Signatures, electronic

Drug, and Cosmetic Act and the Fair Packaging and Labeling Act. Color additives. Part 11 Electronic Records Electronic Signatures... 

Traditionally, documentation has been maintained on hardcopy paper systems. However, soft copy computer records are permitted provided it can be assured that the records can be maintained without corruption. More sophisticated systems that are used to create electronic records and electronic signature must be capable of... 

Another important aspect for discussion is the impact of regulations, spe-cihcally the regulation on electronic document management and electronic signatures, 21 CFR Part 11, published by the Food and Drug Administration (FDA) for the hrst time in 1997 [1] (also see Chapter 26, which covers 21 CFR Part 11 in detail). Since that time the draft rules of Part 11 have been withdrawn and reissued along with various guidance documents [2-3], Some of the key points of Part 11 are as follows ... 

FDA. Code of Federal Regulations, Title 21 Food and Drugs, Part 11 Electronic Records Electronic Signatures Final Rule, Fed Regr 62 (54), 13429-13466 (20 March 1997). 

FDA. Withdrawal of draft guidance for industry on Electronic Records Electronic Signatures, Electronic Copies of Electronic Records, Fed Regr 68 (23), 5645 (4 February 2003). 

FDA. Draft Guidance for Industry on Part 11, Electronic Records Electronic Signatures—Scope and Application Availability of Draft Guidance and Withdrawal of Draft Part 11 Guidance Documents and a Compliance Policy Guide, Fed Regr 68 (37), 8775-6 (25 Eebruary 1997). 

Computer applications allow for defining and managing several important nonclinical data types that are managed by the system itself. Such data are referred to as metadata or control data. These are information such as domain-specific descriptions, application conditions, parameters, and methods in a repository. Control data fields can be part of the data collection forms or in system-defined tables. Some of these control fields include electronic signatures, form status, transmission date, transmission number, field completed, and memo fields (large text format). The database contains tables for reference ranges, visit schedule, form schedule, labels, and drug codes. 

The first draft of the new requirement had draconian security requirements, softened (as is common) after a comment period Demands for biometric identifiers were replaced with password control options. But the revised final regulation was still broad in scope and necessitated extensive documentation and testing for all systems used in the industry (with even stronger controls if the user opted for electronic signatures). 

Electronic signatures and handwritten signatures executed to electronic records shall be linked to their respective electronic records to ensure that the signatures cannot be excised, copied, or... 

When an individual executes one or more signings not performed during a single, continuous period of controlled system access, each signing shall be executed using all of the electronic signature components. 

Demonstrate that electronic signatures are linked to their respective electronic records in a manner that prevents excision, copying, modifying, or otherwise transferring to falsify an electronic record by ordinary means (e.g., by opening in WordPad to edit, or by simple file operations). 

Demonstrate that user ID (an essential element of user ID/PW combination comprising the electronic signature) is not reusable by deletion/recreation, overwrite, or other means. 

Demonstrate that electronic signatures employ at least two distinct components (user ID and password). 

Demonstrate that the first signing of a continuous session uses all electronic signature components. 

Demonstrate that user ID is displayed at the time of application of the password to execute an electronic signature (i.e., at least one electronic signature component that is only executable by, and designed to be used only by, the individual). 

Demonstrate that passwords (one of the two components of electronic signatures) can only be known to the genuine owners, and cannot be viewed by anyone, including administrators of the account (at operating system and application level). 

Electronic signatures shall be administered and executed to ensure that attempted use of an individual s electronic signature by anyone other than its genuine owner requires collaboration of two or more individuals. 

Electronic signatures based on biometrics shall be designed to ensure that they cannot be used by anyone other than their genuine owners. 

Refer also to demo that use of invalid password does not allow access to system or permit electronic signature. 

Demonstrate that the system includes controls to detect multiple attempts at unauthorized use (e.g., repeated login attempts/failed password entry on login and electronic signature). 

---