StarCast: Complying with US FDA Title 21 CFR Part 11 for the Life Sciences Industry
Based on our interpretation of the Part 11 rule and the functions and features discussed in this document, VeriLogix, Inc. believes that StarCast, when upgraded to include FDA Version Control and the eSignature data structure, technically complies with the intent and requirements of 21 CFR Part 11 and several international GMP guidelines. StarCast continues its long-standing partnership with the life sciences industry and provides technology, tools and solutions to its pharmaceutical, medical manufacturing and biotechnology customers. StarCast provides an opportunity for customers to promote FDA compliance while reducing their costs and maximizing their return on investment.

Disclaimer

This web page and information is subject to change without notice. VeriLogix' compliance analysis with respect to StarCast software performance based on 21 CFR Part 11: (i) in no way expresses the recognition, consent or certification of StarCast software by the US FDA, and (ii) applies to certain components of StarCast only as stated herein. The customer is solely responsible for compliance with all applicable regulations, and Verilogix has no liability or responsibility in this regard. This specification is provided by VeriLogix for informational purposes only, without representation or warranty of any kind, and VeriLogix shall not be liable for errors or omissions with respect to the materials. The only warranties for VeriLogix products and services are those that are set forth in the warranty statement accompanying such products and services, if any. Nothing herein should be construed as constituting an additional warranty.

Purpose

The purpose of this web page is to describe the functions and features of StarCast that, in the opinion of VeriLogix, demonstrate technical compliance with 21 CFR Part 11 Electronic Records, Electronic Signatures and several GMP guidelines that have similar requirements. Compliance by StarCast with 21 CFR Part 11 is predicated on that customer's StarCast system containing Version Control and the eSignature data structure and a Private-Server (discussed below).

The US FDA regulation 21 CFR Part 11 Electronic Records, Electronic Signatures was the result of a 6 year study by the FDA to supply all FDA regulated companies with requirements on how a "paperless" record system could be maintained while still complying with GxP. In February 2003, the FDA withdrew all Part 11 guidelines because concerns were raised that their then current regulations would "discourage innovation and technological advances without providing a significant public health benefit." Then, in August 2003, the FDA published final guidance for Part 11 which reduced the scope of Part 11 and made hybrid systems acceptable under Part 11.

FDA defines an electronic record as "any combination of text, graphics, data, audio, pictorial or other information representation in digital form that is created, modified, maintained, archived, retrieved or distributed by a computer system." As it relates to StarCast, there are various types of electronic records, such as:

      ·   Courses
      ·   Documents
      ·   Tests
      ·   Surveys
      ·   Training Plans
      ·   Electronic signatures

Content Versioning

StarCast, when upgraded to include Version Control and the eSignature data structure records and stores each version of a course, document, test, survey or training plan, and marks each subsequent version with the individual who uploaded the original content or made subsequent changes. This record is date and time stamped and maintains the old and new values for each of the fields that have been changed in addition to the user ID of the person who made the change.

StarCast uses server time in Los Angeles for logging activities, which is unique and unequivocal. For customers with multiple time zones, procedures must be in place to define time zones interpretations for each site, which should include daylight savings time requirements.

Consequent to FDA’s systems based inspection approach, VeriLogix may need to be consulted in the event of an FDA audit to provide reports or data extracts. VeriLogix participation in FDA audits carries separate costs and charges.

Electronic Signature

Part 11 provides requirements under which FDA will consider electronic signatures as equivalent to traditional handwritten signatures. Part 11 does not delineate where electronic records and electronic signatures are required. Instead, FDA specifies that these requirements are defined by the "predicate" rule, such as GMP for finished pharmaceuticals (21CFR Part 211) and medical devices (21CFR Part 820).

The following are definitions as written in 21 CFR Part 11:

Electronic Signature – Electronic signature means a computer data compilation of any symbol or series of symbols executed, adopted, or authorized by an individual to be the legally binding equivalent to the individual's handwritten signature.

Closed System – Closed system means an environment in which system access is controlled by persons who are responsible for the content of the electronic records that are on the system. For companies wanting to maintain a strict "closed system environment", they must choose the Private Server option for their StarCast system, whereby their system is housed in a physically separate server within VeriLogix' server arrays.

StarCast provides for Electronic Signatures with authorization by user ID and password which does not require an external PKI security product. To insure the integrity of signatures, StarCast provides the following safeguards.

      ·   When the number of failed logon attempts is exceeded, StarCast prevents the user from further access without intervention of a systems admin.
      ·   An email is generated to the system admin(s) notifying them of a potential security breach.
      ·   An electronic record of failed attempts is maintained by StarCast

StarCast Part 11 Functions

StarCast allows designated courses, documents, tests and/or surveys to be earmarked for signature verification. The signed electronic records contain the name of the signer, the date and time the signature was executed, the meaning associated with the signature and a statement that the user has read, listened to or viewed the material and understands its meaning, and confirms this by electronic signature. The signed electronic records meet the "electronic signature linking" requirement of 21 CFR Part 11 which specifies that if the electronic signature is tampered with, or the file containing the signature is separated from the transaction record, the tampering is evident.

1. If a course or document carries an attached test, the system allows the test to be repeated until the user achieves a passing score, at which time the electronic verification process is invoked. If the test is set to "single-try", "limited-tries" or "limited-tries with a time gap between tries", and the user fails the exam, a failure notice is sent to the system administrator.
2. The system allows administrators to change all passwords, system wide, on a periodic basis.
3. The system contains a time-stamped and unalterable audit trail that records the date and time of user entries that create, modify or delete electronic records.
4. The system allows administrators to establish automatic distribution lists for courses, documents, tests or surveys. Upon significant update of content, the system administrator may direct the system to automatically redistribute the revised content to those on the distribution list for re-verification.
5. The system allows the generation of accurate and complete copies of verification records suitable for inspection, review and copying by the FDA.
6. Access to the system is by role-base authority.
7. Version-Control allows the system to time-stamp exactly which version of a course, document, test or survey the user read, viewed or listened to, and to permanently link that version to that user's history in a way that the user can not readily repudiate the signed record as not genuine.
8. Version control allows you to verifiably remove (or prevent from use) obsolete content from circulation, while maintaining historical documentation.

For further questions or discussions on this document or US FDA Title 21 CFR Part 11 for the Life Sciences Industry, please contact VeriLogix, Inc.