Training has never been more important for life science businesses. Modern learning management systems make it simpler and easier to provide the required training and development for employees at all levels within the organization. However, there’s a single fly in the ointment – 21 CFR Part 11. Here’s the 21 CFR Part 11 PDF checklist.

Set by the FDA, this part of the federal code deals with how your organization records, stores, and safeguards electronic records, including training records. In fact, training records are traditionally one of the major parts of any compliance inspection. Why is that?

The FDA requires you to demonstrate that your teams have the right combination of experience, education, and training to perform their stated job duties. Paper-based training records, outdated training information, incomplete data – these are just a few of the ways that you might find yourself in hot regulatory water. The right LMS can help, but what should you look for that might indicate a system is compatible with 21 CFR Part 11?

Inspection Ready Training Records

One of the most important mandates when it comes to life science organization training is that your records be ready for inspection. What does that mean in the day of digital recordkeeping? Simply put, according to 21 CFR Part 11, PDF, XML, HTML, and other standard digital record forms are permissible. The records must be ready to share with inspectors, and they must:

• Be current for all learners
• Agree with applicable SOPs
• Be complete
• Include changelogs, timestamps, and traceable authorizations

So, any LMS you choose must be able to deliver inspection-ready training records to FDA inspectors. That applies whether you’re going through an on-site inspection, or the FDA has requested electronic records be transferred to them digitally.

The Right Workflow

In addition to the 21 CFR Part 11 PDF/digital document rule for ease of access and inspection-ready documents, you need to ensure that the LMS you choose supports the right workflow. Using a learning management system can greatly simplify your process, but there are things you should know.

Do You Have to Go Digital?

You might be concerned that 21 CFR Part 11 requires you to go all-digital, but that’s not the case. The FDA allows life science companies to determine whether they will maintain their records in hardcopy format, or go the digital route. With that being said, most organizations find that digital technology simply offers too many benefits to pass up, and that managing hardcopy records is just too onerous, particularly as business continues its inexorable shift toward the online environment.

Why Consider Digital Recordkeeping?

There are plenty of pretty obvious reasons to go the digital route, even considering the regulations imposed by the FDA when it comes to digital records and signatures. Chief among the benefits are:

• Time savings
• Cost savings
• Ease of access
• Ease of sharing
• Reduction in demand for raw resources (paper and ink)
• Ease of planning

The Workflow

An LMS should offer some specific workflows and capabilities. Ideally, it what you’re able to achieve with a compliant/validated LMS should look something like this:

• The LMS automatically generates a detailed training plan specific to each learner’s:
• • Training needs
  • Certification needs and goals
  • Career path
  • Ongoing training requirements
• The LMS automatically stores all electronic training plans
• The LMS makes those training plans available to all authorized personnel in digital form, but also as stipulated in 21 CFR Part 11, as PDF, XLM, HTML, and other document types
• The LMS allows distributed personnel to view the training plans, even if they are in a different geographic location
• The LMS records individual logins in the system’s database
• The LMS automatically logs lesson, module, and course completion for each user in the system
• Administrators can easily view learner records in an LMS compliant with 21 CFR Part 11 as PDF, XLM, or HTML documents, or print them as needed
• The LMS automatically updates and ensures the system is always up to date
• The LMS provides a clear view of the organization’s compliance with recommendations through granular and high-level reporting

Choosing the Right Learner Features

While 21 CFR Part 11 compliance is essential, it is not the end of your considerations. Life science organizations must also consider the user experience, how well learners will be able to absorb the information they’re presented, and many other things. We’ll break those down briefly below.

Accessible: One of the most critical considerations is that your learning material is accessible when and where it fits your learner’s needs best. Increasingly, that means moving outside of the traditional training labs and putting your courses and modules into learners’ hands on mobile devices, or making your system accessible from employees’ home PCs and laptops. Of course, this still requires that you comply with 21 CFR Part 11, particularly when it comes to electronic signatures and access control to the system.

Learning Type: While the life science industry might not have the same need to deliver highly-engaging material as is found in general businesses, you do need to give some thought to the types of learning material you’re using. Is it all dry, dull, and boring? You can expect lower levels of engagement and information retention. That leads to lower test scores, and then to other problems. Consider interactive material, gamification, and chunking to help break up and improve the learner experience.

We Can Help

Struggling to find an LMS that complies with 21 CFR Part 11 mandates? At eLeaP, we’ve developed one of the most robust learning management systems in the world, and we’ve thoroughly tested it to ensure that it is fit for your intended purpose. Not only do you get compliance with FDA regulations, but you also benefit from an agile LMS that puts the learning experience front and center to boost information retention and engagement. Contact us today to schedule your consultation.

Struggling to comply with 21 CFR Part 11 on electronic records? Many life science companies find themselves in the same position. It’s a complicated set of rules and regulations that must be followed, and it applies to all electronic systems in your business, from your labeling to your learning management system. You can download the whitepaper, “How to Prepare for a 21 CFR Part 11 FDA Inspection“.

However, it doesn’t have to be as confusing as it might seem. In this guide, we’ll dive into what you need to know about electronic records and what compliance might look like.

What Are Electronic Records?

Under 21 CFR Part 11 on electronic records, the FDA defines it as, “any combination of text, graphics, data, audio, pictorial, or other information representation in digital form that is created, modified, maintained, archived, retrieved, or distributed by a computer system.” With this definition in hand, we can see that just about any sort of information stored within an electronic system used by your life science company fits the bill. That includes things like vendor correspondence, customer purchase orders, and even employee training documents.

How Are Electronic Records Stored?

Electronic records are stored within an electronic system. This can be a closed system – one in which you (the company responsible for maintaining and monitoring the records) have total control over access and security. It may also be an open system – one in which you (the company responsible for the records) does not have direct control over the information, such as in a cloud-hosted situation. In both system types, your records are digital – they’re stored either on a local hard drive or in remote storage within a data center.

How Long Must Electronic Records Be Maintained?

Speaking of record retention, the FDA explained in its 21 CFR Part 11 guidance document, “The Agency intends to exercise enforcement discretion with regard to the part 11 requirements for the protection of records to enable their accurate and ready retrieval throughout the records retention period (§ 11.10 (c) and any corresponding requirement in §11.30). Persons must still comply with all applicable predicate rule requirements for record retention and availability (e.g., §§ 211.180(c),(d), 108.25(g), and 108.35(h)).”

Can Electronic Records Be Changed to Physical Records?

Yes, you can change electronic records to physical records. In the same guidance document mentioned above, the FDA stated, “FDA does not intend to object if you decide to archive required records in electronic format to nonelectronic media such as microfilm, microfiche, and paper, or to a standard electronic file format (examples of such formats include, but are not limited to, PDF, XML, or SGML).

