In recent years, the Food and Drug Administration (FDA) has increasingly observed violations involving data integrity during audits. Data integrity issues have been observed in traditional pharmaceutical firms as well as in medical gas firms. Solid, accurate and reliable data is an important component to ensure compliance with FDA’s Current Good Manufacturing Practice (CGMP) regulations. The integrity of drug (and food/beverage/device) manufacturing data is also critical for your own business success.
What is “data integrity”?
Data integrity refers to the completeness, consistency and accuracy of data. The data integrity term ALCOA stands for Attributable, Legible, Contemporaneous, Original and Accurate.
What is “metadata”?
Metadata is the contextual information required to understand data. A data value is, by itself, meaningless without additional information about the data. Metadata is structured information that describes, explains or otherwise makes it easier to retrieve, use or manage data. For example, the purity number “99.8” is meaningless without metadata (“percent.”) Metadata for a particular piece of data could include a date/time stamp documenting when the data were acquired, a user ID of the person who conducted the test or analysis that generated the data, the instrument ID used to acquire the data, material status data, the cylinder serial or lot number, and audit trails. Gas chromatography metadata could include the retention times, gas names, essential instrument parameters, etc. Metadata should be maintained with the original data throughout the record’s retention period. The relationships between data and their metadata should be preserved in a secure and traceable manner.
What is an “audit trail”?
An audit trail is a secure, computer-generated, time-stamped electronic record that describes the history of events relating to the creation, modification or deletion of an electronic record. For example, the audit trail for a gas chromatograph (GC) run should include the username, date/time of the run, the integration parameters used and details of any reprocessing. Documentation should include the reason for any changes. Audit trails include any revisions, reprocessing or attempts to delete a record (e.g. chromatogram).
What regulations are impacted by data integrity?
§ 211.68 (requiring that “backup data are exact and complete” and “secure from alteration, inadvertent erasures, or loss” and that “output from the computer … be checked for accuracy.”)
§ 212.110(b) (requiring that data be “stored to prevent deterioration or loss.”)
§§ 211.100 and 211.160 (requiring that certain activities be “documented at the time of performance” and that laboratory controls be “scientifically sound.”)
§ 211.180 (requiring that records be retained as “original records,” or “true copies,” or other “accurate reproductions of the original records.”)
§§ 211.188, 211.194, and 212.60(g) (requiring “complete information,” “complete data derived from all tests,” “complete record of all data,” and “complete records of all tests performed.”)
§§ 211.22, 211.192, and 211.194(a) (requiring that production and control records be “reviewed” and that laboratory records be “reviewed for accuracy, completeness, and compliance with established standards.”)
§§ 211.182, 211.186(a), 211.188(b)(11), and 211.194(a)(8) (requiring that records be “checked,” “verified,” or “reviewed.”)
Data integrity certainly applies to electronic records (see 21 CFR Part 11). Software for creating and maintaining electronic production, calibration, testing, labeling and distribution records is available and will likely become more widely used in the future. Be certain you consider the integrity of the data when you decide to create an electronic record.
If your operation uses a gas chromatograph or automatically acquires production testing data into a computer, you are creating and maintaining electronic records.
As of 2019, most of the medical and food/beverage records are still handwritten and certainly impacted by data integrity issues.
Examples of data integrity issues for medical and food/beverage gas companies?
Error corrections – If a mistake is made on a record (e.g. fill log) by the operator, the mistake can be easily corrected. The error should have a single line drawn through the entry and the correct entry should be written near the error. The initials/signature of the person who corrected the entry should be placed near the error. If the date of the correction is not the same as the date of the entry, the date of the correction should be entered. If the reason for the correction is not obvious, the reason for the correction should be documented.
Never erase, obliterate or white out an error on a regulated record. Always use an indelible ink pen to make hand written records.
Invalidating test results – Occasionally, the Oxygen test, gas chromatograph, etc., may deliver a non-conforming result. This could be as a result of the instrument being bumped during calibration, an electrical spike, a regulator failure, etc. You should follow your “non-conformance” or “out-of-specification” (OOS) procedure to determine what steps are needed to proceed. Among other actions, you might decide to reject the lot, recalibrate the instrument, retest the product, etc. It is critical to decide if the original test result was valid (and the product is truly non-conforming) or if the original test results are invalid (and the product may be retested.) The original test result must be recorded along with an explanation about the results of your investigation.
