Reflections on FDA Q&A draft guidance on Use of Electronic Records and Electronic Signatures

The FDA has recently issued a draft guidance on “Use of electronic records and electronic signatures in clinical investigations under 21 CFR Part 11 – Questions and Answers”.

In 1997, the FDA published a final rule to define specific criteria that are to be met when a record required by the Federal Food, Drug and Cosmetic Act (FD&C Act), the Public Health Service Act and FDA regulations (other than part 11) is created, modified, maintained, archived, retrieved, or transmitted electronically instead of in paper format. This also applies to electronic signatures when used in place of ink signatures.

electronic signatures FDA

The part 11 regulations apply to all FDA program areas and the intent was to make electronic technology use as widespread as possible,  but at the same time to assure protection of public health as well as ensuring electronic records are authentic, reliable and maintain data confidentiality.

In 2003, the FDA issued a significant draft guidance document on the scope and application of 21 CFR Part 11. The guidance contained recommendations to provide a practical interpretation of Part 11 requirements.

Since 2003, electronic technologies have made significant advances, expanding the use of electronic systems in clinical investigations. More advanced electronic systems now include improved features such as audit trails, automated date-time stamps etc which are now standard components of the majority of electronic systems.

In this latest draft guidance, the FDA clarifies which aspects of Part 11 must be implemented in the technological environment. The guidance also highlights  the importance of validation of electronic systems, their ability to generate copies of records and to archive records and the use of audit trails as powerful tools to ensure quality and reliable electronic records.

The FDA is continuing to encourage sponsors to use a risk-based approach when deciding to validate electronic systems, implement audit trails, or archive required records for clinical investigations. Example of electronic systems used in clinical investigations include:

  • eCRFs
  • Electronic Data Capture (EDC) systems
  • Electronic Clinical Trial Management System (eCTMS)
  • Interactive Voice Response System (IVRS) and Interactive Web Response System (IWRS)
  • Electronic Patient Reported Outcomes (ePRO)

The FDA provided a Q&A document to better clarify the scope and application of Part 11 requirements in clinical investigations. The guidance is divided into three main parts:

  1. Electronic Systems
  2. Outsourced Electronic Systems
  3. Mobile Technology

In the first part, questions are focused on validation strategy for electronic systems and tips to properly evaluate if 21 CFR part 11 applies to a specific record or process you are managing in your company. The relationships between a paper and an electronic record are also stressed: as an example, it is very important to take into consideration that an electronic file has embedded data to avoid any data loss when printing it.

As also reinforced by the recent update of the ICH E6 (R2), the Sponsor, when outsourcing, should adequately verify the vendor capabilities and ensure proper oversight of all study activities.

This means not only signing a contract and having regular meetings but the Sponsor mustbe aware of the physical location in which the data are stored and if they will be moved or managed according to the privacy law which could be different between countries.

Today, the use of mobile phones and tablets with specific apps and high-tech devices capable of recording your heart rate or blood pressure are becoming more and more common. The use of such technology could improve the efficiency of data collection during a trial but it should be compliant with part 11.

Implementing the part 11 rule on mobile phones is not an easy task because the rule doesn’t specifically talk about that: the FDA clarifies many different situations with this simple approach of Q&A and its intention to push it forward is now even clearer.


There are 28 Q&A in the document which are all relevant and interesting, but some are more pertinent to companies that use in-house developed systems or cloud systems. Some extracts below:

Q1. What should sponsors consider when using a risk-based approach for validation of electronic systems used in clinical investigations? 

Sponsors should use a risk-based approach for validating electronic systems owned or managed by sponsors. The extent of validation should be tailored to the nature of the system and its intended use. It is worth mentioning that even if using a cloud system validated by the vendor, the system should anyhow be validated by the company utilizing the system, to ensure compliance with company processes and procedures.

Q2. Under the scope of 21 CFR part 11, what will be FDA’s focus during inspections?

It will focus on the implementation of the electronic system, including changes. During inspection, FDA will focus on:

  • source data that are transferred to another data format or system to ensure that checks are in place and that critical data are not altered
  • review SOPs, training and auditing to ensure that the system is functioning and is being used in the manner intended.

As a CRO we are often requested to manage “rescue” studies and transfer data from one system to another. This process is challenging and must be carefully evaluated with a risk assessment exercise, agreeing on output data formats and input data formats, detailed and documented migration process, develop mock-study tests to ensure that checks are in place and data is not altered during the migration , evaluation of implications on audit trail information etc

It is equally important to develop appropriate SOPs as well as system work instruction to detail processes and train resources on processes so that they can apply them correctly when building databases for clinical investigations.

Q10. If a non-U.S. site is conducting a clinical investigation, are records required by FDA regulations subject to part 11 requirements?

If it is conducting a clinical investigation under an investigational new drug application (IND), the clinical investigator and the sponsor must follow FDA regulations, including part 11.

This is important to bear in mind, even if a clinical investigation is run outside of US, but the clinical data will be part of a IND, then FDA regulations will apply. It is important to provide appropriate training to resources so that they are aware of applicable regulations depending on the nature and purpose of the study.

Q15. What should sponsors consider when deciding to validate outsourced electronic services that are used in clinical investigations?

A risk-based approach to validation. It is ultimately the responsibility of the sponsor to ensure that the outsourced electronic service is validated as appropriate. Sponsors should obtain documentation from the electronic service vendor that includes, but is not limited to, a description of SOPs and results of testing and validation.

This is particularly relevant for CROs providing services like data management and statistics. For this reason we write and maintain appropriate validation documentation and provide evidence of validation during audits and inspections as well as having adequately trained resources who understand the requirements of validation.

Q19. Does FDA consider the mobile technology to contain the source data?

FDA considers source data as data that are first recorded in a permanent manner. In general, for data collected directly from study participants through mobile technology, the first permanent record is located in the sponsor’s EDC system or the Electronic Health Record (EHR) and not in the mobile technology.

Q20. What should sponsors consider when implementing audit trails on data obtained directly from study participants using the mobile technology in the clinical investigation?

When data are copied or transmitted directly from the mobile technology to the sponsor’s

EDC system or from the mobile technology to the EHR and then to the sponsor’s EDC system, the audit trail begins at the time the data enter the sponsor’s EDC system.

These two Q&A are particularly interesting as mobile technology is becoming more and more widely used in clinical investigations to collect patient’s diary data, questionnaires, and daily drug compliance which are often primary or secondary endpoints of a clinical study. It is important to clarify with the sponsor and investigator what is considered source data and include it the clinical protocol.

To summarize, this draft guidance is particularly valuable to sponsors, clinical investigators, contract research organizations, and other interested parties because it provides more direction and detail than a typical FDA guidance, clarifying and expanding its risk-based expectations regarding validation, audit trails, and record archiving.

As a data-driven CRO, CROS NT provides a portfolio of EDC systems and eClinical technologies to Sponsors of clinical trials. We strictly adhere to FDA and EMA guidance and can provide regulatory and clinical data consultancy for Sponsors looking to implement a risk-based approach. We are also able to support Sponsors with the validation of electronic systems for use in clinical investigations.

CROS NT maintains an ISO 9001:2015 certification for its Quality Management System and an ISO 27001:2014 certified IT partner (Arithmos Information Technology) to manage IT processes and systems.