauthorize lost/stolen tokens or devices and to issue replacements using suitable controls.

Use of transaction safeguards to prevent unauthorized use of passwords/codes and report attempts at unauthorized use to security and management.

Initial and periodic testing of devices (tokens/cards) to ensure they function properly and have not been altered in an unauthorized manner.

Signed electronic records shall contain information associated with the signing that clearly indicates: (1) Printed name of signer; (2) Date and time of execution; and (3) The meaning associated with the signature.

Electronic signatures and handwritten signatures executed to electronic records shall be linked to their respective electronic records to ensure that the signatures cannot be excised, copied, or otherwise transferred to falsify an electronic record by ordinary means.