After years of prodding from the pharmaceutical industry, the U.S. Food and Drug Administration (FDA) published its final rule on 21 CFR Part 11, covering electronic documents and signatures, on March 20, 1997. Instead of marking that date as the beginning of its liberation from Babylonian information technologies, the pharmaceutical industry increasingly views Part 11 as another regulation, another hurdle, another $100 million headache.
"FDA came up with 21 CFR Part 11 in response to industry's request for regulatory guidance on how to use electronic documents and signatures," notes Tom Moran, vice president of the pharmaceutical practice of NCS Technologies (Piscataway, N.J.). "Pharmaceutical companies provided a great deal of input as the regulations were written and implemented. Before long, companies had forgotten the potential business advantages to compliance and focused instead on penalty avoidance. Only recently has the pharmaceutical industry rediscovered the business case for Part 11."
Pressure, Pressure, Everywhere
With mergers, generics and patent expirations pressuring pharmaceutical manufacturers to become more efficient, Part 11 compliance needs to become part of that success formula.
"Complying with Part 11 sooner, rather than later, allows managers to concentrate on operational efficiency that much sooner, and in a compliant manner," Moran says. "It would be great if companies viewed Part 11 not as a headache, but as an opportunity. Sure there's an implementation cost, but it is more than balanced by the benefits of automated processes, integrated systems, and the storage and sharing of electronic documents. Costs of implementing Part 11 are minimal compared with the cost of a violation, so it makes business sense to protect yourself. "
Part 11's obvious benefits are reduced paperwork and less reliance on manual information tracking--what used to be referred to as the "paperless" office. In fact, no industry has gone completely paperless, but some have reaped huge efficiencies by conducting important transactions electronically.
"We have saved more than $1 billion by changing our own business into an e-business and eliminating paperwork," says Doug Souza, vice president of process manufacturing at Oracle Corp. (Redwood Shores, Calif.). "Not having to handle paperwork has allowed us to dedicate human resources to more critical tasks. Today, we're able to access purchase orders, expense reports and HR transactions from anywhere in the world in a secure, auditable environment."
According to David Wilson, an information technology (IT) consultant and principal with Audit Solution (Kent, England), companies should not implement Part 11 just to make the FDA happy. "They should do it because it makes good business sense," he says. "Pharmaceutical companies spend 10 years and hundreds of millions of dollars pushing a drug through development. In the end, all they really have is data. And it had better be good data. If you can't trust your development and clinical data, you're in deep trouble anyway.
"So keeping FDA happy isn't the objective," Wilson adds. "The objective is quality."
Sanjay Mathur, chief technology officer at trustERA Inc. (Cupertino, Calif.), notes that although the pharmaceutical industry is already over-burdened with regulations, companies need to view Part 11 as an opportunity to streamline and renovate their processes, institute world-class security and data integrity and demonstrate to both FDA and their customers that their data is free of misrepresentation, alteration or tampering. "Paperless documentation can shave months off the time it takes to reach the NDA [new drug application] stage," Mathur says. "This idea of trustworthiness is usually associated with financial industries, but it should apply to every business, especially one that is so concerned with improving quality of life."
Kate Townsend, vice president for regulatory compliance and validation at Taratec Development Corp. (Bridgewater, N.J.), puts it most succinctly: "We view Part 11 as an opportunity to improve business operations."
Other Industries' Pursuit of Paperless
It's become too easy to criticize pharmaceuticals' Part 11 deficiencies by pointing out other industries' successes with highly secure paperless transactions. In defense of pharma, one could point out that other businesses operate in a relatively unregulated environment, implementing new information technologies at their own pace and in response to nothing but pressing business needs. On the other hand, pharmaceuticals' status as a pillar of our healthcare system suggests that its needs for security and data integrity should be without peer.
In telecommunications and banking, if data doesn't pass from one point to another in a secure, reliable fashion, the company might not be able to bill for service or even conduct critical transactions.
"That's an immediate pain point," says NCS Technologies' Moran. "Although pharmaceuticals are much more highly regulated than other industries, an analogous pain point doesn't really exist."
Nevertheless, observing other industries can be instructive. For example, Audit Solution helped a multi-national firm implement a Windows 2000 network into the English court system, which with 40,000 users at more than 400 sites requires very high standards for security, electronic signatures and document control.
"The entire project was done perfectly from day-one," says Wilson, adding that "installing the same system in a pharmaceutical company would not have been so easy."
