Data Integrity in Pharmaceutical and Medical Devices Regulation Operations

Best Practices Guide to Electronic Records Compliance

Orlando Lopez

• Publisher: Productivity Press
• Year: 2016
• Print ISBN: 9781032339887
• eBook ISBN: 9781315349978
• Topic: Business
• Subtopic: Operations
• Index: Business

Data integrity is fundamental in a pharmaceutical and medical devices quality system. This book provides practical information to enable compliance with data integrity, while highlighting and efficiently integrating worldwide regulation into the subject. The ideas presented in this book are based on many years' experience in regulated industries in various computer systems development, maintenance, and quality functions. In addition to case studies, a practical approach will be presented to increase efficiency and to ensure that the design and testing of the data integrity controls are correctly achieved.

Chapter 1

Introduction

Global medicines regulatory systems include guidelines on the use of computer systems to conform to regulations governing medicine manufacturing practices and the applicable controls that must be in place to ensure the integrity of e-records throughout the retention period.

Currently, the integrity of e-records is a major global concern for, among others, the U.S. Food and Drug Administration (FDA), Australia’s Therapeutic Goods Administration (TGA), Canada’s Health Products and Food Branch Inspectorate, and European Regulatory Agencies. Multiple FDA Warning Letters and EU Good Manufacturing Practice (GMP) Noncompliance Reports (Chapter 2) have emphasized the volume of key e-records integrity failures in regulated life science industries.

Poor e-records integrity by regulated entities is considered to be a serious GMP deficiency. Such deficiencies demonstrate that quality control systems do not adequately ensure the integrity of the records generated and stored by these regulated entities.

In response to deficiencies in preapproval inspections (PAIs) documentation, the US FDA issued CPG 7346.832, which has been in effect since May 2012. CPG Objective 3 covers the authentication of data submitted in the Chemistry, Manufacturing, and Controls (CMC) section of the PAIs application, including audits of laboratory e-records integrity. In August 2014, the US FDA issued Level 2 guidance covering shared computer login authentication.*

In 2011, the European Medicines Agency (EMA) increased the number of clauses relating to e-records integrity in Annex 11 to the EU GMP guide (Chapter 6).

EMA Annex 11 was expanded by the Medicines and Healthcare Products Regulatory Agency (MHRA), Britain’s Medicines and Medical Devices Regulatory Agency, to include the expectation that regulated life science industries must review the effectiveness of their governance systems (Chapter 10). The purpose of these reviews is to ensure data integrity and traceability. In March 2015, MHRA issued a second revision of the GMP Data Integrity Definitions and Guidance for Industry (Chapter 9). This guidance document outlines an e-records integrity governance program, and principles for defining quality and e-records integrity in processes and systems. In addition, the guidance document defines terms and provides associated expectations and examples for many of these (Chapter 4). The MHRA guidance document may be used to ensure a common understanding of terms and concepts.

As regulatory agencies and competent authorities tighten up their inspection requirements, it is important that managers, supervisors, and users in regulated entities understand the issues around e-records integrity. Improved governance programs must be implemented to ensure that computer systems performing GMP-regulated functions correctly process e-records.

This book is relevant to production and quality control systems used when manufacturing medicinal products. It provides practical information to enable e-records integrity regulatory requirements compliance, while highlighting best practice for e-records maintenance, associated risk-assessed controls, and e-records management.*

Chapter 2 summarizes examples of e-records integrity issues as documented by US FDA, Europa, Health Canada, and World Health Organization (WHO).

Chapter 3 discusses the e-records life cycle. This life cycle needs to be understood to effectively manage e-records and to ensure their integrity.

Chapter 4 reviews terms introduced by the GMP Data Integrity Definitions and Guidance for Industry, published by MHRA in 2015, in the context of a typical manufacturing environment. Appendices V through VII include examples of e-records for nonclinical laboratories, clinical systems, data warehousing, and business intelligence.

While GMPs vary globally, the e-records management requirements identified are broadly similar.* Chapters 5 through 7 discuss e-records controls in US FDA 21 CFR Part 211, EMA Annex 11, and other GMP-related regulations and guidelines.

Chapter 8 discusses the controls associated with trustworthy computer systems. To ensure the integrity of e-records, it is essential that the systems managing these e-records must also be trustworthy.

Chapter 9 analyzes MHRA Data Integrity Definitions and Guidance, the first guideline published by a regulatory agency.