Two examples:
Oxygen Purity – Consider if you used the Servomex to test the purity of the oxygen and the instrument indicated 98.7%. This is below the USP minimum of 99% and would disqualify the lot for distribution. Your OOS procedure should be followed to determine the next steps (venting, reanalysis, etc.). Even if you decide to recalibrate and reanalyze the lot, you must keep a record of the original test result (98.7%) along with any other actions (recalibration, retesting, etc.) that you take. Fortunately, the paramagnetic oxygen analyzer technology is highly reliable and Oxygen purity OOS is very rare.
Gas Chromatography – Sometimes, an unusual event is recorded on the chromatogram. This could be due to an electrical spike, sample regulator issue, etc. All unusual events and results must be documented and explained. We recommend printing the chromatogram, signing/dating the chromatogram to indicate that it is a true copy of the electronic record and explaining any unusual events in writing on the chromatogram. Follow your OOS procedure. Even if you decide to invalidate the original test, you must keep the chromatogram with the testing records.
Audit trails – If you make a change to a record (handwritten or electronic), the history of the record and changes must be maintained.
Handwritten records – For example, if you filled out a Packaging Control Record (PCR or “Fill Log”) for medical oxygen and the form was damaged beyond legibility, you cannot simply copy the data onto a new form and discard the old form. You must keep the original record attached to the new record (e.g. by stapling). This result will not be neat looking, but it will preserve the history of the record.
Electronic records – Similarly, if you make a change to a gas chromatography method file (e.g. slightly revise the retention times), you must maintain the history of the method file. This history is captured in an “audit trail.” The key is to be able to recreate the method as it existed at any time and to document the revisions done to the electronic record. There have been serious FDA compliance actions simply because audit trails were not maintained.
Most newer chromatography data acquisition systems have audit trail provisions that you can enable in the software settings. If you are using a legacy GC data acquisition system, consider upgrading to a 21 CFR Part 11 compliant system with audit trails. There are no “grand-fathering” provisions for older non-compliant software.
Keep in mind that audit trails also apply to computerized production and testing systems. If you make a change to the software or system, a record must be maintained of the change. Audit trails must be reviewed by the Quality Control Unit.
Copies of records – You are permitted to make true copies of handwritten and electronic records. In all cases, ensure that you preserve the content and meaning of the original record. This includes all the metadata required to reconstruct the CGMP activity (e.g. GC method, calibration files, etc.). True copies of electronic records may be made and maintained in the format of the original records or in a format that allows for the content and meaning of the original records to be preserved if a suitable reader and copying equipment are readily available. Be careful when upgrading legacy software that the new software will be able to read the old records. If the new software cannot read the old data, you will need to keep a copy of the legacy system active (for the length or the record retention period) or transfer the data (including metadata) to another format (e.g. paper.)
Hybrid electronic records – If you intend to make paper copies of an electronic record (e.g. chromatograms), you should initial/sign and date the paper copy. Ensure that you have a procedure that defines the meaning of the signature and date. The signature and date attest that the paper copy of the record is a true copy and includes all the data needed for CGMP compliance. This creates a “hybrid electronic record.” The original copy of the record exists on the computer, but a true copy for compliance purposes is on paper.
When does data become a CGMP record?
When generated to satisfy a CGMP requirement, all data become a CGMP record. You must document, or save, the data at the time of performance to create a record in compliance with CGMP requirements. You should not record data on pieces of paper that will be discarded after the data are transcribed to a permanent fill log or other record. Similarly, you may not store electronic records in a manner that allows for manipulation without creating a permanent record. (See audit trail, above.)
It is a serious violation to sample and test product until it passes… and then only keep the final record. This practice is also referred to as testing into compliance.
The FDA also does not recognize ditto marks (or similar continuation marking) as a legitimate record. Similarly, in the United States, signature stamps are not allowed on CGMP records.
The FDA is re-evaluating the guidance for electronic records. If the agency changes its position, we will revise this information, as needed. If you have questions or need additional compliance procedures, please contact Tom Badstubner – tom@asteriskllc.com.
