21 CFR Pt. 11 Compliance with Electronic Signatures

In 21 CFR Part 11, the Food and Drug Administration (FDA) establishes its requirements for electronic records and signatures. These regulations, which apply to all or any FDA program areas, were intended to allow the widest possible use of electronic technology, compatible with FDA's responsibility to guard the general public health.

 

The DocuSign Agreement Cloud is employed by pharmaceutical and medical device companies to satisfy a variety of compliance requirements, including those set forth within the Code of Federal Regulations Title 21 Part 11.

 

We have an entire guide to CFR Part 11 and electronic signatures with samples of how DocuSign solutions satisfy requirements.

 

Here we’ll summarize subpart C of CFR Title 21 Part 11, which outlines requirements associated with the utilization of electronic signatures.

 

What is 21 CFR Part 11?

Title 21 CFR Part 11 is that the a part of Title 21 of the Code of Federal Regulations that establishes the us Food and Drug Administration regulations on electronic records and electronic signatures.

 

The term “Part 11” applies to records in electronic form that are created, modified, maintained, archived, retrieved, transmitted or submitted, under any records requirements set forth by the FDA regulations/predicate rules.

 

Life science organizations and device manufacturers regulated by the FDA are required to follow the Code of Federal Regulations Title 21 Part 11.

 

The FDA also issued a guidance paper “Part 11, Electronic Records; Electronic Signatures — Scope and Application” to supply further clarification on electronic records and electronic signatures.

 

What does 21 CFR Part 11 require associated with electronic signatures?

The FDA allows electronic signatures to be utilized in place of pen and ink signatures on paper documents in order that business are often conducted digitally. so as to be compliant electronic signatures must include:

 

The printed name of the signer

The date and time the signature was executed

A unique user ID

Digital adopted signature

The meaning of the signature (labeled “signing reason”)

What are the opposite requirements for electronic signatures?

Below are the wants as outlined in subpart C on electronic signatures:

 

Each electronic signature must be unique to at least one individual and not reused by, or reassigned to, anyone else. Subsection 11.100(a)

 

The identity of the individual must be verified before establishing, assigning, certifying or otherwise sanctioning the individual’s electronic signature, or any element of such electronic signature. Subsection 11.100(b)

 

Persons using electronic signatures shall, before or at the time of such use, certify to the agency that the electronic signatures in their system, used on or after August 20, 1997, are intended to be legally binding equivalent of traditional handwritten signatures. Subsection 11.100(c)

 

Persons using electronic signatures must, upon agency request, provide additional certification or testimony that a selected electronic signature is that the legally binding equivalent of the signer’s handwritten signature. Subsection 11.100(c.2)

 

Electronic signatures that aren't based upon biometrics must employ a minimum of two distinct identification components like an identification code and password. Subsection 11.200 (a)(1)

 

When a private executes a series of signings during one , continuous period of controlled system access, the primary signing must be executed using all electronic signature components. Subsequent signings must be executed using a minimum of one electronic signature component that's only executable by, and designed to be used only by, the individual. Subsection 11.200 (a)(1)(i)

 

When a private executes one or more signings not performed during one period of controlled system access, each signing must be executed using all of the electronic signature components. Subsection 11.200 (a)(1)(ii)

 

The uniqueness of every combined identification code and password must be maintained such no two individuals have an equivalent combination of identification code and password. Subsection 11.300(a)

 

Identification code and password issuances must be periodically checked, recalled or revised (e.g., to hide such events as password aging). Subsection 11.300(b)

 

Loss management procedures must be followed to electronically deauthorize lost, stolen, missing or otherwise potentially compromised tokens, cards and other devices that bear or generate identification code or password information. The system must issue temporary or permanent replacements using suitable, rigorous controls. Subsection 11.300(c)

 

The system must use transaction safeguards to stop unauthorized use of passwords and/or identification codes, and to detect and report in an instantaneous and urgent manner any attempts at their unauthorized use. Subsection 11.300(d)

 

A procedure must be in situ for initial and periodic testing of devices like tokens or cards that bear or generate identification code or password information to make sure that they function properly and haven't been altered in an unauthorized manner. Subsection 11.300(e)