21 CFR Part 11 Compliant Electronic Records (Guide)

21 CFR Part 11 compliant electronic records represent the digital records that comply with the Food and Drug Administration (FDA) 21 CFR Part 11 regulation requirements.

The regulation aims to ensure the authenticity, integrity, and, when appropriate, confidentiality of electronic records used in FDA-regulated industries.

Life Science industries, such as pharmaceuticals, biotechnology, CRO, and medical devices, are required to maintain accurate and secure electronic records when operating in the US market.

The article discusses the definition of electronic records, requirements as per 21 CFR Part 11, and key recordkeeping system features. Moreover, it examines how an electronic QMS solution, like SimplerQMS, supports compliance with 21 CFR Part 11.

Life science companies have been increasingly adopting Document Management and electronic QMS solutions that are 21 CFR Part 11 compliant to simplify achieving and maintaining compliance.

The following topics will help you understand 21 CFR Part 11 compliant electronic records:

• Electronic Record Definition as per 21 CFR Part 11
• What are 21 CFR Part 11 Electronic Records Requirements?
• Key Electronic Recordkeeping System Features
• How SimplerQMS Meets 21 CFR Part 11 Electronic Records Requirements

Electronic Record Definition as per 21 CFR Part 11

Electronic records are defined as any combination of text, data, audio, or other information in a digital form managed within computer systems, according to 21 CFR 11.3(b)(6).

This means that text documents are not the only information assets included here, but also the following:

• Images
• Sound files
• Graphics
• Videos
• Test records
• Source code
• Spreadsheets
• And more

Companies subject to 21 CFR Part 11 must develop and implement procedures and controls for creating, maintaining, and transmitting electronic records. Employing such procedures and controls in compliance with the regulation helps ensure that records are genuine, confidential, and free from tampering.

In the Life Sciences, 21 CFR Part 11 can be applied to electronic records related to the safety, efficacy, and quality of human and veterinary drugs, medical devices, and biological products.

Here are three examples of electronic records used in Life Science companies:

• Electronic laboratory notebooks: Electronic notebooks are used to record the results of experiments and other scientific data. They are an important part of the scientific record and should be maintained in a secure and accessible manner.
• Manufacturing records: Manufacturing records are used to track the production of drugs, medical devices, and other products. They should be maintained in a way that allows for the traceability of materials throughout the entire product life cycle.
• Training records: Training records are used to document the training of employees. They should be able to provide evidence of employees’ skills and competency.

What are 21 CFR Part 11 Electronic Records Requirements?

The 21 CFR Part 11 outlines the electronic records requirements for procedures and controls Life Science companies must employ to ensure the authenticity and integrity of records.

All the requirements for electronic records are specified in the 21 CFR Part 11 Subpart B.

The following sections will briefly explain the electronic record requirements according to 21 CFR Part 11.

Controls for Closed Systems (Section 11.10)

A closed system means a secure environment where only authorized users can access electronic records.

Companies that use closed systems to handle electronic records should have procedures and controls to ensure that the records are authentic, complete, and secure as per 21 CFR 11.10.

These procedures and controls should also help to prevent people from denying that they are the genuine signers of a record.

Procedures and controls for electronic records must include the following:

• System validation: Ensure system performance is accurate and reliable and can detect invalid or altered records.
• Record generation: Generate accurate and complete copies of records in human-readable and electronic form.
• Record protection: Protect records so they can be retrieved accurately and easily throughout the retention period.
• System access: Limit system access to authorized individuals.
• Audit trails: Maintain secure, computer-generated, and time-stamped audit trails of operator entries and actions.
• System checks: Enforce a specific permitted sequence of steps and events in the workflow.
• Authority checks: Ensure only authorized individuals can use the system, sign records, access data, or alter records.
• Device checks: Validate the source of data input and operational instructions.
• Employee training: Ensure personnel have the necessary education, training, and experience to perform their assigned tasks.
• Quality policies: Establish written policies that hold individuals accountable for actions in records initiated under their name.
• System documentation: Implement appropriate controls over systems documentation, including distribution, access, and use.
• Revision and change control: Maintain an audit trail of the time-sequenced development and modification of systems documentation.