Chapter 10 examines e-records integrity governance. This is a key element to effectively managing and maintaining e-records integrity.

The appropriate management of e-records requires a considered implementation of integrated system controls, some procedural (e.g., segregation of duties, standard operating procedures), some physical (e.g., different locations to establish redundancy), and some electronic (e.g., computer security rights and roles). Chapters 11 through 15 cover good data integrity practices (GDIP) to ensure e-records integrity (content, structure, and context). These practices are implemented via technical and procedural controls that are discussed in these chapters.

Chapters 16 and 17 address e-records in contract manufacturing and cloud service environments.

Chapter 18 addresses how internal audits can uncover e-records integrity issues.

Chapter 19 briefly discusses data integrity remediation activities. Chapter 20 provides a summary of critical e-records integrity issues. Appendix III contains a tabulated comparison between EMA Annex 11, 21 CFR Parts 11, 211 and 820, and many other global regulations.

To provide additional supporting information, this book references relevant abridged regulations and guidelines.

Rather than developing an industry standard, this book is intended to provide guidance on how the industry can effectively manage e-records and improve basic compliance.

With the exception of the definition of “Data Integrity,” this book is consistent with the MHRA’s data integrity guidance document.^†

The recommendations on implementing controls to avoid issues with e-records integrity described in this book are the author’s opinion. They are not intended to serve as official implementation processes as specified by regulatory agencies.

Additional Readings

MHRA, MHRA expectation regarding self inspection and data integrity, May 2014.

Sampson, K., Data integrity, The Food and Drug Law Institute, 6, 6–10, 2014. http://www.nxtbook.com/ygsreprints/FDLI/g46125_fdli_novdec2014/index.php#/0.

US FDA, FDA PAI Compliance program guidance, CPG 7346.832, Compliance Program manual, May 2010. http://www.ipqpubs.com/wp-content/uploads/2010/05/FDA_CPGM_7346.832.pdf.

*  FDA, Questions and answers on current good manufacturing practices, good guidance practices, level 2 guidance: Records and reports, 2015, http://www.fda.gov/Drugs/GuidanceComplianceRegulatoryInformation/Guidances/ucm124787.htm.

*  Data handling: The process of ensuring that data is stored, archived, or disposed in a safe and secure manner during the data life cycle.

*  GAMP^®/ISPE, Risk Assessment for Use of Automated Systems Supporting Manufacturing Process: Risk to Record, Pharmaceutical Engineering, Nov/Dec 2002.

†  MHRA, MHRA GMP Data Integrity Definitions and Guidance for the Industry, March 2015.

Chapter 2

Inspection Trends*

Since 2004, inspection trends worldwide have focused on issues related to the integrity of e-records with the issue also coming to prominence in the United States since 2007 (Figure 2.1).

Three major cases on e-records integrity were reported in the United States in 2006 and 2007: Able Laboratories (2006), Leiner Healthcare Products (2007), and Actavis Totowa (2007).

The Actavis Totowa case related to inconsistencies between e-records and notebook data. The U.S. Food and Drug Administration (FDA) also recorded that there was no evidence of the manufacturer checking the accuracy of data files.

Based on 2007 inspection findings similar to the aforementioned, the US FDA has refocused on the int...

Table of contents

• Cover
• Half Title
• Title Page
• Copyright Page
• Dedication
• Table of Contents
• Foreword
• Preface
• Authors
• Contributors
• 1 Introduction
• 2 Inspection Trends
• 3 Electronic Records Life Cycle
• 4 Electronic Records Related Definitions
• 5 Electronic Records Handling: 21 CFR Part 211
• 6 Electronic Records Handling: EMA Annex 11
• 7 Relevant Worldwide GMP Regulations and Guidelines
• 8 Trustworthy Computer Systems
• 9 MHRA Guidance
• 10 Electronic Records Governance
• 11 Procedural Controls for Handling E-Records
• 12 Electronic Record Controls: Supporting Processes
• 13 Electronic Records Controls: Records Retained by Computer Storage
• 14 Electronic Record Controls: During Processing
• 15 Electronic Record Controls: While in Transit
• 16 Electronic Records and Contract Manufacturers
• 17 Electronic Records and Cloud Computing
• 18 Self-Inspections
• 19 Electronic Records Remediation Project
• 20 Summary
• Appendix I
• Appendix II
• Appendix III
• Appendix IV
• Appendix V
• Appendix VI
• Appendix VII
• Appendix VIII
• Appendix IX
• Appendix X
• Index