Persons must still comply with all predicate rule requirements, and the records themselves and any copies of the required records should preserve their content and meaning. As long as predicate rule requirements are fully satisfied and the content and meaning of the records are preserved and archived, you can delete the electronic version of the records. In addition, paper and electronic record and signature components can co-exist (i.e., a hybrid8 situation) as long as predicate rule requirements are met and the content and meaning of those records are preserved.”

How Does 21 CFR Part 11 on Electronic Records Affect Your LMS?

A modern learning management system is an electronic system, like your payroll and accounting software. It is designed to create, store, and maintain electronic records (training records related to your employee’s training and development). For that reason, it falls under the purview of 21 CFR Part 11, not just for electronic records, but also in terms of the FDA’s rules regarding electronic signatures.

What Records Are Stored in My LMS?

Today’s learning management systems are vast and varied. They can store any number of training record types, all of which must be maintained for a specific period. Some of the most common types of records include the following:

• Certification-related documents
• Continuing education (CE) related documents
• Corporate training-related documents
• Career advancement-related documents

What Do My LMS Records Have to Do with 21 CFR Part 11?

While it might not seem like your LMS falls under the scope of 21 CFR Part 11 for electronic records, it’s important to understand that the usage of the system and regulations that require your staff to be trained and to conduct their roles by knowledge and experience come into play here.

The Role of the Electronic Signature

While the focus of this guide has been on exploring 21 CFR Part 11 for electronic records, we must also mention electronic signatures, as they bear on the security and protection of electronic records. Your LMS will have electronic signature functionality that plays a role in a wide range of scenarios and situations, including the following:

• Learners must log in to their personal accounts to complete specific modules and have that completion recorded and credited to them.
• Administrators must log in to their accounts to make changes, alter documents, export records, and create learning paths.
• Users will have electronic signatures (logins) that tie into the need to create clear audit trails for accountability and responsibility.

Choosing an LMS for Your Life Science Company

Finding the right LMS is vital for compliance with the rules in 21 CFR Part 11 on electronic records and electronic signatures. Not all learning management systems today were designed with these regulations in mind, and some software developers may not have updated their existing platforms.

At eLeaP, we designed our LMS from the ground up to help our life science clients ensure compliance with 21 CFR Part 11 and other parts of 21 CFR. We offer advanced functionality, secure record storage, robust authentication, and other benefits you require. Contact us today to schedule a custom consultation to learn more about our learning management system and how we can support your organization.

The FDA has stringent regulations that apply to life science companies, particularly when it comes to electronic records and signatures. One essential part of complying with those regulations is filing a 21 CFR Part 11 letter of certification, better known as a letter of non-repudiation agreement. For those unsure of what these letters do, how to write one, and other details, this guide lays out what you should know. You can also download the whitepaper “How to Prepare for a 21 CFR Part 11 FDA Inspection“.

What is a 21 CFR Part 11 Letter of Certification?

As part of the compliance process, all life science companies must file what’s called a letter of non-repudiation agreement with the FDA. This letter must be on file with the organization, or the organization will deem you not in compliance.

According to the FDA’s website, “A letter of Non-Repudiation Agreement for digital signatures must be submitted to the FDA prior to registering as a transaction partner for the FDA ESG. The letter must be submitted (preferably on company letterhead) and signed with a traditional handwritten signature. Users requesting a new ESG account must send an electronic copy of their Letter of Non-Repudiation to ESGHelpDesk@fda.hhs.gov. In addition, users must send a physical copy to the FDA. Users must send a hard copy within 2 weeks, or your account may be disabled.”

Where Should You Send a 21 CFR Part 11 Letter of Certification?

According to the FDA, all letters of non-repudiation agreement should be sent to the following address:

Lowell Marshall
Electronic Submissions Gateway
U.S. Food and Drug Administration
3WFN, Room 7C34
12225 Wilkins Avenue
Rockville, MD 20852

What Should a 21 CFR Part 11 Letter of Certification Look Like?

The FDA has provided two sample letters on the organization’s official government website. Both include placeholders in brackets that indicate where you should supply information, as well as what information is needed. You can find the two sample letters of non-repudiation agreement here: https://www.fda.gov/industry/about-esg/appendix-g-letters-non-repudiation-agreement

We have also included the text of both sample letters below for your convenience:

SAMPLE LETTER #1

[Company Letterhead]

[Today’s Date]

Lowell Marshall
Electronic Submissions Gateway
U.S. Food and Drug Administration
3WFN, Room 7C34
12225 Wilkins Avenue
Rockville, MD 20852

Re: Electronic Signatures

Dear Sir or Madam:

Pursuant to Section 11.100 of Title 21 of the Code of Federal Regulations, this is to certify that [Company Name], [Company Address], intends that electronic signatures executed by our employees, [List of employee names] are the legally binding equivalent of traditional hand-written signatures.

Sincerely yours,

[Hand-written signature]

[Company Representative Title]

[Employee Name #1]: _________ [Hand-written signature of employee #1]

[Employee Name #2]: _________ [Hand-written signature of employee #2]

[Employee Name #3]: _________ [Hand-written signature of employee #3]

[etc.]

SAMPLE LETTER #2

[Company Letterhead]

[Today’s Date]

Lowell Marshall
Electronic Submissions Gateway
U.S. Food and Drug Administration
3WFN, Room 7C34
12225 Wilkins Avenue
Rockville, MD 20852

Re: Electronic Signature Certificate Statement

To Whom It May Concern:

Pursuant to Section 11.100 of Title 21 of the Code of Federal Regulations, this is to certify that [Company Name] intends that all electronic signatures executed by our employees, agents, or representatives located anywhere in the world are the legally binding equivalent of traditional hand-written signatures.

Sincerely yours,

[Hand-written signature]

[Name of Company Representative]
[Company Representative Title]

Does 21 CFR Part 11 Apply to Me?

For those who are unsure whether the rules and regulations apply to their organizations, answer the following four questions:

• Is there another FDA requirement to maintain records (a predicate rule)?
• Do you choose to meet that requirement by keeping electronic records?
• Do you use electronic signatures to document specific things (actions/events) that have occurred?
• Do you submit electronic records to the FDA?

If you answered yes to the above, then 21 CFR Part 11 does apply to you, and you’ll need to complete and mail a letter of non-repudiation agreement to be on file with the FDA. If you are still unsure, take the GAMP Approach to 21 CFR Part 11 Compliance course to help you navigate the FDA’s compliance landscape.

What Happens If You Don’t File a 21 CFR Part 11 Letter of Certification?

If you fail to file a letter of non-repudiation with the FDA, you’ll be deemed out of compliance, even if you’ve followed every other step required of you. That could lead to receiving Form 483, as well as FDA warning letters. If the situation is not corrected, you could see damage to your organization’s reputation and potentially lost business, as well as further action from the FDA. Thankfully, filing a letter of non-repudiation is simple and takes very little time.

Why Do I Need to File a Letter of Certification?