Controls for Open Systems (Section 11.30)

An open system means an environment where anyone can access electronic records.

Companies using open systems must implement the same requirements applicable to closed systems.

However, there is the need to use an extra layer of security with measures such as document encryption and appropriate digital signature standards as per 21 CFR 11.30.

If you want to learn more about the difference between open and closed systems, our article is a great place to start.

Signature Manifestations (Section 11.50)

In accordance with 21 CFR 11.50, electronic records that are signed must include the following information:

• The printed name of the signer
• The date and time of signature
• The meaning associated with the signature

This information regarding the electronic signature must be under the same controls as the electronic record and must be included in the document.

Signature and Record Linking (Section 11.70)

Electronic and traditional handwritten signatures must be linked to the electronic records they are signed on as per 21 CFR 11.70.

This measure prevents the signatures from being removed, copied, or transferred to falsify the records.

While this article focuses on the electronic records requirements specified in 21 CFR Part 11, it is important to note that several other requirements are outlined in this part of the regulation. Please refer to our article on 21 CFR Part 11 requirements to understand other requirements in this regulation.

Key Electronic Recordkeeping System Features

Utilizing key features and functionalities of an electronic recordkeeping system helps Life Science companies ensure that their electronic records comply with 21 CFR Part 11.

Here, we mention some key features of an electronic system regarding electronic records. Keep in mind that this is not an exhaustive list. Overall, the 21 CFR Part 11 compliant system should be able to ensure the authenticity, confidentiality, and integrity of electronic records.

The key features of an electronic recordkeeping system to comply with 21 CFR Part 11 include:

Record Generation

The ability to generate accurate and complete copies of records is essential for compliance with 21 CFR 11.10(b).

The system must be able to generate copies of records in both human-readable and electronic form. The written form should be easy to read and understand. And the electronic form should be suitable for inspection, review, and copying by the FDA.

Data Retrieval

The system must ensure that electronic records can be easily accessed and retrieved during their retention period as per 21 CFR 11.10(c).

This means that the system must have a robust search and retrieval capability. Users should be able to find the records they need using keywords easily. They should also be able to view and print the records in a timely manner.

Access Controls

The system should have robust access controls that prevent unauthorized users from accessing electronic records in compliance with 21 CFR 11.10(d).

Access controls should be based on the license type and user role, meaning users should only be given access to the records they need to perform their assigned tasks.

Passwords are an important type of access control, as they can restrict access to the system. Strong and unique passwords that are changed regularly can help to protect electronic records from unauthorized access. Read our complete article to learn more about password requirements as per 21 CFR part 11.

Comprehensive Audit Trails

The system should maintain comprehensive audit trails that track all actions related to electronic records as outlined in 21 CFR 11.10(e).

This includes who accessed the records, when, and what they did.

Audit trails can also be used during audits to show a complete sequence of events in the workflow, demonstrating if the processes are being followed accordingly.

Audit trails are useful for investigating unauthorized access, data manipulation, or other issues within the system.

Control of System Documentation

The system should offer controls to ensure documentation is accurate, complete, and up-to-date as mentioned in 21 CFR 11.10(k). This includes the quality manual, policies, procedures, work instructions, training materials, and so on.

Documentation should be stored in a secure location and accessible to authorized users only.

Signature Data

The system should associate signature information with signed electronic records as per 21 CFR 11.50.

The signature data includes the signer’s name, date, time, and purpose associated with this signature. This information should be included in the electronic record in both electronic display and printout versions.

How SimplerQMS Meets 21 CFR Part 11 Electronic Records Requirements

SimplerQMS can help Life Science companies achieve 21 CFR Part 11 compliance by providing a comprehensive eQMS solution for managing electronic records and quality documentation.

SimplerQMS provides features and functionalities specifically designed to comply with Life Science requirements, including 21 CFR Part 11.

