21 CFR Part 11: An FDA Regulatory Compliance for Electronic Records

Since 1997, hospitals, pharmaceutical companies and other regulated businesses have moved record keeping, retrieval and storage from paper to electronic systems at a rapid rate. The shift was driven largely by faster and safer data exchange around the world. Title 21 CFR Part 11, the FDA regulation on electronic records and electronic signatures, sets the rules that keep this data trustworthy and protected.

The FDA treats an electronic record as reliable only if it meets Part 11. Its requirements apply to every FDA-regulated organization that stores and maintains digital records, so that the records stay accurate and reliable and systems perform as intended. This article explains the main 21 CFR Part 11 compliance requirements and why they matter.

Who does 21 CFR Part 11 apply to?

The FDA enforces Part 11 for electronic records and electronic signatures. Besides medical device makers, the regulation affects biotech companies, biologics developers and other FDA-regulated industries.

The rule distinguishes between closed and open systems used to store electronic records. The requirements for the two differ slightly, based on how each system is accessed and secured.

What are the requirements for open and closed systems?

1. Security and validation in open systems. An open system must meet the same basic controls as a closed system, plus extra measures. Because an open system can be accessed by outside parties, such as a third-party software vendor, the added controls can include document encryption and digital signature standards to protect the integrity and confidentiality of records.
2. Limited access in closed systems. Companies must limit access to electronic records to authorized people. This protects the authenticity of the data. If an organization fails to meet Part 11, the FDA cannot treat its records as trustworthy.
3. Authority and device checks. Organizations must maintain authority checks and regular device checks. Validated record systems help ensure data integrity and authenticity, so that the systems produce authorized and secure data.

What does Part 11 require for electronic signatures?

Electronic signatures used in record systems must be shown in the records they sign. Each signature must also be linked to its record, which is called signature/record linking. This link confirms who the data belongs to and means a signature cannot be copied or moved to another record to falsify it. Part 11 also requires validated systems and audit trails so that signatures in electronic records can be traced.

1. Each signature belongs to one person, not a department or group. The organization must verify the person’s identity before assigning a signature. Organizations using electronic signatures must also certify to the FDA that those signatures are the legally binding equivalent of handwritten signatures. The certification is signed by hand and can be submitted in electronic or paper form.
2. Non-biometric signatures need at least two components, such as an identification code and a password. A signature must be used only by its genuine owner. The system should not let a user without the right permissions copy a signature from one document and attach it to another.
3. Passwords need special controls. Passwords should be changed periodically, and transaction safeguards should prevent unauthorized use. Loss management procedures should deal with lost or compromised security tokens, cards and other devices to stop security breaches.

What does FDA guidance say about Part 11?

Since it took effect, Part 11 has caused confusion across industries, particularly among medical device makers who use electronic records in clinical research. In 2003 the FDA issued guidance, “Part 11, Electronic Records; Electronic Signatures — Scope and Application,” which narrowed how the agency interprets the rule and explained what companies can do to comply. Companies must still follow Part 11 to stay within FDA regulations.

Key takeaways

Part 11 compliance rests on a few principles: control who can access records, validate the systems that hold them, and make sure every electronic signature is unique, linked to its record and protected by strong password controls.