Filing a letter of certification with the FDA signals that your organization complies with the requirements laid out in 21 CFR Part 11. It also shows that you have followed all the steps required of you, including:

• Software/system validation
• Creating validation records for system installation and release
• Developing user training records
• Conducting due diligence when it comes to vendor validation (if applicable)
• Developing internal SOPs and policies

eLeaP has over 19 years of experience helping life sciences organizations comply with the FDA’s rigorous 21 CFR Part 11 auditing and inspection process. Get a free consultation or start a free sandbox account to see how the system works.

The Role of Your Learning Management System

While an LMS might not help you create and file a 21 CFR Part 11 letter of certification, it does play a critical role in your compliance. Creating training plans for employees and ensuring that everyone completes modules covering topics related to password hygiene, software system use, electronic signatures, accountability and responsibility, and data protection are central parts of complying with the FDA’s rules.

The right LMS is vital – as an electronic system, it, too, must be validated and compliant with the regulations. At eLeaP, we designed our learning management system to deliver best-of-breed capabilities but also to comply with 21 CFR Part 11 rules. It is fully validated and fit for use. Contact us today to learn more or to schedule your custom consultation.

Life science companies, including pharmaceutical companies, biotech firms, and medical device manufacturers, are required to comply with 21 CFR Part 11. It’s a wide-ranging, complex set of regulations that deal specifically with electronic records and electronic signatures. Because digital records and digital credentials are used in almost every area of your business today, those regulations impact just about everything, including product labeling.

What Is the 21 CFR Part 11 Labeling Rule?

There is no 21 CFR Part 11 labeling rule – the rule itself is specific to electronic records and electronic signatures. It ties into labeling rules (21 CFR Part 201 and 21 CFR Part 211) that spell out exactly what companies that fall under FDA oversight must due in terms of labeling when it comes to pharmaceuticals and related products (such as sunscreen and OTC medications).

The basic gist here is that drug and medical device manufacturers, as well as all other companies under the FDA’s purview, preserve records of all the systems that are used in the production process. Obviously, that’s a significant number of systems, particularly when it comes to larger companies, and it can even include things like your barcode labeling system.

Labels with Electronic Signatures

The most direct connection between 21 CFR Part 11 and labeling rules is the mandate that labels be connected to an organization, manufacturer, or issuer through an electronic signature.

What is an electronic signature? 21 CFR Part 11 defines an electronic signature as, “(a) Electronic signatures that are not based upon biometrics shall:

(1) Employ at least two distinct identification components such as an identification code and password.

(i) When an individual executes a series of signings during a single, continuous period of controlled system access, the first signing shall be executed using all electronic signature components; subsequent signings shall be executed using at least one electronic signature component that is only executable by, and designed to be used only by, the individual.

(ii) When an individual executes one or more signings not performed during a single, continuous period of controlled system access, each signing shall be executed using all of the electronic signature components.

(2) Be used only by their genuine owners; and

(3) Be administered and executed to ensure that attempted use of an individual’s electronic signature by anyone other than its genuine owner requires the collaboration of two or more individuals.

(b) Electronic signatures based upon biometrics shall be designed to ensure that they cannot be used by anyone other than their genuine owners.”

How Can an LMS Help?

While a learning management system cannot automatically ensure that you’re in compliance with the FDA’s labeling requirements, it can offer a wide range of benefits in terms of training and education.

• FDA Labeling Rule Education – Perhaps the most important step toward compliance with 21 CFR Part 11 and labeling compliance is educating your employees. 21 CFR (all parts) is a complex set of federal rules and regulations that spans thousands of pages. With the right LMS, you can use existing learning modules to train your employees or create your own custom learning content specific to your business, industry, or processes.
• Track Learner Progress – Failure to comply with either the FDA’s labeling requirements or 21 CFR Part 11 can result in being audited by an FDA inspector or inspection team. Often, learning/training records are the place they begin. With the right learning management system, you can track learner progress and ensure that all of your records are complete and up to date and that they’re accessible for FDA inspectors in the format they demand.
• A Step toward Part 11 Compliance – With the right learning management system, your organization will be one step closer to full compliance with 21 CFR Part 11. Again, this deals with electronic record storage, access, and security, as well as with electronic signatures. The right LMS will provide you with not just training for employees related to the FDA’s labeling rules, as well as Part 11 requirements, but will be compliant with Part 11 itself.

How to Choose the Right LMS

With so many learning management systems on the market, how do you ensure that you’re choosing the right system for your medical device or pharmaceutical company? It can be pretty challenging, but the following list will help:

• Is it validated for 21 CFR Part 11? If not, how much time and effort will you need to spend validating it?
• Does the LMS offer the ability to access lessons, modules, and other data remotely from mobile devices? Does it comply with the rules in 21 CFR Part 11 in terms of electronic signatures?
• Does the LMS support authoring your own learning-related content, or are you stuck with what’s available from the vendor?
• Does the LMS align with your learning and development objectives? Will it help get your learners from where they are now in their journey to where they need to be?
• Is the LMS cloud-based? If not, do you have the in-house talent and resources required? Would a cloud-based LMS be better suited, freeing your IT team to focus on more important tasks?
• Is the LMS constantly updated to ensure compliance with changing rules and industry regulations, including future 21 CFR Part 11 and labeling rules?
• Does the LMS offer granular data tracking so that you can monitor learner progress, ensure information security, and limit access to data for unauthorized users?

These are just a few of the questions you’ll need to answer when choosing your learning management system. The right choice will give you a valuable asset that will support positive outcomes for your employees for years to come while also helping you comply with federal regulations.

Contact eLeaP for more information about how our system can fit your needs and to schedule a custom consultation.

High-performance liquid chromatography, or HPLC, is a vital part of analytical chemistry and is used in a broad range of life science businesses. However, analytical laboratories using electronic systems to record, store, and manage data are now required to comply with FDA rules and regulations. 21 CFR Part 11 for HPLC means your organization needs a validated LMS to comply with the regulation.

How does 21 CFR Part 11 for HPLC affect your organization? In this guide, we’ll answer some of the most frequently asked questions from operators of analytical laboratories regarding 21 CFR Part 11 and the FDA’s rules.

Does 21 CFR Part 11 Apply to Your Laboratory?

In a nutshell, yes, it does. The only way these rules would not apply to your organization is if you did not use any type of electronic system to manage electronic records (software handling test results, for instance). Because almost every single life science organization today relies on digital technology, virtually every organization in the industry must comply with these rules and regulations.

What Does 21 CFR Part 11 for HPLC Focus On?

While 21 CFR itself covers an incredible range of federal regulations, Part 11 is much more specific. For 36 pages, the FDA spells out the requirements for organizations in terms of how electronic systems should operate to:

• Protect sensitive data
• Limit access to information and systems in general
• Ensure accountability and transparency
• Make electronic signatures as trusted and legally binding as handwritten signatures

Does 21 CFR Part 11 Apply to Legacy Systems?

