The FDA’s Data Mandates – And Why You Should Care

 

How pharmaceutical companies choose to handle their information material flow will have a huge impact on their profitability and competitiveness. The lessons they’re learning could also benefit you.

 

by Leslie Langnau, senion technical editor

 

There’s a lot of cost that can be cut in the U.S. pharmaceutical industry. Due to a host of factors, it’s starting to feel the pressure to do so.

 

Manufacturers that could have benefited from automation, particularly in the area of material handling, have been slow to take advantage. “In fact,” notes Jack Kuchta, Gross & Associates, “Europe has long employed a higher level of automation technology than the U.S.” Reasons for the resistance to automation will be explained shortly. But there’s a new regulation, desired by the pharma industry, which could make any resistance futile.

 

FDA regulation 21 CFR Part 11 will allow pharma companies to use electronically gathered and recorded data rather than paper documentation to prove that their procedures and processes meet FDA drug handling requirements.

 

Ultimately this regulation will:

 

• Help speed the release of drugs into the market.

 

• Help companies more efficiently and less expensively handle documentation required by the FDA.

 

• Lower costs and, thus, increase profits. 

 

• Reduce the number of required FDA inspections.

 

And, if done right, this regulation will help transform companies in all FDA-regulated industries (as it applies to more than just the pharmaceutical industry) into lean, efficient organizations.

 

FDA-regulated companies do not have to use electronic records instead of paper. They can continue to gather and store data in paper form. They can continue with business as usual.

 

But if they choose to replace paper with electronic records, they may have to replace every control, PC and PLC in their facilities. A solid networking system will be needed. And software will need specific features. At the least, pharma companies that choose to go electronic will have to upgrade many controls to meet the version control and audit trail features required by the Part 11 guideline because most older controls do not have these features.

 

There is no grandfather clause in the regulation to address legacy systems. They must be upgraded or replaced.

 

The other issue is that the rules of this regulation are open to some interpretation. “The FDA guidelines are guidelines. You can have different interpretations of what they mean. It’s up to the pharmaceutical company to read them, interpret them and put together specifications that they think will help them comply with what the guidelines suggest,” says Larry Robinson, IT account manager, USCO Logistics.

 

Only now are managers grasping the scope of change that will have to take place to comply with the 1997 FDA regulation. According to recent studies, the total cost of compliance for a typical medium-to-large drug manufacturer may reach as high as 25 percent of the total site-operating budget.

 

Rethinking existing practices to take full advantage of electronic technology is going to take a thorough, solid execution plan and strong leadership.

 

What is 21 CFR Part 11?

 

“21 CFR Part 11 covers the acceptance of electronic records and electronic signatures, in lieu of paper, as valid documents for product quality, safety and regulatory compliance,” says Paul Moylan, pharmaceutical solution marketing manager, Rockwell Automation.

 

Notes a Gartner study, it “makes electronic signatures as valid as handwritten signatures.”

 

“On an ongoing basis, pharmaceutical companies have to demonstrate that they adhere to their documented procedures for manufacture,” adds Moylan. (And much data collection is still done using manual methods; i.e., the clipboard.) Every batch requires documentation of what happened when. Any change must be noted, time and date stamped, with the proper authorization signature. In brief, there’s lots of paperwork associated with every drug batch or lot.

 

On top of that, there’s an inspection process that must be done before any product can be shipped. A company’s quality assurance group goes through all paper documentation to determine that any deviations in manufacture or material handling were executed properly by appropriately authorized personnel. This is the procedure for already-approved drugs.

 

For drugs that will be introduced to the market, the FDA performs an inspection. Those drugs remain in quarantine until the inspection is complete, which can take a week or more.

 

Why go electronic?

