Technology has dramatically changed our world in the last few decades. Today, we depend on our mobile devices for access to everything from news to work-related documents. Communication spans the ether, and data is more valuable than cash. That is why organizations in the US 21 CFR Part 11 regime are required to have systems that support this highly technical and critical work.

While it’s a brave new world for life science companies, it’s also one that lends itself to information theft and cyber-attacks. The dramatic increase in security breaches in companies of all sizes is evidence that no business is out of bounds for attackers and hackers. For life science companies, this poses some unique challenges, which the FDA attempted to address in the US 21 CFR Part 11 – the US Code of Federal Regulations section that deals specifically with electronic records and electronic signatures.

Unsure how these regulations affect your company’s L&D efforts? Don’t worry; we’ll walk you through what you need to know. There’s a lot to cover, but we’ll hit the high points.

Does US 21 CFR Part 11 Apply in Your Case?

There are a few basic questions you can answer here to help plot a course forward.

• Does your company fall under FDA oversight?

If so, US 21 CFR Part 11 affects you.

• Does your company use a computerized learning management system or intend to do so?

If so, the US 21 CFR Part 11 applies to you. Still unsure, check to see if your organization is covered under 21 CFR Part 11.

What Does US 21 CFR Part 11 Do?

While the entirety of 21 CFR covers thousands of pages, Part 11 is pretty specific. It deals with electronic records and electronic signatures within the computerized systems your company uses. Because learning management systems fall under this heading, your LMS must comply with 21 CFR Part 11.

The basic thrust of Part 11 is that:

• Electronic records (data) should be protected.
• User access to electronic systems and the data contained in them should be restricted.
• All changes and access to information should be linked to electronic signatures that are as trustworthy and authoritative as handwritten signatures.

On the surface, it seems like 21 CFR Part 11 is placing additional burdens on life science companies. However, the truth is that these new rules empower you to begin moving to a paperless future by laying the groundwork for how electronic records must be stored, protected, and accessed. Without this rule, your business would be limited to dealing with physical records and hardcopy signatures.

How Does an LMS Meet Those Challenges?

It’s important to state in the beginning that some LMSs won’t be up to the challenge set by US 21 CFR Part 11. This applies to both in-house developed systems and older systems developed by outside parties. In order to comply with the FDA’s requirements, an LMS must have some pretty specific features and capabilities, including the following:

• Audit Trails: One of the major focuses for the FDA is accountability/traceability. Audit trails are the solution to this. Your LMS must track, record, and report absolutely everything.

Moreover, it needs to provide access to that information in a range of formats, including within the system itself (via the dashboard, for instance), through printable reports, and also through digital reports that can be copied and shared (such as a PDF shared with FDA inspectors). What should your LMS record and report? Here’s a brief overview:

• User progress
• User changes
• User course progression and exemptions
• Unauthorized access attempts
• All changes to data (sequential, with full connection to who made the change, when, and why)
• Sets of triggered events (moving to module B after completing module A, for instance)
• Attempted access from unauthorized IP addresses/devices
• Electronic Signatures: Electronic signatures are considered legally binding and the same as a handwritten signature. They are tied to a username and password specific to each individual user within the LMS and should include multiple components, including the date/time, action taken, and the username taking the action or making the change. Electronic signatures must be inextricably linked to all relevant user actions and should be clearly visible, even if someone else makes changes to the same data at a later point. This information should be part of the audit trail.
• Data Security and Password Best Practices: Your LMS should make it easy to protect the information it contains. It should provide you with the means to set user roles and permissions, restrict access to sensitive information to those who need access and no one else, to set which devices and IP addresses can access the system, and more. User passwords and usernames must be unique and should be changed regularly. The LMS should also offer additional functionality, such as requiring a user to re-enter their password during lengthy sessions and requiring a complete login between sessions (it shouldn’t remember them from session to session).

Putting It All Together

We touched on some of the most important considerations above when it comes to complying with US 21 CFR Part 11 and the FDA’s requirements for your LMS. However, there’s more that you need to consider. This is particularly true when it comes to modern learning management systems – cloud-based systems offer the flexibility that you need, but not all of them are validated and compliant with 21 CFR Part 11.

Sorting through your options, vetting the various LMS platforms out there, and finding one that works for your life science business and complies with FDA rules can be exhausting and time-consuming. At eLeaP, we’ve done all the legwork for you. Our LMS is fully validated, fit for use, and compliant with 21 CFR Part 11 mandates.

In addition, our cloud-based system offers the flexibility, scalability, and ease of use you deserve. You can even author your own training content (or use our vast, built-in library). Contact us today to schedule a custom consultation.