Yes and no. If your legacy system does not handle electronic records in any way, then, no, the rule does not apply. However, if your legacy system does handle electronic records, then the rule does apply. All such systems must be validated, and if they cannot be validated, they cannot be used and will need to be replaced.

What Does the Rule Say?

The rule itself comprises just three of the 36 pages in Part 11. The other 33 pages include discussion from the FDA on the rule itself, as well as other information that life science organizations and other businesses that fall under the purview of the FDA need to know. The rule itself is comprised of just a few parts, which are as follows:

• System validation: “All computer systems used to generate, maintain, and archive electronic records must be validated to ensure accuracy, reliability, consistent independent performance, and the ability to discern invalid or altered records.”
• Secure retention of electronic records to instantly reconstruct analyses: “Procedures should be in place to generate accurate and complete copies of records in both human-readable and electronic form suitable for inspection, review, and copying by the agency. Records must be protected to enable their accurate and ready retrieval throughout the records retention period.”
• Limited access: “Procedures should be in place to limit the access to authorized users.”
• User-independent, computer-generated, time-stamped audit trails: “Procedures should be available to use secure, computer-generated, time-stamped audit trails to independently record the date and time of operator entries and actions that create, modify, or delete electronic records. Record changes shall not obscure previously recorded information. Such audit-trail documentation shall be retained for a period at least as long as that required for the subject electronic records and shall be available for agency review and copying.”
• Use of secure electronic signatures for closed and open systems: “The establishment of, and adherence to, written policies that hold individuals accountable and responsible for actions initiated under their electronic signatures, in order to determine record and signature falsification.”
• Use of digital signatures for open systems: “Persons who use open systems to create, modify, maintain, or transmit electronic records shall employ procedures and controls designed to ensure the authenticity, integrity, and, as appropriate, the confidentiality of electronic records from the point of their creation to the point of their receipt. Such procedures and controls shall include those identified for closed systems, as appropriate, and additional measures such as document encryption and use of appropriate digital signature standards to ensure, as necessary under the circumstances, record authenticity, integrity, and confidentiality.”

What Types of Electronic Signature Control Components Can Be Used?

The FDA allows both non-biometric and biometric electronic signature control components. These can include usernames and passwords, such as those used to log into conventional software, such as email accounts and the like. It can also include two-factor authentication, or the use of physical components, like an ID card with a scannable barcode.

Biometric control elements can include a wide range of components, such as fingerprints, iris scans, and even DNA. There is no mandate on which types your organization uses, only that access to sensitive information and systems is controlled and that there are SOPs in place to ensure accountability and responsibility.

With that being said, biometric controls have greater flexibility, as the FDA states that “electronic signatures that are not based upon biometrics shall: (1) employ at least two distinct identification components, such as an identification code and password.”

Don’t Neglect Your Learning Management System

For life science companies, having a viable, modern LMS is essential. However, because these systems include, record, and manage data, they’re subject to 21 CFR Part 11 for HPLC/laboratories. What that means is they must be validated for use and comply with FDA guidelines or you risk being out of compliance.

At eLeaP, our LMS has been fully validated and is fit for use. It is one of the few such systems on the market that offers compliance with 21 CFR Part 11 “out of the box” while delivering powerful capabilities and flexibility. Start your free sandbox account today to learn more about our system or to schedule your custom consultation.

The digital revolution has been nothing short of remarkable. It has ushered in new ways of living and working, and completely changed how we deal with data. Today, we’re more productive than ever, able to access information in seconds, to compare notes with others from a world away, and so much more. When it comes to the FDA’s regulations, there is a long list of 21 CFR Part 11 examples of companies getting in trouble for not complying with it.

However, that same technology has made it ever more challenging to protect the data that life science businesses need to thrive. Hackers, malicious software, human error – all of these can lead to serious issues, including massive data breaches that leave the personal data of millions of people exposed to nefarious actors, or puts sensitive business data and research in the hands of competitors.

Rules are required to help safeguard that data and prevent unauthorized access to data. The FDA enacted 21 CFR Part 11 to provide rules and guidance that life sciences firms must follow to do just that. However, there has been a significant amount of confusion regarding these rules, even though they were introduced decades ago and have evolved over time along with our data usage habits and technology.

To help clear the air and make sure that you’re on the right path in terms of data protection and security, a few 21 CFR Part 11 examples might be necessary. We’ll explore what you should know below. In the meantime, see how the FDA compliant eLeaP platform can ensure you stay in compliance with Part 11.

What Is 21 CFR Part 11?

CFR stands for Code of Federal Regulations, and the entire code deals with a very wide range of topics. 21 CFR Part 11 is a specific part of that code that deals with how digital records and digital signatures (called “electronic” in the code) are used, stored, accessed, interacted with, copied, and more.

What Is 21 CFR Part 11 About?

At its core, this part of the code is about ensuring companies and organizations develop and implement the right practices. It does this by defining what it takes for electronic signatures and records to be accurate, trustworthy, confidential, trustworthy, reliable, and equivalent to their hardcopy counterparts.

If you look at it in another way, this section of code provides life sciences firms with a roadmap of what’s needed to digitize records and signatures and move them from physical storage to electronic storage, whether that’s on an in-house server or in the cloud.

Some 21 CFR Part 11 Examples

Now that we’ve gotten some of the basics out of the way, it’s time to consider a handful of 21 CFR Part 11 examples and definitions.

What’s an electronic record?

You can think of electronic records as any type of information or document that might be digitized and then stored in an electronic format. For instance, a white paper could be digitized and then stored online. Patient medical history, research and development documents, pharmaceutical research, and so much more fall into this category. The FDA puts it this way: Any combination of text, graphics, data, audio, or pictorial information represented in digital form that is created, modified, archived, retrieved, or distributed by a computer.

What is an electronic signature?

An electronic signature is nothing more than digital information that is used to verify an individual’s identity. It could be an actual digitized version of a handwritten signature, but it could be something much more ephemeral – a username, password, and timestamp, for instance. It could be a password and a physical item that a user must have to log into a system, such as an ID card with a barcode that must be scanned. Or it could be biometric in nature – an iris scan, a fingerprint, or even DNA.

The FDA defines it as:

A compilation of any symbol(s) executed to be the legally binding equivalent of an individual’s handwritten signature.

What is a digital signature?

It might seem strange to have a separate definition of a digital signature from an electronic signature, but it comes down to intended and usage. The FDA defines it as: An electronic signature based upon cryptographic methods of originator authentication, computed by using a set of rules and a set of parameters such that the identity of the signer and the integrity of the data can be verified.

21 CFR Part 11 Examples: How It Applies to Life Science Applications

Given that 21 CFR Part 11 is focused on the protection and regulated access of data within an organization, we can draw some conclusions about how the code applies to life science organizations. However, we should explore some examples to really highlight what your organization needs to do for compliance.