Here are some of the key capabilities that help companies achieve 21 CFR Part 11 compliance regarding electronic records:

Validated System

As per 21 CFR 11.10(a), the system must be in a validated state to ensure that it is accurate, reliable, performs as intended, and can identify invalid or altered records.

SimplerQMS is a fully validated system according to ISPE GAMP5. We automatically revalidate the system when a new version is created, or standard updates are applied.

SimplerQMS execute all QMS software validation processes, so customers do not need to spend extra resources or time on software validation.

Time-Stamped Audit Trail

SimplerQMS provides a comprehensive audit trail of all activity in the system.

This audit trail includes information such as who accessed a record, when, and what they did with it. The audit trail is computer generated and always accurate and up-to-date.

For instance, it automatically tracks relevant data when records are edited, reviewed, approved, or retired. This automatically creates a document history and enables a way to compare changes and roll back to previous versions if needed.

Document Management

SimplerQMS offers a 21 CFR Part 11 compliant document management system. It is easy to create, review, approve, and store electronic records in compliance with the requirements.

Our software also provides automated workflow, version control, document change management, and more. This helps to ensure that documents are accurate, complete, and up-to-date.

Employee Training

Receive personalized training from SimplerQMS to learn how to use our quality management system. We offer unlimited training sessions and support for all QMS modules.

The training is conducted in a dedicated environment to improve users’ confidence before using the software.

Moreover, companies can create their own training to facilitate onboarding new employees. We offer a complete training management module with features to simplify training assignments, automate reminders and notifications, create quizzes, and more.

Electronic Signatures

You can efficiently sign electronic records with SimplerQMS 21 CFR Part 11 compliant electronic signatures.

Signatures are automatically linked to their respective electronic records to prevent falsification. This helps to ensure the authenticity and integrity of electronic records.

Watch the video below to learn how SimplerQMS simplifies document signing with 21 CFR Part 11 compliant electronic signatures and automated workflows, notifications, and reminders.

Secure Data Storage and Retrieval

SimplerQMS uses cloud storage to keep records secure and always available anywhere.

A search feature allows users to retrieve records using keywords in the title and content. This helps to ensure that records can be easily found and accessed when needed, for example, during audits.

Limited System Access

Our software connects with Microsoft Entra ID (previously known as Microsoft Azure Active Directory) to manage system access, ensuring secure authentication and authorization.

Only verified and authorized personnel can access the system and specific records. Users have unique identification codes and passwords to access the system. This helps to protect the confidentiality of electronic records.

SimplerQMS provides much more than a 21 CFR Part 11 compliant electronic recordkeeping system.

We provide comprehensive eQMS software that helps Life Science companies to comply with several requirements. This includes FDA 21 CFR Part 11, EU GMP Annex 11, ICH Q10, MDR and IVDR, FDA 21 CFR Part 210, 211, and 820, ISO 13485:2016, ISO 15189:2022, and more.

Our software offers broad QMS process support, and all Life Sciences QMS modules are integrated and work together seamlessly. This entails document management, employee training, change control, CAPA management, complaint management, audit management, supplier management, and others.

Getting started with your eQMS implementation could be as simple as downloading our eQMS Business Case template.

You can use this resource to evaluate the value of an eQMS for your company and present your findings to your management.

This template can help you ensure that all relevant factors have been considered and that you are making a compelling case for implementing an eQMS in your company.

Final Thoughts

The 21 CFR Part 11 outlines the electronic records requirements. Companies in FDA-regulated industries that use electronic records and signatures must comply with this part of the regulation to ensure electronic records’ authenticity, integrity, and confidentiality.

Several Life Science companies have been implementing 21 CFR Part 11 compliant software solutions to help achieve regulatory compliance, secure data integrity, and streamline processes while reducing costs.

SimplerQMS provides 21 CFR Part 11 compliant eQMS solutions tailored for Life Science companies. By streamlining quality management processes and eliminating manual paper-based documentation processes, we help improve efficiency and save costs.

We invite you to book a free demo and talk to SimplerQMS system experts. This will enable you to learn more about 21 CFR Part 11 compliant eQMS and how SimplerQMS can help you streamline quality management processes and achieve compliance faster.