Paul Bleicher

It is my experience that new regulations or guidance need to be mulled over and discussed for a while before they can be adequately assessed. Subtle use of language in a guidance, intended or otherwise, is best understood after many people have read, thought about, and interpreted the document. Therefore, this quick look is simply that—a general first impression, where I will point out a few interesting features of the new Guidance.

This discussion doesn't reflect the thinking or conclusions of any organization or company with which I am associated—or this magazine. In fact, by the time it is published, it may not even reflect my thinking. Disclaimer accomplished, and now we will turn to the document.

For those who are unfamiliar with the history of this document, it is worth a brief narrative.

The Electronic Records, Electronic Signature regulation, known as 21 CFR Part 11, was created to address issues around the quality, security, and integrity of data obtained from electronic systems that would be used in support of a marketing application. Part 11 was published in April 1997 and took effect in August 1997 after a long period of comment on a previously published draft version.

It was viewed as a landmark regulation that served as a model for other governmental executive branch agencies with similar concerns about data integrity. Of particular note, the FDA mandate doesn't extend directly to computerized systems, except where they are incorporated in medical devices. However, the predicate rule of Good Clinical Practice (GCP), which dictated important principles of data integrity in a paper-based system of data collection, was seen as equally applicable in electronic systems and created the framework from which Part 11 was designed, and through which it could be enforced.

In reading the Part 11 preamble and regulations, it is clear that the drafters worked diligently to create a stringent yet workable framework that could be applied across a broad range of different systems from manufacturing to clinical trials and beyond. The inclusiveness of the language naturally led to significant areas where sponsors and others were unclear on interpretation, intended enforcement rigor, and intent.

In addition, the pace of development and approval of new regulation and guidance is much slower than the pace of new developments in information technology. This was manifest in the regulation by an apparent discrepancy in emphasis vs the realities of information technology. Two examples at the extremes are the repeated mention and potential bias toward biometric authentication and the very limited consideration of the Internet, which was just beginning to transition at the time from novel and exciting technology to the essential business tool that it is today.

A guidance is born

FDA published the Guidance for Computerized Systems Used in Clinical Trials (GCSUCT) in 1999 to address the rapidly developing field of electronic data capture and other technologies and to clarify some of the areas of confusion that had arisen in interpreting Part 11.