All systems that manage electronic records and processing are required to have specific features. This includes your learning management system and all other similar systems. Some of the features that must be present include clear audit trail functionality, a system to ensure record retention, mandatory file formats, policies on setting and using electronic signatures, and procedures for handling data security and integrity.

You also need standard operating procedures that govern and describe how your organization does things. This is particularly true for your IT infrastructure, and include system maintenance, physical security, logical security, incident and problem management, system change controls, configuration management, disaster recovery, electronic signature policy, and backup/restoration policy. Note that these apply to all electronic systems, including your learning management system, as well as your network as a whole.

Finally, system validation is also critical. Any electronic system that will be used in regulated activities must be fit for its intended use. That includes your learning management system.

eLeaP Can Help

Struggling to find an LMS that fits the bill in terms of capabilities and ease of use, but still complies with 21 CFR Part 11? It can be challenging, but eLeaP’s platform delivers the usability and compliance you need. Contact us today to schedule a custom consultation on your needs.

21 CFR Part 11 has major implications for life science organizations. It deals with any system that processes or stores electronic records and focuses on information control and protection in the wake of increasing digital threats and growing data breaches. While you might automatically think of your accounting or payroll system, there are others that deserve your attention, including your LMS.

Ongoing learning and development is a vital consideration for today’s life science organizations. Training records are also one of the first things checked in an FDA inspection, so it pays to have the right LMS in place. One of the most important things to look for when it comes to choosing a validated LMS software, is the way it deals with 21 CFR Part 11 electronic signature requirements.

In this post, we’ll discuss what you need to know about electronic signatures, and what to look for when it comes to a learning management system that offers robust functionality in this area.

What Is an Electronic Signature?

An electronic signature is nothing more than a combination of several pieces of information that are used to identify an authorized user within the LMS. In Title 21 CFR Part 11, the FDA stipulates the following:

(a) Electronic signatures that are not based upon biometrics shall:

(1) Employ at least two distinct identification components, such as an identification code and password.

(i) When an individual executes a series of signings during a single, continuous period of controlled system access, the first signing shall be executed using all electronic signature components; subsequent signings shall be executed using at least one electronic signature component that is only executable by, and designed to be used only by, the individual.

(ii) When an individual executes one or more signings that were not performed during a single, continuous period of controlled system access, each signing shall be executed using all of the electronic signature components.

(2) Be used only by their genuine owners; and

(3) Be administered and executed to ensure that attempted use of an individual’s electronic signature by anyone other than its genuine owner requires the collaboration of two or more individuals.

(b) Electronic signatures based upon biometrics shall be designed to ensure that they cannot be used by anyone other than their genuine owners.

So, what does that mean for your LMS and the electronic signatures used within it? Let’s dig a bit deeper.

21 CFR Part 11 Electronic Signature Requirements within Your LMS

Your learning management system records, stores, and provides access to a very wide range of digital information. It’s crucial that it follows some specific steps to ensure that only authorized users are able to access the records it contains. Before any important task – logging in to the system, withdrawing from a course, completing a course, etc. – a prompt should require the user to provide their electronic signature information. There should be three components:

• The username/ID
• The user’s password
• The meaning or reason for the update

Only when all three of these components are used in conjunction can they be considered a 21 CFR Part 11 electronic signature, and only then do they carry the authority and authenticity of a “wet” signature. In addition, the username/ID and password must be correct for the user and for the intended purpose before the operation can occur. Contact eLeaP to see how we comply with Part 11.

For instance, suppose a learner logged into the LMS and requested access to a specific function – such as deleting test scores. In a properly set up LMS, access to that function would be restricted to specific usernames/IDs and individuals. If the credentials the user provides don’t match the list of authorized individuals, the system will not allow them entry.

This is just one example of how you might decide to configure your LMS to prevent unauthorized access to information and functions while preserving audit trails and accountability. Other potential examples include the following:

• Learning program completion form
• Withdrawal from course
• Course launch
• Course update
• Course deletion
• Course importing
• Course finish
• Exam launch
• Transcript details modified by reviewer
• Change in question/question status
• Manual answer/test grading
• Transcript/record details modification
• Training record editing

Only with the right combination of username/ID and password can any of the following actions be launched or completed. In addition, without accurate meaning details, the system should not allow the action to be launched or completed.

The Benefits of 21 CFR Part 11 Electronic Signature Requirements for Your LMS

While it’s easy to feel that 21 CFR Part 11 introduces burdens that life science organizations must bear, they also bring significant benefits as well. This is particularly true in a system where electronic signatures have been fully implemented. Some of the benefits offered include:

• Ensure that authorized users are able to access specific courses/modules/materials.
• Ensure that only administrators can access sensitive data.
• Ensure that all required previous modules/lessons have been completed prior to completing a course.
• Ensure that learners are able to access customized training plans specific to their certification, training, and career needs.
• Ensure protection against falsification of training records or unauthorized changes to the information in the LMS.

Finding the Right LMS for Your Organization

While it can be challenging to find an LMS that is validated to support electronic signature requirements, doing so is important. It’s not just about regulatory compliance, either. It speaks to information security, growth potential, and the ability to train and educate your team to help further the organization’s success.

At eLeaP, our learning management software has been fully validated and complies with all 21 CFR Part 11 electronic signature requirements. We invite you to contact us to schedule a custom CFR Part 11 consultation and to see how we can support your learners.

The right learning management system can offer some pretty important benefits for your business. However, there are many things that must be considered, whether you have an LMS already in place within your life sciences company, you’re looking to migrate to another platform, or you’re interested in finding your first one. One of the most important today is 21 CFR Part 11 compliance. These federal regulations represent the benchmark for all systems.

How do you know whether a particular LMS meets those requirements? There are several things you can do. First, browse through the LMS developer’s literature to find out if they state they comply with those regulations. If you cannot find any supporting evidence, it’s a good bet that they don’t. You can also look through the system’s features to ensure that it complies with the FDA’s rules and that it delivers the functionality that you need within your business.

What functionality is necessary for 21 CFR Part 11 compliance and your LMS, though? Actually, there are many things to consider. In this post, we’ll explore some of the most critical and what they mean for your life sciences company.

Reporting

Accountability, traceability, and audit capabilities are at the core of 21 CFR Part 11 compliance. The right LMS offers the ability to generate reports that provide access to critical information for administrators and users. Make sure that the LMS you choose can generate reports in the formats that are right for/used within your organization. For instance, if you usually need PDFs, then choosing an LMS that only offers CSV exporting is likely not the right decision. Other formats that might be important for your life sciences business include HTML and Excel. Ideally, the LMS you choose will offer the ability to export in all four formats.

Versioning

How many versions of each course are out there? How much control do you have over the ones in use within your organization? If yours is like many other life sciences businesses, chances are good that you have limited control or might not even be aware that multiple versions exist. That can lead to serious problems for your learners (and issues with 21 CFR Part 11 compliance, too). The right LMS gives you direct control over the different course versions, providing you with the ability to provide information about the course version completed by an employee during an audit or even provide that information in a digital transcript.