 

In 1997, the FDA noted that digital and electronic technology would likely become the preferred means of gathering, storing and representing required data. The advantages were obvious even then: There’s less chance of human error, the data take up less space, and the whole collection process would become faster. Plus, it would take less time for an inspector to check electronic records than paper ones. And the pharma companies wanted to reduce the massive volumes of paperwork they manage. Some companies have already moved into the electronic era and have noted many of these benefits. For example, they have reduced product quarantine time from a week or more to five or six hours.

 

An important goal of all the regulation is to reduce the overall amount of inspection. Rather than search through every piece of paper, an inspector can look at the exceptions and deviations. Eventually, once a company has established a reputation of reliability and is accurately following its procedures, the hope is that inspectors will no longer look at every batch or lot of product; that they will instead review every tenth batch, for example. “There’s a concept in the industry known as corrective action, preventive action, or CAPA,” says Moylan. “It tells the FDA inspector that you capture 100 percent of all deviations and exceptions that occur during production, and that you don’t need to do a quality audit of every single batch of material that goes through the production process. This is where the industry wants to go.”

 

The fly in the ointment

 

What’s stopping, or at least slowing, change is the process of revalidation. Once a drug manufacturing and distribution process works, no one wants to change it. To do so usually means companies must shut down their lines and test each and every piece of equipment to ensure it works with the change, upgrade or revision. This applies to all equipment, including material handling.

 

Controls must actually open valves if that’s what they are programmed to do. Equipment must physically run through its paces. No simulations allowed. The data from these run-throughs must be bound with other documentation and stored should an FDA inspector wish to see them.

 

Thus, there’s a host of systems that managers need to look at to determine what must be done to comply as cost efficiently as possible. According to consultants at the ARC Advisory Group, managers need to review system architectures; services for applications, validation and operator training; any off-the-shelf solutions, as well as any post and revalidation services for altered or upgraded equipment.

 

The revalidation procedures are critical. There must be an audit trail. “Anything that’s an electronic record (or can be defined as one according to the new ruling) must go through this,” says Moylan. “Everything boils down to ensuring that you can identify what is a quality parameter and what is not, what’s an electronic record and what is not. Everything that falls in those categories has to have full version control and auto-trail tracking where you can identify who made a change, when and why, and whether they had the proper authority to do so.” And electronic records are valid for seven years.

 

“There’s a lot of logging in and password and entry procedures around any change that must be recorded,” says Bob Honor, pharmaceutical solutions business leader, GE Pharmaceutical Solutions, GE Industrial Systems. “If someone changes a set point or the speed, he has to log in to say he did that and it’s time stamped so that there is a record of it. Information proving that he has the authority to make those changes must be included, too.”

 

These procedures apply to maintenance and cleaning operations done on equipment as well.

 

Complying with validation also requires the integration of many hardware and software information management and process control systems, notes ARC. This requirement further complicates the issue because pharmaceutical companies tend to have vertical, non-integrated systems. They are easier to validate after a change. Thus, change management will become a huge issue.

 

Failure to comply with Part 11 to the FDA’s satisfaction can result in severe penalties. This can include sending CEOs to jail.

 

The reason for the severity is that the FDA gives companies a lot of leeway in moving toward compliance. Management determines the compliance completion date, for example. If they don’t make their date for good reason, then the FDA steps in and several things can happen.

 

For one, a company can be cited. According to Gartner, more than 40 non-compliance citations have been issued so far, primarily for deficiencies in security, audit trails, and data storage and retrieval.

 

Then there’s the disgorgement penalty. If a company has not complied after several citations, the FDA will shut down the company from further operation and fine it. The fine is usually a retroactive charge. It’s a percentage of all the shipments made between the first infraction citation and the latest one. Two labs thus far have received disgorgement citations of $100 million each.

 

Establishing facilities overseas for shipment to the U.S. is not a loophole. Any company planning on selling drugs to the U.S. must comply with FDA regulations.

 

Pharma companies are fully responsible for compliance. Using a product a vendor claims complies is not enough. Products must demonstrate that in the systems they are installed, they do in fact comply. It’s the system that counts.

