Electronic record storage

General archival needs are controlled access, safe and appropriate storage, and retrievability. The types of items to be archived include paper, field samples, test chemical samples, and electronic records. In general the following types of archive facilities are needed sample freezers and cold rooms, test chemical freezers, file cabinets and/or boxes for paper, and magnetic media for electronic records storage. 

The archiving of electronic data poses more specific challenges. GLP requires records retention and retrieval of archival records. Since software used for the creation of electronic records is upgraded at a rapid pace, the requirement of retrievable archived records can be difficult to comply with. Even when stored on electronic media, the records have to comply with the records retention period and be retrievable. The collection, storage, and retrieval of electronic records should address all GLP aspects, including environmental conditions to ensure the integrity of the media. 

With electronic notebook studies, there will also be paper data to audit. This will include facility data (e.g., weather data, equipment maintenance records, storage temperature logs, personnel records, etc.) and study specific documents, such as faxes, e-mails, paper notes, etc. When paper data have been transcribed into the electronic notebook, they should be checked by QA to ensure accuracy. Any data that have been transcribed for whatever reason must be identified as such with the original raw data attached to them. QA should ensure that all paper data have adequate identification (e.g., study and trial numbers), that they are recorded per GLP, including dated signatures, and that all of the pertinent paper data or exact copies are sent to the Study Director for archiving. 

Automated dissolution equipment in most cases must be compliant with the FDA electronic records and electronic signatures regulation (21 CFR Part 11). The requirements of the regulation include use of validated systems, secure storage of records, computer generated audit trails, system and data security via limited access privileges, and the use of electronic signatures. 

The security strategy selected has to ensure that cells containing formulas (on purpose, by mistake, or by the auto-save function) of the spreadsheet cannot be overwritten. In today s standard office network environment, in some cases, the network itself is, not validated and does not fulfill the electronic record/electro-nic signature requirement. Therefore, the validated spreadsheets should be stored in a protected drive to which only restricted personnel have access. Furthermore, the server used for storage/handling should be qualified. Figure 18.7 is an example. 

Controlled Access. Access to the physical archives (e.g., file cabinets and freezers) is controlled by locks and the archive management. Access to electronic files is controlled by secret user identification (ID) numbers. Well designed electronic data storage software records or stores the ID number of any user that enters or changes data and when that entry or change occurred. 

Computer system documents are generated during the project. These documents may be either printed material or electronic records, such as computer files, storage media, or... 

For this definition, the primary attribute to take into consideration is whether the data is accessible once it is put into storage, not the retrievability of the record. This definition would consider data in transient memory to be an electronic record. 

In many circumstances, the supplied system will be based on a standard COTS product and include additional features that are superfluous in the intended context. These features cannot normally be disabled because they are integral to the COTS product. Such redundant features should be included in the Functional Specification, noted as superfluous and, if possible, rendered inaccessible to users within the implemented computer system. Standard features that support compliance, such as audit trails for electronic records, should be used even if not defined within the URS. In such circumstances it may be necessary to make additional design allowances for the inclusion of these features (e.g., for audit trail functionality, extra storage capacity may be required). Standard documentation for COTS products can be referenced by the Fnnctional Specification, if available for inspection, rather than reproduced. Care must be taken to refer to the correct version of COTS documentation and to keep cross-references up to date following any system upgrades. 

A regular review of data stored in the archive is essential not only as indicated earlier to detect any degradation of the storage media, but also to determine if the archive technology or record is becoming redimdant. Periodic assessments will be needed to decide whether or not to maintain the archive electronic records. It may be decided only to maintain critical records such as those involved with batch records, batch sentencing and recall, over longer periods of time. Once the retention period is over, a follow-on decision will need to be taken as to whether to retain the electronic records for a further period or to destroy them. The minimum retention times for some example electronic records is indicated in Chapter 12. 

This approach works well with simple data configurations (e.g., small self-contained data tables). Because industry standard formats are used, the risk of technical obsolescence is reduced and consequently the likelihood of archive migration minimized. Examples might include RTF rather than Microsoft Word 7 formats. Electronic records can also be stored as images (e.g., PDF format) although this increases storage volume requirements significantly. This method should not be used... 

Our investigator noted that the laboratory is nsing an electronic record system for processing and storage of data from the XXXX and HPLC instmments that is not set up to control the secnrity and data integrity in that the system is not password controlled, there is no systematic backnp provision, and there is no audit trail of the system capabilities. The system does not appear to be designed and controlled in compliance with the reqnirements of 21 CFR Part 11, Electronic Records. [FDA Warning Letter, 2002]... 

Workflow for approval of SOPs Electronic records and electronic signatures Facility for user requests to change an SOP Storage of forms and templates in original software Storage of previous, current, and under-revision versions Controlled distribution... 

From time to time it may be necessary to remove data or other electronic records from an on-line computer system to another durable secure location for long term off-line storage. This removal also includes the removal of the metadata associated with the record, for example, the properties of a Microsoft Word document or a series of data definition and table relationships. 

Many electronic records are associated with the applications that reside on Infrastructure servers and storage devices. These records are defined and the requirements for the specific management are defined in other chapters of this book. Needless to say, IT department System and Database Administrators will have access to such electronic records. The following controls should be apphed to System and Database Administrators ... 

Do adequate procedures exist for the archiving and retrieving of media and data, which includes (where needed) archiving and storage of obsolete software and hardware needed to retrieve the electronic records through the required period of retention 11.10(c)... 

The documentation of all aspects of a POCT service has been a major issue for many years, compounded by the fact that often the storage of data in laboratory and hospital information systems has been limited and often inconsistent. Thus it is critically important to keep an accurate record of the test request, the result, and the action taken as an absolute minimum. Some of the issues concerning documentation are now being resolved with the advent of the patient electronic record, electronic requesting, and better connectivity of POCT instrumentation to information systems and the patient record (see earlier discussion). The... 

Finally, software tools that can secure electronic records and enable safe storage of data have received considerable attention [65], These technologies allow for more streamlined approaches (i.e., electronic notebooks, paperless laboratories) and provide for the legal defensibility of patents and NCEs. 

Storage Media Failure. Electronic records in a storage facility exist in the form of physical media that can be compromised. Fire, explosion, contamination, electronic impulses (in some cases), flooding (in some cases), or simple longterm signal degradation (more a problem in some cases than others) can render content unrecoverable. 

Storage Media Incompatibility. Electronic records preserved on a particular form of media may in the long term be unrecoverable because the physical devices that read them may disappear from common use. 

Data Storage. The demand for paper and paper-based products continues to grow, despite the move to electronic data storage and communications and despite other strategies to reduce paper use. Understandably, society demands a more concrete record of its transactions than mere electronic and magnetic records, which can disappear in an instant. 

As mentioned before, we recommend a hardcopy record of the spectrophotometer signals in addition to a mere printing of the analytical results of the samples, to monitor the system performance and as a safety backup, independent of electronic data storage. 

---