E-Signatures

Electronic signatures are part of the foundation of the FDA’s rules. What is an electronic signature, though? Really, this is nothing more than the combination of information used by an individual to access your system – a username, and password, combined with specific course version, login time, and other information. All of this data must be captured and used as a legally binding digital signature considered under the law as the equivalent of an individual’s handwritten signature.

Audits

Auditing is a critical consideration for all learning management systems, but even more important when it comes to complying with the FDA’s mandates. Changelogs, user tracking, who initiated changes, when those changes were initiated, and when they occurred – these are all examples of data that must be tracked and identified within an audit. It provides accountability and traceability, helping to ensure the safety and security of the system and the information it contains. Auditing includes several different areas of the LMS, including sessions, courses and modules, exams, transcripts, courseware, and more.

Data/Record Storage

In order to comply with FDA regulations, the LMS must include a constant recording feature. This is a proactive tool that ensures information is saved and stored against future needs without administrators having to set recording rules manually. The right LMS will include electronic storage that supports automated inspections, auditing, and in-depth reporting.

Secure Platform

Platform security is a major concern when it comes to learning management systems. The right LMS will be cloud-based, always up to date, and will include state-of-the-art encryption to help safeguard data, user accounts, and other assets. Make sure that any LMS you consider offers a guarantee of security and reliability for any information stored within the system.

Additional Considerations with an LMS

For life sciences businesses, it’s important to ensure any LMS you choose offers 21 CFR Part 11 compliance, but you should also look for a few other benefits and features that will make life easier for your administrators while also ensuring that your learners have a positive experience.

• Automatic Training Plans: Does the LMS automatically generate training plans based on certification conditions, renewal requirements, time from the last assessment, and career path?
• Always Updated: Does the LMS developer handle updates and maintenance? This can take a significant burden off your in-house IT talent and allow them to focus on mission-critical tasks.
• Upskilling and Career Advancement: Does the LMS offer the ability to handle upskilling for individual employees? Can you use it to help your employees move forward in their careers?
• Ensure Learning Sequence: Does the LMS ensure that learners have completed earlier modules before allowing them to access more advanced modules? Module/lesson sequencing is a significant concern for information mastery.

Is eLeaP the Right LMS for You?

21 CFR Part 11 compliance is critical for life sciences companies. The right LMS is part of that compliance. At eLeaP, we offer a cloud-based solution that is always secure, always up to date, and fully compliant with the FDA’s rules and regulations. We invite you to start your free trial now or get in touch with us to schedule a custom consultation.

While the FDA’s rules for life science organizations and how they handle electronic records and electronic signatures have been out for some time, many companies find compliance elusive. At eLeaP, we understand how challenging it can be to comply with government mandates, particularly when the information you need is written in legalese and so difficult to understand. We created this 21 CFR Part 11 checklist PDF to help simplify matters and ensure that you’re able to move forward. You can download a PDF version of the CFR Part 11 checklist here.

21 CFR Part 11 Checklist PDF Part 1

Systems Overview

• Is the system a closed system?
• Is the system an open system?
• Does the system already use a username/ID and password combination for access?
• Does the system utilize session tokens?
• Does your system make use of biometrics like fingerprints or iris scanning?

Systems Validation

• Is the system validated?
• Does the system have validation documentation?
• Does that validation documentation list compliance areas?

Systems Record Control

• Does the system highlight altered records or invalid records?
• Does the system allow access to the entirety of an electronic record?
• Does the system create accurate copies of electronic records digitally and in hardcopy?
• Does the system support sharing record copies with FDA inspectors?
• Does the system maintain and make records available throughout their required period of retention?

System Access Control

• Does the system support limited access and ensure that only authorized users can access sensitive data?
• Does each audit trail contain a timestamp, date, and all actions taken by a user?
• Does the system maintain older information when changes take place?
• Does the system make audit trails available for all records throughout their required retention period?
• Does the system make all audit trails available for review by the FDA?
• Can inspectors view, print, or save specific portions of the audit trail?

System Enforcement and Assurance

• Does the system enforce a specific set or sequence of steps or events where necessary?
• Does the system ensure that only authorized individuals can log in?
• Does the system ensure that only authorized individuals can sign records?
• Does the system ensure that only authorized individuals can access operations?
• Does the system ensure that only authorized individuals can alter a record?
• Does the system ensure that only authorized individuals can perform actions?
• Does the system ensure that only authorized devices and IP addresses have access?
• Does the system check for the validity of any input devices or data sources?

System Training and Documentation

• Is there documented training available detailing how the system is used?
• Is that training available to users, IT teams, and others?
• Is on-the-job training available?
• Do you have a written policy that makes all employees/system users accountable and responsible for their actions?
• Is there a policy for distributing, accessing, and using system operations and maintenance documentation?

System Information and More

• Is access to sensitive system information limited to specific users/electronic signatures?
• Does the system have a formal change control procedure that maintains an audit trail complete with date, time, and electronic signatures for all changes?

System Controls

• Does the system have controls to ensure the confidentiality, authenticity, and integrity of all records?
• Is the system’s data encrypted?
• Do signed records contain the meaning of a signing, the printed name of the signer, and the date/time of the signing?
• Does the information in the previous step show on printed and digital copies of all records?
• Does the system automatically record time and date stamps?
• Are time and date stamps consistently presented in the same format to ensure accuracy and understanding?
• Are time and date subject to the same controls as all other information in the system?
• Are all changes to electronic signatures part of the audit trail?

Linking Signatures to Records

• Are all signatures linked to their respective electronic records?
• Are all signatures protected against falsification and/or duplication?
• Are handwritten signatures linked to electronic records where applicable?
• Is the signer prompted to re-sign if an electronic record is changed?
• Are all electronic signatures linked to their electronic records for security?
• Are all electronic signatures unique to individual users?
• Do you have a policy preventing the re-issuance or re-use of signatures?
• Does the system verify a user’s identity before creating/assigning an electronic signature?
• Do you have a procedure in place to deal with forgotten/lost credentials?

Signatures and Controls

• Does the system automatically time out and require users to sign back in periodically?
• Does the system require re-authentication of signatures during continuous sessions?
• Does the system require full re-authentication of signatures between sessions?
• Do you have a policy regarding users “sharing” their non-biometric signatures with other people?
• Are there controls in place to ensure that all signatures and their components are authentic?
• Is there a procedure in place that requires users to periodically change their username and password?
• Do passwords automatically expire after a specific period?
• Is there a means to disable a signature/set of credentials if the information is compromised or lost?