 

The effects on resource management software

 

Most pharmaceutical companies use a type of program that functions between the ERP program and the computer-control programs. The reason for this is that these manufacturing execution systems (MES) are easier to validate and revalidate after an upgrade or new version.

 

“While all ERP, MES and WMS systems must interact, not all have to be Part 11 compliant,” says Steve Simmerman, chief operating officer, Swisslog. “That’s because they may not be involved in the types of transactions where signature capture is essential. Just when there’s a change in the status of the lot or material, even if it’s at the ERP level, then that will require signature capture.

 

“According to several forecast reports we’ve watched,” says Simmerman, “there’s a seven percent probability that by 2004, 50 percent of pharmaceutical companies will upgrade their WMS systems to take advantage of Part 11.”

 

“What’s done is that the vendor provides the hooks or the features that meet the regulations,” says Honor. “These hooks are built into programming tools, data collection software, asset management programs, and all other solutions that touch electronic data in any way. And that includes networks or whatever means are used to transfer data.”

 

“Software must now offer such features as user/name/password and date and time stamp,” adds Simmerman. “Plus software must be able to handle all transactions to master data changes within an application.”

 

While intermediate software is popular with pharma companies, ERP vendors will not stay out of this potentially lucrative market. Gartner reports that ERP vendors are also building in functions that will facilitate Part 11 compliance in enterprise applications.

 

Security is also a critical criterion for this FDA regulation. “You must prove that your network or data collection system is secure,” says Steve Pulsifer, pharmaceutical solutions market development manager, GE Pharmaceutical Systems. “If someone enters the wrong password two or three times, do you have the ability to detect that and automatically lock them out?” (As noted earlier, deficiencies in security was one of the major reasons certain pharma labs were cited for non-compliance by the FDA.)

 

Going outward

 

Companies are dealing with these issues in varying ways. Few pharma companies handle all aspects of drug development and delivery. Like other industries, pharma companies are focusing on their core competencies and outsourcing non-core-related activities.

 

Most pharmaceutical companies consider their core competency to be the marketing of drugs. R&D, manufacture and distribution are contracted out. Thus, any costs for control and system upgrades or changes are not the direct concern of the pharmaceutical company.

 

There is nothing in the FDA regulation that states that members of a supply chain must conform to Part 11. Electronic documentation and control are the responsibility of the pharmaceutical company. It’s up to the company to make arrangements with its supply chain partners to ensure FDA compliance and to acquire the necessary documentation on drug development, manufacture, distribution and receipt. Thus, retailers, such as Wal-Mart, CVS Pharmacy and so on, may have to install systems and processes that meet pharmaceutical interpretations of Part 11.

 

USCO is a distributor for a number of pharmaceutical companies. “From our perspective, the customer, who is the pharmaceutical company, is responsible for ensuring that the applications that it runs its business on are validated,” says Larry Robinson, IT account manager. “USCO’s position is to support its view of what the validation is. We have one pharma client that feels a system cannot be validated unless it owns the system. We have other clients who say as long as we have gone through a validation effort that they approve of, they are satisfied that we comply with their interpretation of compliance with the regulation. We have gone through a validation effort on our two main warehouse management systems. And, from our perspective, we feel confident that we can support any of our customers’ contention that they are in compliance with the guidelines laid out by the FDA.

 

“When a change must occur,” continues Robinson, “we review it and determine whether it affects the validated system. If it does, we determine to what extent and whether we need to go back and validate those areas where the change occurred. If we revalidate, a copy of this change is sent to the partner. It’s our system, and we’re responsible for the state of our system.

 

“Our partners, the pharma companies, are responsible to the FDA. USCO is acting as their agent. So they have the ultimate responsibility to ensure their products, primarily with lot control and recall, are being managed on a validated system. But USCO, acting on their behalf, performs services in the position of continuing that care a