"Part 11 compliance may seem new and scary to pharmaceutical companies," says Taratec's Townsend, "but financial service companies have used electronic transactions and security measures for decades. For example, the PIN numbers used at ATMs are equivalent to FDA's notion of an 'electronic signature.' Unfortunately, pharmaceuticals have not learned from other industries. They feel they have a unique problem. Folks at Taratec, many of whom come from the financial services sector, are amazed to see how far pharmaceutical companies lag with respect to electronic documents and signatures."
No, Please, After You!
Justin Neway, chief science officer at Aegis Analytical (Lafayette, Colo.), blames pharmaceuticals' difficulty with Part 11 implementation on the fast pace of, well, everything that has to do with getting drug products out the door. Neway says that pharmaceutical firms have "too many other fires that need to be put out," but adds that many drugmakers lack a clear mandate from management, lack coordination among internal constituencies and are afraid of being first.
"I've seen surveys suggesting that half of those polled don't think it's possible for the pharmaceutical industry to become paperless," Neway says.
According to some interpretations, Part 11 compliance can turn routine business practices into "mission impossible." Imagine a computer system that updates and sends documents to a client's site each time any form is updated, which may be several thousand times a day. Because Part 11 forbids automated login scripts, a human operator must log on to the computer for each update--clearly an impossibility. A possible workaround is to transmit data from a secure room or location, where workers need to sign in as they enter. That would eliminate some of the problems with automated login, but it requires implementation.
"Many regulations allow grandfathering of previous standard operating procedures, but not Part 11, which applies to legacy systems as well as new systems," Moran says. "There is a great need for creativity on both the technology and process side, which the regulations in fact allow. That's the 'cup half-full' interpretation. The 'half-empty' side is the burden of translating Part 11's relatively broad terminology into actionable specifics."
Even when companies commit to upgrading data systems, they face unanticipated problems, particularly migrating existing data into new computers. "The data can't simply be carried over on a box of diskettes," Audit Solution's Wilson says. "The company must show that the migration itself was secure and uncorrupted."
"In the pharmaceutical industry nobody wants to be the first," adds Oracle's Souza. "The first company to implement a fully-functional Part 11 system is probably going to get audited by the FDA. So firms have taken a wait-and-see attitude, preferring to watch their competitors go through the audits and clarifications, particularly in the area of electronic signatures."
Anyone See That 5-1/4-inch Floppy?
Pharmaceuticals and electronics have always had an uncomfortable relationship. During my stint as a pharmaceutical chemist in the late 1980s, scientists at our company were not permitted to purchase diskettes without approval from a computer purchasing committee, which met just once per month. Things have certainly changed, but the industry has had its share of close encounters of the IT kind. For example, its brush with enterprise resource planning systems in the late 1990s and, most recently, Y2K. In both cases, implementation/remediation took longer and were much more costly than anticipated--facts that taint industry's current view of IT projects.
Aegis' Neway says that during visits to top drugmakers he is still surprised at the lack of sophistication in their data systems, particularly at manufacturing sites.
"A lot of data is still found only on paper, which means that plants are still not enjoying the process stability, product quality and yield improvements that follow making data available to everyone in digital form," he says.
Audit Solution's Wilson says he once visited a site that had "3 million pounds worth of data on one disk in a server sitting under a desk." To make matters worse, the information wasn't backed up.
Wilson believes the industry's problems with Part 11 are partly its own fault and partly cultural. "Regulatory agencies wanted electronic data, and pharmaceutical companies said they wanted to submit it. When the government obliged with Part 11, the real problems became apparent because pharmaceutical companies had not realized the work required and the true cost."
When it comes to the pharmaceutical industry's unique culture, the hurdles are different. "You have a lot of very smart people of different backgrounds, all wanting to do things their own way," says Wilson. "Clinicians and scientists were never required to qualify their computer network infrastructure. Now they are, just like manufacturing has been for years, and they realize it's coming to 'do or die.' They can't escape Part 11 forever, and that fact is making them tremble.
"Y2K, at least, had a finite date for implementation, but Part 11 has no fixed date," Wilson adds.
The 'Not Invented Here' Mentality
Pharmaceuticals have also been guilty of a "not invented here" mentality vis-? -vis new technology, according to NCS Technologies' Moran. That is changing, as firms observe other industries and perhaps avoid painful learning curves that others have suffered through.