Beyond the 21 CFR Part 11 Checklist PDF

As you can see, there’s a lot that goes into ensuring compliance with 21 CFR Part 11. What’s more, these steps apply to all electronic systems your life science company uses, from payroll to learning and development. Each system must be validated to ensure that it meets the requirements we’ve discussed above. That can be challenging and time-consuming. You can also download the whitepaper “How to Prepare for a 21 CFR Part 11 FDA Inspection“.

At eLeaP, we’ve done your due diligence for you. Our LMS is fully validated and compliant with 21 CFR Part 11, allowing you to save time and hassle while still taking advantage of the modern technology today’s businesses and learners need. Contact us today to schedule your custom consultation and to learn more about our cloud-based learning management system.

Biotech companies, pharmaceutical firms, medical device manufacturers, and other life science companies must comply with the rules laid out in 21 CFR Part 11 by the FDA. One way to ensure that you’re able to do that moving forward is to create a training/certification course and make it part of your learning management system.

However, you need to ensure that your course delivers the quality training necessary, covers the areas required, and meets the onus of these federal regulations. In this guide, we’ll explore the components of a 21 CFR Part 11 certification training course to help ensure that you’re able to create a valuable business asset that will offer value for years to come.

Creating a 21 CFR Part 11 Certification Training Course

It’s important to remember that you will likely have employees from many different areas of the business taking the same course. Therefore, you need to ensure that it’s able to serve the needs of those many people. It may also be worth considering setting specific learner paths through the course modules specific to each learner’s responsibilities within the organization. With the right LMS (and one that’s compliant with the FDA’s requirements), it’s simple to set not just learning paths, but also to limit access to information, functions, and features within the system.

Take the course, “The GAMP Approach to 21 CFR Part 11 Compliance” to stay up to date and relevant.

Part 1 – An Overview of 21 CFR Part 11

The first module should be an introduction to 21 CFR Part 11 and what it is focused on. Namely, this section of the federal code of regulations deals with electronic records, electronic signatures, data access, and information security. As the value and availability of data have increased, it’s attractiveness to bad actors has as well. The dramatic rise in data breaches in recent years is evidence of this. The rules laid out in 21 CFR Part 11 evolved to deal with that situation.

Note that this part should also contain some background on 21 CFR Part 11. After all, it was initially rolled out in 1997, and final guidance was not issued until 2007. Background information will help learners to understand more about why the rules are as they are.

Part 2 – Current FDA Interpretation

The FDA has issued guidance documents for life science companies dealing with 21 CFR Part 11 that help to explain the rules and regulations, how they apply, and more. This module should walk users through the current FDA interpretation of Part 11.

Part 3 – Requirements Explained

With the background and the current FDA interpretation out of the way, it’s time to introduce your learners to the 21 CFR Part 11 requirements. These need to be laid out and explained as clearly as possible. Ideally, you will be able to provide the FDA requirement and then an explanation side by side. For instance, something similar to this format, which deals with learning management systems (electronic systems that store records/data all fall under the FDA’s mandate):

Part 4 – Practical Examples

The next portion of your 21 CFR Part 11 certification training course should cover some practical examples of the rules and regulations. Because Part 11 deals with electronic records and electronic signatures, there are lots of potential practical examples that can be used, including the following:

• Examples highlighting the need for good password hygiene
• Examples highlighting unauthorized access attempts
• Examples highlighting the need for accountability and traceability
• Examples showing the use of usernames and passwords, plus other components
• Examples showing the need for and binding legal nature of electronic signatures

Part 5 – Creating a Compliance Plan

While users will need to comply with FDA mandates while executing their regular duties, those mandates must be embodied in a compliance plan created and executed within your business. This module should walk decision-makers and other stakeholders through the process of creating a compliance plan and should include a broad range of information, including:

• How you will validate software systems
• How you will enforce username/password rules
• How you will determine and then set user access restrictions

Part 6 – How Enforcement Works

The FDA doesn’t just set rules and then forget about them. Every year, they audit thousands of life science companies for compliance with 21 CFR Part 11. Of those, hundreds of companies are found to be out of compliance and are issued warnings. This module should highlight metrics and trends in the FDA’s enforcement of the organization’s regulations to help your teams understand the potential ramifications involved in a failure to comply. This section should include examples of warning letters, what to expect during an FDA inspection or audit, and more.

Part 7 – The Future

21 CFR Part 11 is not a static document. It’s a living thing, and it will change over time, although that change might be incremental. In this section, highlight potential changes that might be coming in the future based on emerging threats and trends today.

The Right LMS Is Essential to Your 21 CFR Part 11 Certification Training

As you can see, there’s a lot that goes into your 21 CFR Part 11 certification training plan. The right LMS is a critical consideration here. Of course, the learning management system must be compliant with the FDA’s requirements, but it also needs to offer the functionality and ease of use your learners deserve and the scalability that you need. We invite you to learn more about how eLeaP can fit your needs and ensure compliance with FDA rules.

Learning management systems (LMSs) offer powerful benefits for companies in the life sciences industry. They deliver the means to provide training to all employees quickly, easily, and through a central platform. They offer ease of tracking and monitoring and can even provide the opportunity to author your own content in some cases. However, not all learning management systems comply with federal law. For life sciences companies, it’s critical to find a 21 CFR Part 11 compliant LMS.

What is 21 CFR Part 11?

The 21 CFR Part 11 standard was adopted by the FDA in direct response to the increase in cybersecurity threats and data breaches. It deals specifically with electronic records and electronic signatures, and details what is expected of hospitals, pharmaceutical companies, doctor’s offices, and other life sciences firms in terms of protecting digital records and the use of electronic signatures.

What Role Does an LMS Play in Compliance with 21 CFR Part 11?

For organizations that maintain or compile data on individuals, the right LMS is essential for complying with the federal mandates outlined in 21 CFR Part 11. Choosing the right learning management system is critical and will play a central role in how well-secured electronic records are, how to secure system logins are, and even whether unauthorized access attempts are noticed and logged.

Not sure how to choose the right LMS to ensure that you comply with 21 CFR Part 11? We’ll walk you through some of the must-have features and capabilities with the right learning management system below. You can also get a free 15-minute consult.

Data Protection

One of the first things to consider when choosing an LMS is whether or not it secures user data and prevents unauthorized access. The system should provide administrators with the ability to set access limits for users, ensuring that everyone has access to the information they need, but no more. Administrators should also be able to identify and then block suspicious users. Protecting user data is one of the core goals of 21 CFR Part 11.

Strong Login Protection

Another consideration when choosing an LMS for compliance with 21 CFR Part 11 is the level of login protection offered. Are usernames and passwords required to be completely unique? Does the system automatically prompt users to change their username and password regularly to ensure good hygiene? Some learning management systems that handle huge user loads may share the same login or have similar logins. It’s critical that every user has completely unique credentials and that they change their logins regularly. Learn more about 21 CFR Part 11 password policy.

