Halloran’s Feedback on FDA’s Electronic Systems, Records, and Signatures Guidance

Recently at CORE West – a Clinical Operations Retreat for Executives produced by Halloran Consulting Group – clinical operations executives and life science leaders gathered to discuss opportunities to modernize clinical trials. A particular discussion engaged the audience with an interactive workshop, gathering feedback to share with the U.S. Food and Drug Administration (FDA) on their recent draft guidance, “Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations.”

This draft guidance provides recommendations about the requirements under Title 21 CFR Part 11 (CFR part 11), under which the FDA considers electronic systems, electronic records, and electronic signatures to be trustworthy, reliable, and generally equivalent to paper records and handwritten signatures executed on paper.

It’s been quite some time since this framework has been updated. In March 1997, the FDA published a final rule to establish criteria that generally must be met when a record is created, modified, maintained, archived, retrieved, or transmitted in electronic form in place of a paper record and when electronic signatures are used in place of traditional handwritten signatures.

Later in 2003, the FDA issued a Part 11 guidance, providing recommendations narrowly tailored to reflect the technological environment that existed at the time. The FDA later released a draft guidance in 2017, acknowledging advances in technology have expanded the uses and capabilities of electronic systems in clinical investigations. Now, the FDA has released a draft guidance further addressing the applicability of part 11 as technological advancements continue to impact the industry.

By addressing topics such as information technology (IT), service providers, clinical investigator sites, digital health technologies (DHTs), and real-world data (RWD), it’s our perspective this guidance expands CFR Part 11 in order to meet the modernization of today’s clinical trial operations. Also of note, the guidance reemphasizes risk-based validation by providing additional details on this modern approach as well as clarified guidelines on certified copies and electronic signatures.

Product developers, sponsors, sites, patients, and technology vendor companies engaging in clinical trials are all impacted by this guidance. Because of this large scope impact, we saw the value in holding an interactive workshop at CORE West to gather industry feedback to share with the FDA so the final guidance may reflect insight from the industry and provide more clarity.

FDA Guidance – Impact on Clinical Research

Through this draft guidance, many components previously considered a grey area are now clearly in scope, demonstrating the FDA’s continued attention to the expanded use of technology supporting life sciences. For instance, prior to this draft guidance, the scope of Part 11 was limited to electronic records specifically required by the predicate rule. The new draft document expands the scope to include electronic records used to support regulated activities and those necessary to reconstruct a clinical trial. With this distinction in mind, we’ve considered the implications of this guidance and, through a thoughtful discussion at CORE West, identified opportunities for additional clarification.

Recognized Roles of IT Service Providers and Clinical Investigator Sites

The FDA illustrates an increased focus on the role of IT service providers in clinical trials. They recommend sponsors ensure IT service providers have clear data integrity processes covering topics such as validation, certified copies, record retention, user access controls, confidentiality of data, and electronic signatures. Participants at CORE West felt further clarification would be beneficial around leveraging vendor documentation and the associated FDA expectations during an inspection. When it comes to oversight of IT service providers, participants raised the following question: “Will the FDA want to see evidence of compliance other than audit reports?”

The FDA also highlights the responsibilities of clinical investigator sites that use their own electronic systems in support of clinical trials. By defining what the FDA expects during clinical investigator site inspections, they emphasize the importance of procedures, system controls, training, and record retention at the sites.

Data Integrity Considerations for Digital Health Technologies and Real-World Data

The draft guidance also includes important details regarding DHTs and the FDA’s expectation that the integrity of data captured through DHTs is maintained throughout the entire data lifecycle. The attention on this topic encourages the industry to carefully consider data capture, attribution, transfer, and retention when utilizing DHTs for regulated activities. At the CORE West workshop, attendees noted additional details could be provided for audit trial requirements given the industry’s limited experience in the DHT space. 

The topic of Real-World Data is also addressed in the draft document. The FDA makes clear that sponsors are to ensure the quality and integrity of electronic records submitted to the FDA as part of their marketing application, even if the electronic records are from RWD sources not originally created in part 11-compliant systems with the intention of being submitted. This spurred discussion amongst CORE West attendees resulting in questions to the FDA, including:

• What are the minimum elements of data integrity?
• How far back do you need to go?
• Do you need a full audit trail?

Continued Emphasis on Risk-Based Validation, Certified Copies, and Electronic Signatures

The FDA reemphasizes its view – validation strategy for computerized systems should be driven by a documented risk assessment – considering the potential of the system to affect product quality and record integrity. The draft guidance clearly outlines considerations for applying a risk-based approach to validation including intended use of the system and the criticality of the data being collected. CORE West attendees appreciated the clarity provided on this topic but felt additional details would be valuable to successfully operationalize a risk-based validation. One of the biggest questions was around the different dimensions of risk – are they limited to patient safety, data integrity, and product quality? What other elements of risk should be considered, if any?

The draft guidance also addresses certified copies by outlining the process a sponsor should follow for generating a certified copy. The metadata requirements, retention, and backup of electronic copies were further clarified in the section. CORE West workshop participants noted some vendors provide the service of creating certified copies and wondered how sponsors may successfully ensure the compliance of the process when done at such a high volume.

Electronic signatures have always been at the center of CFR Part 11, and this draft guidance continues to answer questions about electronic signature methods and identity verification. It still remains clear that the FDA will not accept signatures drawn with a finger or an electronic stylus as a form of electronic signature. Examples of methods for identity verification are provided, though CFR Part 11 does not specify what specific method(s) need to be used.

CORE West attendees further asked, “What standard do mobile platforms use to capture an electronically drawn signature need to meet?” Attendees also highlighted that scenarios may arise where users are asked to provide their wet ink signature as identity verification before they are allowed to use the validated electronic signature platform. The following question was later posed, “Could it be agreed that it’s okay to authenticate a user for a validated electronic system without requiring the user’s wet ink signature?”

Conclusion

As expected, the FDA will release draft guidances per requirements set forth in the Food and Drug Omnibus Reform Act of 2022 (FDORA) over the next two years. It is crucial for the industry to review each of these guidance documents and think critically about the impact on their clinical investigation operational processes. Since most of these guidance documents will be released with a request for comments and suggestions, we encourage the industry to engage with the FDA by submitting input to ensure that we, as an industry, have a voice in the direction of the compliance framework governing clinical investigations.

To discuss this guidance and its impact on your clinical investigations, contact Halloran.