Ensuring the Integrity of Electronic Health Records

The Best Practices for E-Records Compliance

Orlando López

• Publisher: Productivity Press
• Year: 2020
• ISBN:
  9781000223033
• Edition: 1
• Topic: Business
• Subtopic: Pharmaceutical, Biotechnology & Healthcare Industry
• Index: Business

Data integrity is a critical aspect to the design, implementation, and usage of any system which stores, processes, or retrieves data. The overall intent of any data integrity technique is the same: ensure data is recorded exactly as intended and, upon later retrieval, ensure the data is the same as it was when originally recorded. Any alternation to the data is then traced to the person who made the modification. The integrity of data in a patient's electronic health record is critical to ensuring the safety of the patient.

This book is relevant to production systems and quality control systems associated with the manufacture of pharmaceuticals and medical device products and updates the practical information to enable better understanding of the controls applicable to e-records. The book highlights the e-records suitability implementation and associated risk-assessed controls, and e-records handling. The book also provides updated regulatory standards from global regulatory organizations such as MHRA, Medicines and Healthcare Products Regulatory Agency (UK); FDA, Food and Drug Administration (US); National Medical Products Association (China); TGA, Therapeutic Goods Administration (Australia); SIMGP, Russia State Institute of Medicines and Good Practices; and the World Health Organization, to name a few.

Chapter 1

Introduction

DI is a critical aspect to the design, implementation, and usage of any system which stores, processes, or retrieves data. The overall intent of any DI technique described in this book is the same: ensure data is recorded exactly as intended and upon later retrieval, ensure the data is the same as it was when it was originally recorded. Any alteration to the data is traced to the person who performed the modification.

Records should be maintained to demonstrate that the quality system has operated effectively and that the specified requirements have been met.

Australian Code of Good Manufacturing Practice for human blood and blood components, human tissues and human cellular therapy products, April 2013.

Any possible concern related to the reliability of data must be identified and understood for appropriate controls to be put in place.

The responsibility regarding accurately handling electronic records (e-records) and the integrity of such e-records lies with the manufacturer or distributor undergoing inspection. These entities have full responsibility to assess their data handling systems for potential vulnerabilities and take steps to design and implement good e-records governance practices to ensure that e-records integrity is maintained (1).

Since the publication of my first book about DI (2) in 2017, the information about DI in the regulated industry has increased by the multiple publications drafted and finalized.

The new/updated publications since 2017 are:

• Health Canada Good Manufacturing Practices (GMP) Guidelines, Version 3 (GUI-0001), February 2018
• MHRA, GxP Data Integrity Guidance and Definitions, March 2018
• Russia Federal State Institute of Drugs and Good Practices (SIMGP), Data integrity and validation of computerized systems, August 2018
• PICS, Good Practices for Management and Integrity in Regulated GMP/GDP Environments (PI 041–1 (Draft 3)), November 2018
• US FDA, Data Integrity and Compliance with Drug CGMP. December 2018
• CEFIC, Practical risk-based guide for managing data integrity, March 2019
• WHO, Guideline on Data Integrity (Draft), October 2019
• US FDA and MHRA, Data Integrity in Global Clinical Trials, December 2019
• IPEC, Data Integrity for Pharmaceutical Grade Excipients, April 2020
• OECD, Advisory Document on GLP Data Integrity (Draft), August 2020
• NMPA (former CFDA), “Drug Data Management Practices Guidance,” December 2020

All guidance documents can be found at https://drive.google.com/drive/folders/1pB9XE29MuFpCBmNpQq0iG8RubmOCPe-u?usp=sharing

The industry has paid more attention to DI as a result of the regulatory agencies’ publications. In addition, the amount of materials published by regulated users is massive.

DI continues to be globally a major concern to all regulatory agencies.

This book is divided into 24 chapters and 5 appendices relevant to production systems and quality control systems and pertinent to medicine manufacturers.

This book updates previous written practical information to enable a better understanding of the controls applicable to e-records. It highlights the e-records suitability implementation and associated risk-assessed controls, and e-records handling (3).

Chapter 2, “E-records Lifecycle Revisited,” updates the electronic e-records lifecycle by adding two new phases to the typical lifecycle covered in the regulatory guidelines. These two new phases are related to the design of the e-records set. These two new phases are implemented before starting to collect e-records.

Chapter 3, “Data and E-records Lifecycles – A Comparison,” discusses the correlation between data and e-records lifecycle.

Chapter 4, “MHRA Guidance – Revisited,” is an analysis of the most recent revision (March 2018) guidance document of the Medicines and Healthcare Products Regulatory Agency (MHRA, United Kingdom (UK) medicines and medical devices regulatory agency).

The key expectations of EU CGMPs inspectors in the area of e-records integrity can be found in Chapter 5, “E-records Integrity Expectations of EU GMP Inspectors.”

Based on a presentation I did in August 2018 (4), Chapter 6, “Comparison of Health Authority E-records Integrity Expectations,” highlights the e-records integrity-related guidance documents published by Health Authorities only.

Chapter 7, “Maxims of E-records Integrity,” discusses the e-records integrity principles applicable to medicine manufacturing operations. The lifecycle, the validity and fidelity, and the reliability of e-records integrity depend on maxims or fundamental rules for the effective handling of e-records integrity.

The vulnerabilities of e-records may be used to undermine the quality of records and may ultimately undermine the quality of medicinal products (1). Chapter 8 examines the typical vulnerabilities of e-records. The risk assessment performed at the beginning of a records handling implementation uncovers these vulnerabilities. Based on Chapter 8, Chapters 9 and 10 discuss the risk assessment and the handling, respectively, of e-records vulnerabilities.

Chapter 11, “Security Service,” focuses on the security controls expected by worldwide regulatory agencies and competent authorities. Focal items include access control, password policy, and audit trails.

The required controls on computer-generated raw data in medicine manufacturing operations are discussed in Chapter 12, “Defining and Managing Manufacturing Data.”

Transient data controls are discussed in Chapter 13.

Chapter 14 considers the critical issue of date and timestamping in digital environments.

E-records migration is the process of transferring e-records and related metadata between one durable storage location, format, or computer system to another. This subject is addressed in Chapter 15.

Chapter 16, “Ensuring E-records Integrity of Cloud Service Providers,” provides the activities which the regulated entity and the cloud service provider must implement to safeguard the integrity of e-records.

Hybrid situations include combinations of paper records (or other non-electronic media) and e-records, paper records and electronic signatures, or handwritten signatures executed to e-records. Chapter 17 addresses the issues associated with records of hybrid systems.

Centered on information security, Chapter 18, “Technologies Supporting E-records Integrity,” provides a broad overview of the cryptographic technologies that can keep e-records integrity for any CGMP-regulated activity.

Chapter 19 describes the integration of the computer system and e-records lifecycles.

Chapter 20 covers miscellaneous e-records integrity issues such as BaaS, audit trails reviews, testing audit trails, database integrity, testing the retention of e-records, and e-records integrity in wireless environments.

A manufacturing-related e-records remediation project is re-examined in Chapter 21.

My advice on how to design e-records integrity into your practices is offered in Chapter 22.

Data integrit...