Two Sets of Credentials

In the past, it wasn’t uncommon for systems to allow users to log in with just a password. However, a single set of credentials is not sufficient to prevent unauthorized access. Two sets of credentials, such as a username and a password, or even a password, and something the user might have with them physically, such as an ID tag, can provide stronger authentication. Two-factor authentication – a standard username/password plus digital verification through a smartphone or other mobile device – can provide even more protection.

Tracking Unusual Activity

While technology has advanced a great deal, it has yet to reach the point where it can determine whether multiple login attempts are due to user error or if there is malicious activity occurring. Your LMS must be able to track unusual activity so that you can check for patterns in behavior, lock down individual accounts, and take other corrective action to ensure that the data within the system remains safe and protected.

Real-Time Progress Monitoring and Reporting

Your learners must make progress – biotech, pharmaceuticals, R&D, and other industries are fast-paced, and it’s important that you’re able to approve new qualifications as quickly as possible. Make sure that your LMS provides you with real-time progress monitoring and reporting so that administrators can see at a glance where employees are in their courses in real time. Your LMS should also include an e-Signature-required setting, which provides administrator control over qualification approval and helps ensure compliance with 21 CFR Part 11.

Course Update Control

New discoveries, advancements in research and development, new materials – all of these lead to the need for updates to your learning management system content. Not just that, but there will be system-wide updates and patches that address functionality, flow, security, and other considerations within the LMS itself. To comply with 24 CFR Part 11, you must have strong version control so that course updates and system updates can be communicated to learners.

Automatic Timeouts

A lot of attention is paid to authorization for logging in, but security threats can also be present if a user leaves their login unattended. Both cyberattacks and in-person threats can compromise data security in these instances. Make sure that the LMS you choose uses automatic timeouts. These will automatically log any user out after a specified period of inactivity, helping to reduce the chance that a user’s account could be hijacked.

Periodic Password Identification

Similar to automatic timeouts, make sure that the LMS you choose requires users to periodically reenter their passwords during a session. This helps eliminate the possibility that an account might be compromised and ensures identity during a learning session. You should be able to configure the interval between login and re-authorization through the system’s control panel for compliance with 21 CFR Part 11.

Making Your Decision

We’ve covered some of the most important considerations for life sciences companies searching for a new LMS that conforms to the mandates in 21 CFR Part 11. The right LMS will ensure that you’re in line with federal requirements but also ensure your learners have a seamless experience and that your administrators have the tools they need to ensure a positive user outcome.

Life science organizations face a wide range of challenges today. The industry is increasingly competitive, for instance. Changing consumer demand, evolving audience demographics, price sensitivity – these are just some of the issues your organization faces. The Code of Federal Regulation (CFR) called 21 CFR Part 11 is that dictates how life sciences organizations handle electronic records and electronic signatures. We will link to the full text of the standard below.

You also must contend with increasing government regulation, such as 21 CFR Part 11, which deals with how your organization stores and accesses digital records, and the use of electronic signatures. Do those regulations apply to your learning management system? Absolutely, they do. However, the actual impact may not be quite what you expected. In this guide, we’ll take a look at what you should know.

What is 21 CFR Part 11?

21 CFR is a section of the Code of Federal Regulations. Part 11 specifically deals with:

• The use and storage of electronic records in all systems used within your business, including your learning management system
• The use, issuance, and control of electronic signatures in all systems used within your business, including your learning management system

According to the 21 CFR Part 11 full text and the subsequent clarifications and guidance offered by the FDA:

FDA considers part 11 to be applicable to the following records or signatures in electronic format (part 11 records or signatures):

• Records that are required to be maintained under predicate rule requirements and that are maintained in electronic format in place of paper format. On the other hand, records (and any associated signatures) that are not required to be retained under predicate rules, but that are nonetheless maintained in electronic format, are not part 11 records. We recommend that you determine, based on the predicate rules, whether specific records are part 11 records. We recommend that you document such decisions.
• Records that are required to be maintained under predicate rules, that are maintained in electronic format in addition to paper format, and that are relied on to perform regulated activities. In some cases, actual business practices may dictate whether you are using electronic records instead of paper records under § 11.2(a). For example, if a record is required to be maintained under a predicate rule and you use a computer to generate a paper printout of the electronic records, but you nonetheless rely on the electronic record to perform regulated activities, the Agency may consider you to be using the electronic record instead of the paper record. That is, the Agency may take your business practices into account in determining whether part 11 applies.

Accordingly, we recommend that, for each record required to be maintained under predicate rules, you determine in advance whether you plan to rely on the electronic record or paper record to perform regulated activities. We recommend that you document this decision (e.g., in a Standard Operating Procedure (SOP), or specification document).

• Records submitted to FDA, under predicate rules (even if such records are not specifically identified in Agency regulations) in electronic format (assuming the records have been identified in docket number 92S-0251 as the types of submissions the Agency accepts in electronic format). However, a record that is not itself submitted, but is used in generating a submission, is not a part 11 record unless it is otherwise required to be maintained under a predicate rule and it is maintained in electronic format.
• Electronic signatures that are intended to be the equivalent of handwritten signatures, initials, and other general signings required by predicate rules. Part 11 signatures include electronic signatures that are used, for example, to document the fact that certain events or actions occurred in accordance with the predicate rule (e.g. approved, reviewed, and verified).

How Does the 21 CFR Part 11 Full Text Apply to Your Learning Management System?

There are several obvious ways that 21 CFR Part 11 applies to your organization’s learning management system. These include:

• Electronic Records: Your LMS records and stores a very wide range of electronic records. These include things like employee training plans and schedules, test results, training analyses, and a great deal more.
• Electronic Signatures: Everyone who accesses your LMS must have their own electronic signature – the username/ID and password, combined with change-reasons and time/date stamps – that provide authorization for any actions taken or changes made within the system.

Does the FDA Really Care about Training Records?

Yes, the FDA can and will inspect your electronic training records. In fact, in many instances, training records are among the first inspected during a compliance audit. Therefore, it’s critical to choose an LMS that is built from the ground up with 21 CFL Part 11 in mind.

What Steps Must Be Taken?

The same steps need to be taken with your LMS as with any other electronic system your organization uses to record, store, or access digital records. These include:

• Validating: Validate the LMS to make sure that it is fit for your needs and usage scenarios. Make sure that the system’s features and capabilities match your requirements today, as well as in the future.
• Control Versions: You must have control over all versions of the courses contained within the LMS. Track revisions of content, new versions, training transcripts, and more.
• Auditing: Any change to data recorded by and stored in your LMS must include an audit trail that explains who, when, and why alterations were made.
• Reporting: You should have access to both granular and high-level information via built-in reporting tools within your LMS.

eLeaP Can Help

For most life science organizations, building an in-house LMS from the ground up to comply with the 21 CFR Part 11 full text is a daunting task. At eLeaP, we designed our groundbreaking LMS to provide all the functionality demanded by the FDA’s regulations and to empower you and your learners while simplifying compliance and delivering the quality training your team needs.