21 CFR Part 11

The Title 21 Code of Federal Regulations Part 11 (21 CFR Part 11) provides compliance information regarding electronic records and electronic signatures. Within this part, requirements are created to help ensure security, integrity, and confidentially of electronic records and to ensure electronic signatures are as legally binding as hand-written signatures.^[1]

History

By the early 1990s, food and drug manufacturers approached the U.S. Food and Drug Administration (FDA) about the possibility of electronic submissions with electronic signatures. However, at that time the government did not allow for digital signatures. In July 1992, the FDA began soliciting comments about the process of using electronic signatures.^[2]

In March 1997, the FDA issued Part 11 regulations which, in the words of the FDA, were "intended to permit the widest possible use of electronic technology, compatible with FDA's responsibility to protect the public health."^[3] Various keynote speeches by FDA insiders early in the 21st century (in addition to compliance guides and draft guidance documents)^[3] as well as strong efforts by the FDA to motivate industry to move to e-filing^[4] resulted in many companies like Eli Lilly^[5], Agilent Technologies^[6], and other businesses rapidly being forced to change their methods and systems to adapt to the new standards.^[3]^[7]

However, many entities expressed concerns about the Title 11 conditions, including concerns the regulations would "unnecessarily restrict" the use of technology, add significant compliance costs beyond what was intended, and stifle technological innovation while reducing public health benefit.^[3] In November 2002, the FDA released the guidance document "Guidance for Industry 21 CFR Part 11; Electronic Records; Electronic Signatures, Electronic Copies of Electronic Records" to the public for commenting.^[8] On February 3, 2003, the FDA withdrew that document, stating "we wanted to minimize industry time spent reviewing and commenting on the draft guidance when that draft guidance may no longer represent our approach under the [current good manufacturing practice] initiative," adding it would afterwards "intend to exercise enforcement discretion with regard to certain part 11 requirements."^[3] Further guidance documents were withdrawn later that month, culminating in a final guidance document in August 2003 stating the government body would re-examine Part 11 and make necessary changes.^[3]^[9] This change in policy led many IT members in the pharmaceutical and life sciences industry in late-2004 to state one of the key problems they face is the lack of clear guidelines from the FDA about what is required for compliance.^[10]

The FDA had indicated it would produce a revised version of Part 11 by the end of 2006, after its Third Annual FDA Information Management Summit had concluded.^[11] Those revisions never arrived, and little in the way of updates on the topic arrived.^[12] On July 8, 2010, the FDA announced it would begin to audit facilities working with drugs "in an effort to evaluate industry's compliance and understanding of Part 11 in light of the enforcement discretion,"^[13] leaving some to wonder if this was an indicator the regulation and/or its guidance would finally see a revision.^[14]^[15]