"There's a great pool of talent from other industries that could help pharma come to grips with its IT problems. We're now seeing senior pharmaceutical executives with no previous pharmaceutical experience. Melding the best 'outside' and 'inside' experience and best practices makes good business sense," Moran says.
A good example of what could be learned from other industries is image management. Part 11 implementation is even less advanced and understood for images than for documents, notes Janet Smith, vice president of quality and regulatory processes at Scimagix Inc. (San Mateo, Calif.).
"Pharmaceutical companies use the most amazingly primitive image repositories you can think of. We've seen rooms filled with hundreds of boxes of slides, or hundreds of image CDs, none indexed. Finding images takes so much time that companies will often choose simply to re-do experiments rather than look for old data."
As with electronic alphanumeric data, Part 11-compliant image storage allows image indexing, retrieval and easy communication of visual data across departments. Although her company specializes in GLP (good laboratory practices) image systems, Smith points out that any operation that uses visual or graphic data can benefit, particularly dosage and formulation, crystallization, particle size measurements, spectra for quality assurance/control, chromatographs and product degradation.
"Pictures can also assist in analyzing behavior of consecutive batches for process automation and optimization," she adds.
Action Plan for Implementation
Although Part 11 compliance is company-specific, every firm needs an action plan to assure implementation stays on track. At the very least companies must:
- have management commit to Part 11 compliance;
- make sure Part 11 is understood and accepted "in the trenches;"
- piggyback Part 11 compliance with other IT upgrades, for example laboratory information management systems;
- implement Part 11 in enough operations to make it part of company culture. According to experts, combining Part 11 implementation with other IT projects may offer economy of scale and a faster payback.
Because Part 11's deep, broad reach into pharmaceutical operations, companies must decide what areas to tackle first.
"Most companies would do well to adopt a reasonable, flexible Part 11 compliance plan that first deploys electronic document management," suggests Alex Abramov of Ernst and Young's pharmaceutical industry practice (New York). "Signatures require an infrastructure that you have to build, and the technology to validate such a system is not 100 percent there today. Companies should focus on document management first and add electronic signature capability later."
Assuming there's a one-size-fits-all strategy sitting on some consultant's desk that will help your company implement Part 11 is a big mistake. Part 11 requires planning, intelligence and dedication to the goals, rather than the mere trappings of the regulation: A simple check-list or software purchase will not do.
"Just about every asset management company that makes software is claiming full compliance today, right out of the box," notes Marty Osborn, vice president of product strategy for Datastream Systems (Greenville, S.C.). "And they're all lying because individual pharmaceutical companies require flexible systems tailored specifically for their business processes. It's just not possible to purchase off-the-shelf Part 11 products to cover every documentation scenario for every company."
Sidebar:
Solvay Pharmaceuticals' Five-Step Implementation Plan
Solvay Pharmaceuticals (Marietta, Ga.), believes it's ahead of the curve on Part 11 compliance because of its early adoption of a five-step implementation strategy.
Step 1: Develop a master plan comprising standard operating procedures for various phases of the project. This includes early communications with the U.S. Food and Drug Administration.
Step 2: Conduct employee training that emphasizes the importance of compliance. All new Solvay employees, except for sales personnel, are automatically enrolled in a Part 11 training class. The company plans to include its sales force some time in 2003.
Step 3: Create an inventory of legacy systems, noting which ones required remediation or upgrade. Eventually a working group comprised of information technology, quality assurance and validation professionals will act on this inventory. Critical to this phase is identifying vendors who aren't compliant and replacing them with those who are.
"Some vendors market their equipment as Part 11 compliant when in fact only parts are compliant," notes Joseph Northington, Solvay's vice president of quality assurance/quality control. "If that happens to be the norm for that piece of equipment, we will supplement or improve it, until fully compliant systems become available."
Step 4: Define the corrective action plan for the various systems.
Step 5: Implement a corrective action plan.
In drawing up priorities for its Part 11 plan, Solvay emphasizes operations that generate raw data, for example manufacturing, quality control and analytical development, followed by quality assurance, clinical, regulatory affairs and engineering. Legal and human resources have been excluded from the project.
"You have to focus on critical areas first; otherwise you'll never finish. It's great to be on the right track, but unless you keep moving the train will run you over," Northington says.
Even the best Part 11 strategy won't yield results overnight. Solvay is "two or three months" behind in the third part of its plan and doesn't expect to be fully compliant before 2010.
